Kantan Analytics
| 开发者 | inglewood |
|---|---|
| 更新时间 | 2026年8月4日 04:21 |
| PHP版本: | 7.0 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Kantan Analytics is a self-hosted WordPress analytics plugin that tracks visitors, sessions, journeys, and conversions — without cookies, external services, or data ever leaving your server. A private, self-hosted Google Analytics alternative: every metric lives in your own database. You own it.
Kantan keeps every metric in your own database and answers the questions you actually have: which pages convert, where visitors come from, who keeps coming back, and what changed this week. The dashboard installs in a few minutes and runs in the WordPress admin sidebar you already use.
Privacy by architecture
- No cookies. Browser localStorage only — no consent banner required in most jurisdictions, no cross-site tracking possible.
- No IP storage. The visitor's country is resolved from a bundled offline database at tracking time (region is optional — bring your own city database); the raw IP is used only for that lookup plus the exclusion/rate-limit checks, and is never written to disk.
- Nothing phoned home. Every metric stays in your WordPress database and Kantan never sends your data to us. One optional integration — the Attribution Webhook, off by default — can forward conversions to a webhook URL you choose (e.g. your own CRM); see the Privacy section.
- Configurable retention. Raw session detail purges on the schedule you set (default 90 days). Daily aggregates live in a local SQLite file forever.
- Bots and admins filtered. Logged-in admins, common bots, and IPs you specify are excluded before anything is recorded — your numbers reflect actual humans.
- Sessions, pageviews, bounce, duration — trended across any date range, with device, browser, OS, and screen-resolution breakdowns
- Traffic sources & UTM tracking — organic, direct, referral, social, paid; UTM parameters captured on first touch and attached to every conversion in the session
- Click heatmaps & scroll depth — recorded per-page, per-element, no external script
- User journeys with named visitors — every visitor gets a persistent ID and a generated three-part name (e.g. "Roaming Copper Wren") so long journeys are actually legible across return visits
- Page-to-page flow — see exactly which path your best visitors walk, and where the rest drop off
- Conversion tracking — phone, email, directions, bookings, plus auto-detection of form submissions from Contact Form 7, WPForms, Gravity Forms, Formidable, Ninja Forms, Forminator, and others
- Long-term aggregate storage — daily totals kept indefinitely in a local SQLite file even when raw rows are purged on schedule, so five-year trend lines don't require holding five years of personal data
claude mcp add command connects Claude Code (or any MCP client) to 18 read-only, typed analytics tools at /wp-json/kantan/mcp — built on the WordPress Abilities API, no separate credential scheme, nothing writable by an agent.
Built for self-hosting
- Free forever, GPL v2
- No accounts, no signups, no SaaS dashboard
- Runs on any standard WordPress install (6.9+, PHP 7.0+)
- ~2 MB plugin, 5–50 MB/year of data depending on traffic
- Extensible sidebar tab system — companion plugins like Kantan SEO snap in alongside the analytics tabs
安装:
- Upload the plugin folder to the
/wp-content/plugins/directory, or install it through the Plugins screen in WordPress. - Activate the plugin through the 'Plugins' menu in WordPress.
- The database tables are created automatically on activation.
- View your analytics at Analytics in the admin menu.
屏幕截图:
常见问题:
Does this use cookies?
No. Kantan uses browser localStorage to recognise returning visitors, never cookies. No consent banner is required in most jurisdictions, and no cross-site tracking is possible.
Where is the data stored?
All data is stored in your WordPress database in wp_kantan_* tables, with daily aggregates in a local SQLite file under wp-content/uploads/kantan/. Nothing is sent to external servers.
How is traffic source detected?
The tracking script categorizes referrers automatically:
- Organic: Google, Bing, Yahoo, DuckDuckGo, Baidu
- Social: Facebook, Twitter, Instagram, LinkedIn, Pinterest, TikTok
- Referral: Other external sites
- Direct: No referrer or same domain
Does this slow down my site?
No. The tracking script loads asynchronously after page content and uses sendBeacon for exit tracking. There are no blocking requests, no third-party domains, and no external CDNs. Performance impact is well under 10ms.
Is this GDPR / CCPA / ePrivacy compliant?
