Trackless – Cookieless Analytics

Trackless measures your site's traffic — and, on WooCommerce stores, your real revenue and margin — entirely server-side. No own analytics cookies, no JavaScript snippet, and consent-banner needs depend on your site setup. You read the reports in your Trackless account dashboard. Trackless is part of WooModuly.cz, a collection of WordPress and WooCommerce plugins — see https://woomoduly.cz/produkt/trackless/. How visitors are counted (privacy by design):

• The visitor key is a daily-rotating HMAC-SHA256 hash of IP + User-Agent + day, keyed with a secret salt that exists only on your server. It cannot be reversed and changes every day.
• The raw IP address is never stored and never transmitted — only a keyed hash.
• Global Privacy Control (the Sec-GPC browser signal) is honoured: opted-out visitors are not tracked at all.
• No data is written to the visitor's browser — no cookies, no localStorage, no fingerprinting scripts.

What it measures:

• Visits and sessions with source / medium / campaign and a GA4-style channel group
• Page views and events: product view, category view, search, add to cart, cart, checkout, 404
• Device, browser, OS, country and language (one row per visitor per day)
• With WooCommerce: orders, revenue, refunds, payment and shipping methods, first-order flag, order attribution (computed server-side from the cookieless visitor match), ordered items — including per-unit purchase cost for margin reporting if you store it (_wc_cog_cost, _alg_wc_cog_cost, _cost or the trackless_wholesale_price filter)

Events are collected into a small queue table in your own database and flushed once a day via WP-Cron (or manually with the "Send now" button). The delivery is HMAC-SHA256 signed and idempotent, so retries are safe. WooCommerce is optional: on a plain WordPress site you get cookieless web analytics; with WooCommerce you also get the e-commerce metrics. External service: Trackless (please read) This plugin is a connector for Trackless (https://trackless.cz), a hosted analytics service. It is not a standalone statistics plugin — the reports live in your Trackless account, and the plugin sends data to the service's ingest endpoint at https://trackless.cz/ingest. When data is sent: only after you enter your API key and explicitly tick the Data Processing Agreement (DPA) consent checkbox in the plugin settings. Until you do both, the plugin collects and sends nothing. What is sent (once a day, HMAC-signed):

• Pseudonymous traffic aggregates: hashed visitor identifiers (keyed HMAC, daily-rotating), hashed IPs, page URLs, referrers, UTM parameters and click IDs, the raw User-Agent (used server-side to derive device/browser/OS and to flag bots — not stored), country code, language
• With WooCommerce: order data including order ID, totals and refunds (amounts), currency, payment method, shipping method, order status, and line items with prices and (if configured) per-unit purchase costs
• Site metadata: site name, domain, timezone, currency, order statuses, product categories, carriers, payment gateway names

IP→country database: to show visitor country on hosting without a geo header (no Cloudflare / GeoIP module), the plugin downloads a small public IP→country database from https://trackless.cz/api/geoip/country.dat.gz (refreshed about once a week) and resolves the country locally — the visitor IP never leaves your server for this. The database is DB-IP Lite by DB-IP (https://db-ip.com), licensed CC BY 4.0. IP→hosting database: to keep bot farms out of your statistics, the plugin downloads a second public database from https://trackless.cz/api/geoip/hosting.dat.gz (also refreshed about once a week) listing IP ranges that belong to datacentres, clouds and VPNs, and checks the visitor IP against it locally — again the IP never leaves your server. Consumer ISPs and Apple iCloud Private Relay ranges are excluded from that database, so an ordinary customer is not affected. Built from DB-IP ASN Lite by DB-IP (https://db-ip.com), licensed CC BY 4.0. Hosting network names: alongside the database above, the plugin downloads https://trackless.cz/api/geoip/hosting-networks.json, a small list naming the network operator each range belongs to. It is what lets a visit that was treated as datacentre traffic be traced back to the network responsible, so a mistake can be found and corrected instead of guessed at. Fetched in the same step as the database itself, and like it, nothing about your visitors is sent anywhere. CDN edge ranges: the plugin downloads a small JSON list of Cloudflare edge IP ranges from https://trackless.cz/api/geoip/cdn.json (also refreshed about once a week). If your site sits behind a CDN, this is what lets the plugin tell a visitor's own IP from the CDN's — without it every visitor would look like the same person. A copy ships with the plugin, so this works from the very first request. None of these three downloads sends anything about your site or your visitors — they are plain requests for public files. Terms and pricing: Trackless is a paid service with a 30-day free trial; you need a Trackless account and API key to use this plugin.

• Terms of Service: https://trackless.cz/en/obchodni-podminky
• Data Processing Agreement (DPA): https://trackless.cz/en/zpracovatelska-smlouva

1.1.17

• When a visit is treated as coming from a datacentre, the plugin now also reports which network it was — so if a real customer is ever misjudged, the cause can be found and corrected instead of guessed at. Nothing further about your visitors is sent; the network is looked up on your own server, as before.

1.1.16

• Visits coming from datacentres, clouds and VPNs — typically bot farms rather than shoppers — are now recognised and kept out of your visitor numbers, so traffic and conversion rates reflect real people. Ordinary customers, including Safari users with iCloud Private Relay, are not affected.
• Sites behind a CDN (Cloudflare) are now measured correctly: the plugin tells a visitor's own IP from the CDN's, so visitors are no longer counted as one person and your excluded IP addresses work again.

