DevDome Analytics: Visitor Tracker, Site Stats & Bot Detection

DevDome Analytics is a WordPress visitor tracker for real-time website statistics, traffic sources, sessions and outbound clicks. It reports known bots and AI crawlers separately from human visitors, so detected automated traffic does not inflate your visitor stats. A free DevDome account is required to process analytics events and generate reports through the hosted service. Site stats and real-time visitors Use DevDome as a traffic monitor to see visits as they happen and review website traffic over time. Key metrics appear inside WordPress; detailed web analytics reports in your DevDome dashboard cover periods from the last 24 hours up to 12 months. The reports include:

• Visitors, unique visitors, live visitors, pageviews and sessions.
• Top pages, traffic sources and referrers.
• Countries, devices, operating systems and browsers.
• Outbound link clicks, bot hits, AI crawlers and AI referral traffic.
• Pages per visit, session duration and bounce rate.

The live visitor count answers how many people are visiting now. These real time visitors are shown as aggregate traffic stats, without identifying WordPress user accounts. Page views and blog stats Review page views and post views in the Pages report to find popular posts and other frequently visited content. Per-page reports include visits, visitors, pageviews, referrers, outbound clicks, countries, browsers, operating systems and devices. For private reporting, the visitor counter and page view counter provide different measures: how many visitors arrived and how many pages they viewed. This website counter is part of your analytics reports; the plugin does not provide a public counter widget. Bot detection and AI crawler tracking Search engines, SEO crawlers, monitoring services and AI bots request WordPress pages. DevDome Analytics detects known crawlers and separates them from human traffic in your visitor analytics. Detected crawlers include Googlebot, Bingbot, GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Google-Extended, CCBot, AhrefsBot, SemrushBot and other known crawlers. Unknown, new or deliberately disguised bots may not always be identifiable. Known AI bots are also distinguished from search-engine bots, helping you see when services such as ChatGPT, Claude, Perplexity and Google-Extended access your content. The plugin reports detected crawlers. It does not block them. AI referral tracking identifies visits referred by supported assistants, including ChatGPT and Perplexity, separately from other traffic sources. Outbound click tracking and event tracking Track clicks on links that leave your WordPress site, including:

• Affiliate and product links.
• Partner websites.
• Social profiles and other external destinations.

The link click counter records outbound clicks in your reports. Clicks can be relayed through your own WordPress server so they can continue to be measured when ordinary third-party analytics requests are blocked. Event tracking also covers the documented page activity and, while Track Clicks is on, searches made through your site's search form. Search terms are limited to 200 characters. External services below lists the fields sent with each event. Cookieless analytics and First-Party Delivery General website analytics are cookieless on new installations. Track Returning Visitors is optional and disabled by default. Outbound click tracking can use random visitor and session identifiers when someone clicks an external link. With returning-visitor tracking off, those identifiers stay in memory for the current page. Outbound tracking can be disabled independently. First-Party Delivery is available on supported DevDome plans. When enabled, the analytics script is served from your own domain and events are relayed through your WordPress server using randomized paths specific to your site. This can reduce data loss caused by browser extensions and ad blockers that target known third-party analytics domains. No tracking method guarantees detection of every visit. Tracking settings and privacy controls You control collection through separate settings:

• Enable Tracking is the master switch.
• Track Returning Visitors controls recognition across days.
• Track Clicks and Track Outbound Links control click collection.
• Track AI Referrals controls AI referral identification.
• Track Bot Visits controls bot and crawler reporting.

Administrators and editors are excluded by default on new installations. You can exclude additional WordPress roles. The browser Do Not Track signal is respected by default. DevDome Analytics does not collect post content, WordPress user accounts, customer data, order data or activity inside wp-admin. It does not collect visitor form field values except the site's own search terms when tracking and click tracking are enabled. Full transmission and storage details appear below. Hosted reports without WordPress analytics tables DevDome is a lightweight Google Analytics alternative for WordPress. Analytics events are processed by the hosted DevDome Analytics service, with no custom analytics tables or analytics event storage inside your WordPress database. The WordPress Overview tab shows key metrics. Your DevDome account provides full traffic, referral, click, location, device and crawler reports. No visitor data is tracked or sent until the site is connected. The DevDome Tools dashboard's plugin catalog request and the connection-status check on the plugin's own screen are described under External services. AI and agent support On WordPress 6.9 and newer, DevDome Analytics registers WordPress Abilities for:

• Connection status and traffic numbers for the last 1, 7 or 30 days, matching the dashboard.
• Reading and updating every tracking setting.
• Testing the connection and obtaining the one-click connect link.
• Disconnecting and resetting data.