Kantan is designed for privacy-first compliance under modern privacy law: no cookies, no IP storage, no cross-site tracking, and — unless you switch on the optional Attribution Webhook — no data leaves your server. In most jurisdictions you do not need a consent banner to use it. We're not lawyers — confirm with yours — but architecturally the tool is built for privacy-first compliance rather than retrofitting it.
Will this work with caching plugins (WP Rocket, W3 Total Cache, etc.)?
Yes. The tracking script is loaded via standard wp_enqueue_script and runs client-side, so cached pages still record visits correctly. The only thing to watch for is plugins that delay or defer JavaScript so aggressively that visitors leave before the script fires — exclude kantan-analytics/assets/tracking.js from any "delay JS until interaction" rule and you'll be fine.
Can I import data from Google Analytics?
Not currently. Kantan starts tracking the moment you activate it, and historical GA data has a different structure that doesn't map cleanly. If GA→Kantan import is something you need, drop us a note at https://trykantan.com.
What happens to my data if I deactivate the plugin?
Nothing — your data stays in the database. Deactivating just stops new tracking and hides the dashboard. If you uninstall (delete) the plugin, the tables remain unless you explicitly drop them; this is standard WordPress behavior and lets you reactivate without losing history.
How do I exclude my own visits, or specific staff IPs?
Logged-in admins are excluded by default. The Settings tab also lets you exclude specific IP addresses (one per line). Common bot user-agents are filtered automatically.
What's the AI agent?
A downloadable .md file from the dashboard that turns any AI coding agent (Claude Code, Gemini CLI, and compatible tools) into a read-only analyst for your site. It uses a WordPress application password you generate, calls the REST API, and answers questions in plain English. It only reads — nothing it sees leaves your terminal unless you ask.
Does this work with WordPress multisite?
Yes — install at the network level or per-site. Each site gets its own tables and its own dashboard. There's no aggregated network-wide view yet; that's on the roadmap.
更新日志:
2.29.0
- Fixed: bot filtering now applies to every metric. It was only reaching your visit count, bounce rate and duration — device breakdown, visitor counts, top pages, journeys and campaigns were all still counting bots. That's why the same 30 days could report 29 visits and 78 device sessions. All figures now describe the same set of visitors.
- Fixed: bot detection now catches two kinds it used to miss — sessions that view several pages while accruing no time at all (these never bounce, so the old rule never saw them, yet they dominate the journey and page-flow reports), and traffic reporting an 800x600 viewport, which is the headless-browser default rather than a real screen.
- Fixed: 800x600 traffic is no longer counted as a tablet. If your tablet segment showed unusually high bounce and short visits, this was why.
- New: exclude specific date ranges from every metric, under Settings. For the days no rule can sensibly catch — a load test, a migration crawl, a scraper that browsed like a reader. One such day can outweigh months of real traffic in your baselines.
- New: email, paid and campaign traffic sources. A visit tagged
utm_medium=emailwas previously reported as direct, because email clicks arrive with no referrer. Any visit carrying autm_mediumis now attributed to it, for the whole visit rather than just the landing page. - Fixed: pages no longer split across multiple rows because of email and ad tracking parameters. Mautic's
ct, HubSpot's_hsenc/_hsmiand newer ad click ids are now stripped, and cleanup also runs on the server so it works even when a cached script misses it. Existing split rows are merged once on upgrade. - Fixed: conversions now say when no rules are configured, instead of reporting zero. Zero conversions because nothing is being watched looked identical to zero because nobody converted. Kantan also suggests rules based on buttons your visitors already click and the paths they already take.
- Fixed: the UTM report counted rows and labelled them sessions, and skipped bot filtering entirely, so it disagreed with the traffic report. Both now count the same way. For "how much traffic came from this channel", the traffic report remains the authoritative one.
- Fixed: conversion links on your own domain now work. A rule like
/checkout(or a full URL on your own site) matches by path prefix; previously a same-site rule either never matched absolute link URLs or — if it contained your own domain name — counted every internal link click as a conversion. Outbound-domain rules are unchanged.
- New: an MCP setup card in the dashboard's AI Agent section — live status (detects your WordPress version and the MCP Adapter plugin), the exact one-command Claude Code connection for your site, and install guidance when the adapter is missing. Fully translated (Deutsch, Español, Français, Italiano, 日本語).