1.1.15

• When the Trackless server rejects a batch — most often because the API key is wrong — the plugin now waits before trying again instead of re-sending the same data after every page view, and says so in the WordPress admin. Previously a wrong key could make a busy site re-post its whole queue hundreds of times a day.

1.1.14

• WooCommerce orders now carry the cookieless visitor key captured at checkout, so guest orders are matched to the visits that led to them — order attribution and the number of touches per order are now filled for guests too, not only logged-in customers.

1.1.13

• The plugin page now links to WooModuly.cz, the WordPress and WooCommerce plugin collection this plugin is part of.

1.1.12

• Add-to-cart events now include the redacted page URL and referrer, so event reports keep page and source context.
• WooCommerce product totals are now calculated from order line items, so shipping tax is not mixed into product revenue.

1.1.11

• Cron-like front-end URLs (cron / *_cron query parameters) are ignored by tracking, so maintenance endpoints are not counted as page views.

1.1.10

• Wording tightened around cookie-banner and consent claims: the plugin still stores no cookies or browser identifiers, but the listing now says consent-banner needs depend on the site's overall setup.

1.1.9

• More reliable delivery: when a daily send is due (or the local queue has grown large), the batch is now also sent right after the page finishes loading — a safety net for sites where WP-Cron does not run reliably — without adding any delay to the visitor's page.
• The sent batch is now byte-for-byte consistent with the other Trackless connectors (PrestaShop, OpenCart), so the HMAC signature matches exactly across platforms.
• Cleaner uninstall: the locally downloaded IP→country database file and its bookkeeping options are now removed as well.

1.1.8

• Order attribution is now derived server-side from the cookieless visitor match, consistent with every other Trackless platform — the plugin no longer forwards WooCommerce's own cookie-based Order Attribution, so attribution stays fully cookieless.
• Orders are now timestamped in UTC, so an order and the visit that produced it always fall on the same day in your reports (fixes a possible one-day mismatch on stores in a non-UTC timezone).

1.1.7

• Device, browser and OS detection now runs server-side in Trackless: the plugin forwards the raw User-Agent and the app parses it centrally, so the result is identical across every site and module and is updated centrally without a plugin release.
• The IP→country database is now downloaded from a fixed Trackless address (https://trackless.cz/api/geoip) instead of being derived from the configured ingest endpoint.

1.1.6

• Visitor country is now resolved even on hosting without a geo header (no Cloudflare / GeoIP module): the plugin downloads a small public IP→country database (DB-IP Lite, CC BY 4.0) from Trackless about once a week and resolves the country locally — the visitor IP never leaves your server for this. Hosts that already provide a geo header (or use WooCommerce geolocation) are unchanged.

1.1.5

• Bot/crawler detection now runs server-side in Trackless: the plugin forwards the visitor's User-Agent and the app decides what is a bot, so the rule is identical across every site and module and is updated centrally without a plugin release. The local bot User-Agent list and the central bot-pattern sync have been removed.
• Excluded IP addresses are now configured only in Trackless (Můj účet). The local excluded-IP field has been removed; the plugin applies the centrally managed list it receives via the ingest response (single addresses and CIDR ranges, IPv4 and IPv6). The IP match still runs on your server, because that is the only place the real visitor IP is seen — Trackless itself only ever receives a salted, irreversible hash.

1.1.4

• Bot/crawler filter is now managed centrally in your Trackless account: the User-Agent list you keep there is applied automatically by the plugin (taking precedence over the local default). One place to maintain it across all your sites; your local list is kept as a fallback.

1.1.3

• Excluded IP addresses now also accept CIDR ranges (IPv4 and IPv6), not just single addresses.
• IP addresses you exclude centrally in your Trackless account are now applied by the plugin automatically, alongside your local list. Your local list is kept.

1.1.2

• Expanded the default bot User-Agent filter to match the PrestaShop module: SEO crawlers, monitoring/uptime services, headless browsers and common HTTP libraries are now filtered out by default, for cleaner human-only stats. Any custom list you saved is kept.

1.1.1

• New setting: Excluded domains (self-referral) — return visits from payment gateways keep their original source. Pre-filled with common gateways.
• New setting: Filtered robots (User-Agent) — the bot filter is now editable.
• Clearer wording of the developer-only multi-currency note.

1.1.0

• Internationalization: all user-facing strings are translatable (text domain trackless), English source strings, bundled Czech and Slovak (cs_CZ, sk_SK) translations.
• readme rewritten for the WordPress.org plugin directory, including the external-service disclosure.
• Hardening pass: stricter capability checks (manage_options on save and send), escaping of all admin output, sanitization of all inputs, fuller uninstall cleanup (salt, transients, cron).

1.0.1

• Visitor fingerprint and IP hash switched to keyed HMAC-SHA256; the order ip_hash now uses the identical construction as the tracker (cross-day attribution join).
• Fix: corrupt queue rows are deleted on fetch instead of being re-scanned forever.
• Fix: trackless_conversion_rate filter values NAN/INF are clamped to 1.
• Fix: X/Twitter is matched exactly (x, x.com, t.co) — sources merely containing the letter "x" are no longer classified as social.
• Fix: plain HTTP clients (curl, wget, python-requests) are treated as bots and not tracked.
• Fix: 3-letter geo header country codes (e.g. AUT) are skipped instead of being cut to a different country's 2-letter code.

1.0.0

• Initial release: cookieless server-side traffic analytics; with WooCommerce also orders, revenue and margin.