Compatible AI agents and MCP clients can discover and use these abilities when the site exposes them, for example through the official WordPress MCP Adapter. Every ability runs the same code as the plugin screen under the same administrator capability. Disconnect and data reset require explicit confirmation and are annotated destructive. Agent output never carries email addresses or the site token. On an unconnected site, only abilities you deliberately invoke contact DevDome: the confirmed connect-link request and the connection test. The pre-connection requests are detailed under External services.

1.1.2

• Bundled DevDome library 1.7.6: if you connect a DevDome account from the DevDome Tools dashboard, the Connect card now says exactly what is shared, including the list of active DevDome plugins and their versions. Sites that were already connected, and sites that never connect, send nothing new. See External services.
• Listing text rewritten: new title, short description, tags and a restructured description. No change to how the plugin works.

1.1.1

• Updates now work when the plugin folder belongs to another system user (shared DevDome core 1.7.4): a folder installed from a root shell or by an AI agent used to fail every update; the plugin now repairs the folder ownership itself when it can, and says exactly what to run when it cannot.

1.1.0

• Fixed: the tracker's inline configuration (Do Not Track, cookieless, click and outbound switches) never reached the tracking script on WordPress sites; the script tag filter dropped it. Every switch now applies.
• AI referrals: visits arriving from ChatGPT, Perplexity, Claude, Gemini, Copilot and similar assistants are labelled as AI referrals on the dashboard while "Track AI Referrals" is on.
• First-Party Delivery now serves the bot detector from your own domain too (bundled FingerprintJS BotD, MIT); Reset Analytics works (the service side answers it).
• Privacy: the redirect tag carries the path only (never a query string), Global Privacy Control is honoured everywhere Do Not Track is, the outbound-click detector stores nothing on the device in cookieless mode, secrets in error text are redacted before any cut.
• "Report this error" on every error banner sends the error text and context to DevDome support with one click.
• Database guard: every failed query is recorded, no write follows a failed read, every option write is read back; settings saves and the connect handshake report exactly what landed.
• Connect: the handshake fails closed, keeps its retry link until the connection is stored, and the shared library (1.7.1) never reports "not connected" after a failed database read.
• Abilities: start-connect and settings changes that collect more data need confirm: true; read abilities never call home; every ability answers a database error when a query failed.
• Multisite: uninstall cleans every site of a network; fresh subsites get the privacy defaults.

1.0.8

• WordPress Abilities API (WordPress 6.9 and newer): 8 abilities for AI agents and MCP clients through the official WordPress MCP Adapter: get-status, get-stats (1, 7 or 30 days), get-settings, test-connection, update-settings (read back before reported), start-connect (returns the approve link), disconnect and reset-data (both require confirm: true and are annotated destructive). Every write goes through the same handler as the screen. Agent output never carries e-mail addresses or the site token.
• Disconnect now checks the account server's answer and says when the site could not be unlinked remotely.
• Security review fixes: a disconnect stays a disconnect even when the account server could not be told (no silent re-link); the master tracking switch and the Do Not Track signal are enforced at every sending point, including beacons from pages cached earlier and bot reporting; the click switches are honoured by the first-party tracker copy; settings saves report what was actually stored; an agent must confirm before a change that collects more visitor data; the generated first-party script is never written or deleted through a symbolic link; the relay credential is removed on uninstall when Delete data on uninstall is enabled; the site-search term disclosure was added to the readme.
• The stats endpoint accepts 1 to 365 days only; agent error messages pass through the same redaction as results; the install notes no longer mention a manual Account ID step.

1.0.7

• Settings: every switch now shows a one line hint with an info icon holding the full explanation of what is sent and what turning it off changes, the same layout as DevDome Malware Scanner.
• DevDome Dashboard: installing another DevDome plugin from the dashboard no longer activates it, you activate it yourself from its card. Output escaping tightened.

1.0.6

• DevDome Dashboard: plugin list, descriptions, logos and versions now come from devdome.com, one-click install of DevDome plugins from WordPress.org, Docs link and Fix buttons, Activate stays on the dashboard.