- Fixed: the downloadable agent pointed to a wordpress.org listing for the MCP Adapter that doesn't exist — it now links the official GitHub release. Agent template is v2.0.1; installed agents update themselves automatically.
- New: MCP server — connect Claude Code (or any MCP client) to your analytics with one command. On WordPress 6.9+ with the MCP Adapter plugin, Kantan exposes 18 read-only, typed tools (visits, pages, traffic sources, conversions, visitors, journeys, clicks & scroll, videos, AI crawlers, Business Profile) at
/wp-json/kantan/mcp, built on the WordPress Abilities API. Kantan SEO's tools join the same server automatically. - New: the downloadable AI agent (v2.0.0) is now MCP-first with automatic REST fallback — installed agents update themselves within a week.
- The MCP surface is read-only by design: no settings, no writes, and nothing that spends money can be reached by an agent through it.
- Requires WordPress 6.9 or newer (the Abilities API). Existing installs on older WordPress keep working on 2.27.x.
- Fix: after updating to 2.27.0, the Realtime view could briefly show a burst of long-running "visitors" that were actually old sessions. The one-time IP purge was nudging each cleaned row's last-activity time to the moment of the update, so historical sessions looked active for a few minutes. Corrected — no analytics data was affected (visit counts, duration, bounce and sources were never touched) and the view now stays accurate.
- Security: the visit-tracking endpoint could be forged. Added per-IP flood limiting on new sessions and a read-time filter that keeps zero-engagement bot sessions (sub-two-second bounces) out of your visit counts, bounce rate, duration and sources — nothing is deleted, and it cleans up existing junk automatically. Toggle in Settings.
- Security: client IPs are now resolved only from trusted reverse proxies (Cloudflare, and local/private proxies), so a forged X-Forwarded-For can no longer spoof a visitor's IP or bypass IP exclusion. IP exclusion now supports IPv6.
- Privacy: the tracker no longer stores the visitor IP at all — it is used only for the exclusion and rate-limit checks, then discarded, so "no IP stored" is now true end to end. Any IPs written by earlier versions are purged automatically on update.
- New: visitor profiles expose the user agent so you can identify the source of suspicious traffic.
- New: visitor countries — a "Top Countries" breakdown resolved from a bundled offline database (no external calls, no IP stored). Region is optional via a bring-your-own city database. Country data by DB-IP (CC-BY).
- New: "View all" on Top Referrers — the dashboard block lists the top 10, and this opens every referrer in the period, with a filter box to find one quickly. Each row still opens the referrer detail view.
- New: /referrers REST endpoint returns the full referrer list with a total count.
- i18n: new strings translated for German, French, Spanish, Italian, and Japanese.
- New: "Ask the agent" prompts on the Video and AI Crawlers tabs — one click surfaces copy-paste, data-specific questions for your Claude Code / Gemini CLI agent.
- New: /crawlers REST endpoint exposes AI-crawler activity to the agent, so it can report which AI bots hit your site, how often, and the split between live fetches and training crawls.
- Improved: the downloadable Analytics agent (v1.3.0) now understands video engagement and AI-crawler data — new /videos and /crawlers endpoints, workflows, and starter prompts.
- i18n: new strings translated for German, French, Spanish, Italian, and Japanese.
- New: Video analytics — engagement tracking for the YouTube, Vimeo, and self-hosted videos your pages already embed. No setup: embeds are detected automatically (including lazy-loaded and popup embeds).
- New: Video dashboard tab with plays, play rate, average watch time, and completion rate, per video.
- New: click any video for a detail view — plays by day, the pages it was watched on, and autoplay share.
- New: video settings — master switch, per-provider toggles, privacy-enhanced youtube-nocookie.com rewrite (on by default), and muted-autoplay exclusion so background hero loops don't inflate play rate.
- New: all video features fully translated in German, French, Spanish, Italian, and Japanese.
- Privacy: provider player scripts load only on pages that actually embed them; engagement is stored as anonymous aggregates in your own database. Privacy-policy suggestion text updated.
- Improved: dashboard dates now follow your site language (localized month names and AM/PM) instead of always showing English.
- New: the AI Crawlers tab is now fully translated in German, French, Spanish, Italian, and Japanese.