1.0.5

• First-Party Delivery is honest about why it is unavailable: while the site is not connected the switch is disabled with a Connect button above it, and on the Free plan it shows "Included in the Pro plan and above" instead of switching itself back off. Plan changes now reach the screen within minutes.
• The manual Account ID connect option was removed. Connecting is always the one-click, signed-in flow.
• Disconnecting from the plugin now also unlinks the site on DevDome servers and clears every cached account detail, so every DevDome plugin on the site agrees immediately.
• The DevDome Dashboard (suite hub) was redesigned: cleaner cards, your account email and plan on the overview, and update buttons shown only when an update really exists.
• One button system across the suite: the same Connect button and the same Save Settings button in every DevDome plugin.
• New bug-report button in the page header.

1.0.4

• New: First-Party Delivery, an optional ad-block-resistant mode (off by default, included in the DevDome Pro plan and above). The tracking script is served from your own domain and events relay through your own site server-side with randomized per-site names, so ordinary blockers of third-party analytics domains cannot drop them. Bypasses most, not all, blockers. Every relayed field is validated and sanitized, identity always comes from the plugin's own settings, and the relay accepts only same-site browser requests.
• Connecting works again for fresh installs: the plugin serves a one-way fingerprint of its site token at /.well-known/devdome-connect-proof.txt, which the DevDome service verifies against your site before accepting the connection. No token, secret, or visitor data is exposed by it.
• One connection, both sides: a site connected through the devdome.com dashboard now shows as connected in wp-admin by itself, and if the site is removed or its token rotated on the dashboard, the plugin flips to disconnected with a clear notice instead of staying green while calls fail. A local Disconnect always sticks.
• Fixed: the Overview tiles never loaded on sites using plain permalinks (the WordPress default). They now show the same numbers as the DevDome dashboard everywhere, and an unavailable answer leaves the placeholders instead of showing zeros.
• First-Party Delivery hardening: forwarded visitor IP and country headers are trusted only when the connection they arrived on vouches for them; events relay correctly on subdirectory and subdirectory-multisite installs; relayed forwards no longer block the visitor's request; in-app (social webview) visits keep their traffic source; the served script copy is refreshed only when its content really changed; and the /dd-e click endpoint requires the browser's own same-site Origin header too.
• The tracking script used for First-Party Delivery ships inside the plugin package and is copied, never downloaded, into your uploads folder.
• Turning First-Party Delivery on requires a real answer from the plan check; an unreachable service or a rejected credential no longer enables it, and a rejected credential switches it off with a notice instead of silently losing events.
• Toggling First-Party Delivery clears common page caches so cached pages stop beaconing to a stale endpoint.
• The daily refresh event is removed on plugin deactivation, and uninstalling always cleans up the cron event and the generated script file.
• The plan check sends the site token in a request header instead of the URL.

1.0.3

• New optional First-Party Delivery mode (off by default, included in the DevDome Pro plan and above): the tracking script is served from your own domain and events are relayed through your site server-side, using randomized names unique to your site, so ordinary ad blockers that block third-party analytics domains cannot drop them. Bypasses most, not all, blockers. Every relayed field is validated and sanitized before forwarding, identity always comes from the plugin's own settings, and the forward authenticates with your site token. All other tracking is unchanged on every plan.

1.0.2

• Unified DevDome suite icons and updated the suite hub with one-click installs for WordPress.org plugins.

1.0.1

• No request is made to DevDome before you act: the one-click connect link is now requested only when you press "Connect Via DevDome Account", and the account check no longer runs until a connection has been started or completed. Off by default, opt-in by a button press.
• The connect screen now says exactly what connecting sends before you press the button.
• Every field of the relayed outbound-click event is individually validated and sanitized before it is forwarded, and the site and account identifiers in it now always come from the plugin's own settings, never from the request body.
• Request paths and IP addresses read from server variables are sanitized where they are read.

1.0.0

• First release on WordPress.org.
• The admin screen's styles and behaviour now load as enqueued files instead of inline blocks.
• The tracking snippet is enqueued too: the plugin no longer writes script tags into the page markup. Outbound-click counting is unchanged, including on sites where a blocker stops the tracker file from loading.
• Internal rename: every function, class, constant, option and transient the plugin owns now carries its own identifier prefix. Existing settings and your DevDome connection are carried across automatically.
• Fixed a fatal error that could break wp-admin on sites running several DevDome plugins when this one loaded first.