- Fixed: the Conversions and AI Crawlers tabs now group correctly under the localized "Analytics" heading in non-English languages.
- New: AI Crawlers tab — see which AI crawlers (GPTBot, ClaudeBot, PerplexityBot, CCBot, and more) are fetching your content, how often, and which pages. Tracked server-side (crawlers don't run JavaScript) and kept completely separate from your human visitor stats, with live-fetch vs training-crawl called out.
- New: analytics data is now tagged per property — groundwork for upcoming multi-site aggregation (Kantan Hub). No change to existing single-site dashboards; your tracking works exactly as before.
- Change: all updates now come from WordPress.org. The self-hosted updater has been removed; if you installed from trykantan.com, this update moves you across and you will keep receiving updates as normal.
- Improved: more of the dashboard now localizes — visitor and click detail subtitles, relative timestamps ("5 min ago"), scroll-depth tooltips, and site-scan/webhook status messages that were previously always shown in English.
- New: bundled translations for the admin dashboard — German, French, Spanish, Italian, and Japanese. Set your site or user language and the dashboard UI follows. (Chart labels and a few dynamic strings remain English for now and will be localized in a follow-up.)
- Security: the excluded-IPs and data-retention settings endpoints now require administrator access even for read requests.
- Change: the admin dashboard's tooltip styles are now enqueued as a stylesheet instead of inlined.
- Hardening: every visitor-tracking, UTM, conversion, and form input is now unslashed and sanitized at the point it is read, and the values forwarded to integration hooks are sanitized arrays rather than the raw request.
- Security: diagnostics and configuration endpoints (status, conversion links, attribution webhook config) now require administrator access even for read requests.
- Change: all admin and front-end JavaScript is enqueued through WordPress — no inline script tags remain.
- Change: bundled Chart.js updated to 4.5.1.
- Hardening: comprehensive output escaping across the admin dashboard, timezone-safe date handling, and URL parsing through WordPress core wrappers — aligning the plugin with the official WordPress.org plugin coding standards.
- Change: minimum supported WordPress raised to 5.6.
- Docs: clarified the privacy documentation to disclose the optional Attribution Webhook, which sends conversion data to a CRM endpoint you configure — and only when you enable it.
- New: Business Profile — a canonical, editable record of your business facts (hours, offerings, address/phone, brand voice, claims to make or avoid) under Settings → Business Profile. The downloadable AI agents now read it as ground truth before writing or rewriting content, so generated copy uses real facts and your voice instead of guessing. Your agent can even draft it from your site ("Draft my business profile"), and it's the same source of truth for both the Analytics and SEO agents.
- New: Attribution Webhook — send every conversion to your email/CRM platform (HubSpot, GoHighLevel, Salesforce, Zapier, Make, and more) with its first-party campaign + journey attribution, keyed by an anonymous visitor id. HMAC-signed; no personal data leaves your site. Set it up under Settings → Attribution Webhook / CRM, with a one-click "Send test".
- New: passthrough parameter capture — Kantan now captures ad-click and CRM contact ids from inbound links (gclid, fbclid, msclkid, contact_id, mkt_tok and ~45 more) and includes them in the webhook, so your CRM can join the conversion to the right contact. The captured params are stripped from stored URLs.
- Improved: the downloadable AI agent now officially documents Gemini CLI alongside Claude Code (it's the same Markdown format — drop it in ~/.claude/agents/ or ~/.gemini/agents/). The agent self-updates to this broadened version automatically.
- Improved: "Ask the agent" prompts now copy with the agent name prefixed, so the pasted prompt delegates to the right Kantan agent. Wording across the agent download is now tool-neutral.
- New: a "What about Codex?" explainer on the agent download covering why OpenAI Codex isn't officially supported yet (and how to use Kantan with it today).
- New: Scroll Depth by Page — the Interactions tab now breaks scroll depth down per page (with a visual bar), so you can see which pages get read versus abandoned instead of just a site-wide average.
- New: click a visitor's name on the Realtime tab (or in Visitor Profiles) to open their full visit history — every session, the pages they walked, durations, and conversions.
- New: Interactions drill-downs — click any Click Region to see exactly which elements were clicked there and on which pages, and click any row in Top Clicked Elements for its per-page breakdown.
- Improved: click tracking now records the actual link/button clicked (not the inner span or icon) with a clean, accessible-name-first label, and no longer captures whole-page text from stray clicks. Top Clicked Elements merges the same control across pages and filters out container/no-text noise — so the report finally reflects what visitors actually click.
- New: Top Referrers detail modal — click any referrer on the Overview dashboard to see its sessions, visitors, daily trend, landing pages, the exact referring URLs, and recent visitors.
- New: the Claude Code agent now keeps itself up to date — it checks for a newer version about once a week and refreshes in place, with no re-download and without ever rotating your API key. Added an "Update agent file" button and clearer "install once, use on every site" guidance.
- New: "Ask the agent" — a sparkle icon on dashboard data blocks (referrers, traffic sources, pages, journeys, interactions, devices, conversions) opens a modal of copy-paste, data-specific prompts for the Claude agent.
- New: AI-assistant referral attribution — visits are identified from utm_source as well as the referrer (catching empty-referrer ChatGPT/Perplexity/Claude links) and split per assistant; the Overview AI card shows the per-assistant breakdown.
- Fixed: Overview KPI cards lay out cleanly as 3-up / 2-up on laptop screens.
- New: an "AI Assistants" KPI card with sparkline on the Overview dashboard — shows visits referred by AI assistants and their share of total traffic at a glance.
- New: AI assistants (ChatGPT, Perplexity, Claude, Gemini, Copilot and more) are now a first-class traffic source. Visits referred by them are tracked and shown as their own "AI Assistants" category across Traffic Sources, sessions, the realtime tab, and conversions. Existing AI-referred visits are reclassified automatically on upgrade.
- New: the Claude Code agent gained an "AI Assistant Referral Traffic" workflow and an "Am I getting AI traffic yet?" starter prompt.
- New: a "Support & Bug Reports" card in Settings — a one-click email link that pre-fills your plugin, WordPress, and PHP versions plus your site URL, so reports arrive with the diagnostics we need to help. Settings and Support links now also appear in the WordPress plugins list.
- Fixed: the agent download dialog now caps its height and scrolls on short/laptop screens instead of overflowing off-screen.
- New: starter prompts in the Claude Code agent download — copy-to-clipboard example prompts (30-day summary, best/worst content, traffic-source ROI, visitor journeys) appear in the credentials modal and are written into the generated agent .md.
- Fixed: clicking a page row now opens the page-detail modal on every tab. The click handler was previously only present on the Overview tab, so page rows on Pages, Journeys, and the SEO tabs showed a hover state but did nothing when clicked.
- Fixed: the "Visits Over Time" chart on the Overview tab could render blank — the canvas had no sized container, so Chart.js collapsed it to zero height. It now renders in a fixed-height container.
- Fixed: IP exclusion and visitor IP logging now resolve the real client address through reverse-proxy/CDN headers (Cloudflare, nginx, load balancers) instead of always using the proxy's own address. On proxied sites the "Your current IP" box previously showed a private hop (e.g. 127.0.0.1 or 192.168.x.x), and excluding it had no effect. When only a local/private address is available, the box now flags it and links to an external IP lookup.
- New: optional read-only dashboard access. A user granted the
kantan_view_dashboardcapability can view the dashboard and its data withoutmanage_options— every write, scan, and sync still requiresmanage_options. The dashboard menu capability is filterable viakantan_dashboard_capability. Inert on normal sites; powers a public read-only demo.
- Security/clarity: the Claude Code agent download now states plainly that the generated Application Password grants the full API access of your account (not read-only), with guidance to keep the file out of version control and how to revoke the password under Users → Profile → Application Passwords.
- Added: an
Update URIheader so the "Enable auto-updates" toggle appears for Kantan Analytics in the Plugins list. (The WordPress.org build omits this header so wp.org continues to own updates there.)
- Removed: Conversion Backfill tool in Settings — the underlying hostname-matching bug it patched was fixed back in 2.9.8, so the catch-up tool is no longer needed. The REST endpoint, dashboard UI, and
_backfillconversion-type display shim have all been removed.
- New: Conversions tab — see your conversions by type and by traffic source, with a recent-conversion log, right in the dashboard. Surfaces the conversion data Kantan already tracks via Settings → Conversion Links.
- Dashboard assets (Tailwind CSS and Chart.js) are now bundled with the plugin instead of loaded from a CDN — the admin dashboard makes no third-party requests and works fully offline.
- New: Kantan contributes suggested text to WordPress' built-in Privacy Policy generator (Settings → Privacy), reflecting your configured data-retention window.
- New: Realtime tab — shows visitors active in the last 5 minutes with their current page, traffic source, session age, and "last seen" age. Auto-refreshes every 30 seconds with a visible countdown and a manual "Refresh now" button. Pauses polling when the browser tab is hidden.
- New: Live visitor count badge next to the "Realtime" item in the dashboard nav. Visible from every tab — the same 30s poll that drives the Realtime tab also keeps the badge current, with a pulsing green dot when at least one visitor is active.
- New: REST endpoint
GET /kantan/v1/realtime?window=5— returns{ count, window_minutes, visitors, timestamp }. Each visitor row includes the most recent pageview (current page), generated display name, traffic source, session age, and seconds since last activity.
- New: UTM parameters now surface on the Journeys tab alongside each named visitor's session timeline — see campaign, source, and medium for pre-conversion visits (previously only visible aggregated on the UTM tab). REST
/visitorsand/journeysendpoints also expose the new fields, so the Claude Code agent and recommendations engine can attribute behavior to campaigns.
- Fix: conversion link matching corrected — hostname was being searched inside the full URL string (always -1); now checks href.startsWith(rule.domain) OR rule.domain contains hostname. Affected all conversion link click tracking since the feature launched.
- New: Conversion Backfill tool added to Settings. Scans historical click data and creates approximate conversion records for sessions likely missed by the bug. Matches anchor text against each rule's label; backfilled records carry a
_backfilltype suffix. Idempotent — safe to run multiple times.
- Author renamed from "Kinda Useful Plugins" to "Try Kantan" across plugin header, readme, and updater comment.
- readme description and FAQ rewritten — full feature pitch with subsection structure; FAQ expanded from 4 to 10 items (caching, GDPR/CCPA, GA import, deactivation, multisite, agent, etc.).
- Fix: conversions endpoint now returns correct visitor_id for pre-2.9.4 records; query uses COALESCE(c.visitor_id, a.visitor_id) to recover attribution from the joined session record when the conversion row has a null visitor_id.
- Fix: version constant bumped to match header (was stuck at 2.9.4).
- Sidebar nav groups now accordion — clicking a group label collapses or expands it. The active group always starts expanded; inactive groups start collapsed. Keeps the nav usable on laptops when many SEO sub-tabs are registered.
- Persistent visitor attribution for conversions:
visitor_idcolumn added towp_kantan_conversionsso attribution survives beyond the 90-day raw-data retention window. - Form integrations now inject
kantan_visitor_idalongsidekantan_session_idon all detected forms (CF7, WPForms, Gravity, Formidable, Ninja, Elementor Pro, Fluent, Forminator). - Schema migration runs automatically on update — no manual action required.
- Update channel migrated to trykantan.com. Plugin URIs, SEO upgrade link, and auto-updater endpoint now point to the new domain.
- New: Split test tracking integration — pageviews can now record
test_idandvariant_idfrom a companion split-testing plugin. - New:
kantan_pageview_trackedaction hook fired after each pageview insert. - Database migration to add
test_idandvariant_idcolumns to the pageviews table.
- New: Clickable page URLs throughout dashboard — opens SEO page detail modal or upsell.
- New: Sparkline mini-charts on Overview stat cards.
- Surface recommendations engine on Overview, Interactions, and Journeys tabs.
- New: IP address exclusion for analytics filtering.
- Rebuilt Journeys tab with visitor profiles and generated names.
- New: Admin exclusion and bot filtering.
- New: Interactions endpoint for click heatmap and scroll depth data.
- New: Device breakdown endpoint and queries.
- Switched dashboard to left sidebar nav with grouped tabs.
- New: Click tracking, scroll depth tracking, and user journey analysis.
- New: Entry/exit page tracking and top-clicked-elements report.
- New: Automatic daily cleanup with configurable retention.
- Initial release: core visitor tracking and admin dashboard.