ZenMarkup Privacy Analytics
| 开发者 |
zenmarkup
anthonyzen |
|---|---|
| 更新时间 | 2026年10月16日 13:02 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Self-hosted website analytics for WordPress. All data is stored in your WordPress database and never sent to third-party services. The tracker is cookieless and loads no external resources, making the plugin GDPR, CCPA, and PECR friendly by default — no consent banner required.
Once activated, the plugin starts collecting anonymous visitor data and displays a full analytics dashboard inside WP Admin.
Features
- Real-time visitor counter
- Pageviews, unique visitors, bounce rate, and average session duration
- Interactive SVG world map with zoom, pan, and country/city drill-down
- UTM campaign tracking with automatic URL cleanup
- Event tracking — outbound links, file downloads, mailto and tel clicks, 404 pages
- Custom events via data attributes or JavaScript API
- Smart insights — exit pages, dead pages, user journeys
- 24-hour peak activity chart
- New vs repeat visitor breakdown (single vs multiple sessions in a day)
- Device, browser, and operating system detection (server-side)
- Weekly or monthly email reports
- CSV export on every dashboard tab
- Date range selector with custom ranges
- Role-based dashboard access control
- Configurable data retention (7–365 days)
- IP exclusion list and admin traffic filtering
- Bot traffic analysis
- No cookies, no localStorage, no sessionStorage
- IP addresses are never stored — only an irreversible SHA-256 hash is used internally
- Geolocation is resolved locally on your server (optional) — only country and city names are stored
- No personal identifiers — no names, emails, or login state tracked
- GDPR, CCPA, and PECR friendly by default
admin-ajax.php for data collection, which bypasses page caching.
Who is it for?
- Site owners who want analytics without a consent banner
- GDPR-regulated businesses that need compliant analytics out of the box
- Agencies managing multiple WordPress sites
- Developers who prefer self-hosted, zero-dependency tooling
安装:
- Upload the
zenmarkup-privacy-analyticsfolder to/wp-content/plugins/. - Activate the plugin through the Plugins menu in WordPress.
- Visit Analytics in the admin sidebar to view your dashboard.
屏幕截图:
常见问题:
Does this plugin use cookies?
No. The plugin uses zero cookies, zero localStorage, and zero sessionStorage. No consent banner is needed.
Is this plugin GDPR-compliant?
The plugin is designed to be GDPR-friendly by default. It collects only anonymous, aggregated data. IP addresses are never stored — only a daily-rotating irreversible SHA-256 hash is kept, and it is never used to identify or profile individual visitors. No personal identifiers are tracked.
How does visitor counting work without cookies?
An anonymous fingerprint is generated from a combination of the IP hash, User-Agent, screen size, language, and timezone. This creates a unique but non-reversible identifier that rotates naturally when any component changes.
Does this plugin make external requests?
The only external request the plugin makes is a monthly download of a public IP geolocation database from cdn.jsdelivr.net to your server. Visitor IP addresses and any other visitor data are never sent off your site. The download can be disabled in Analytics → Settings → General. See the "External services" section above for full details.
Does this work with caching plugins?
Yes. The tracker script uses admin-ajax.php for data collection, which bypasses page caching. It is compatible with common caching and optimization plugins.
Where is the data stored?
All analytics data is stored in your WordPress database. Nothing is sent to external servers (except the optional geolocation lookup).
Can I export my data?
Yes. Every dashboard tab has a CSV export option.
Do I need a cookie consent banner?
No. Because the plugin uses no cookies, no localStorage, and no fingerprint with a persistent identifier, you do not need a cookie consent popup for the analytics itself. The visitor fingerprint rotates every 24 hours at midnight UTC, which aligns with the CNIL audience-measurement criteria and EDPB Guidelines 2/2023 — the standard used by privacy-first analytics tools such as Plausible and Fathom. You should still maintain a Privacy Policy page disclosing your use of analytics, but a blocking consent banner is not required.
更新日志:
1.2.9
- Improved: clarified the GDPR FAQ entry to accurately reflect that the daily-rotating IP hash is kept for unique visitor counting, not discarded — the hash is non-reversible and resets every 24 hours.
- Improved: added a dedicated FAQ entry explaining why no cookie consent banner is needed, with a reference to the CNIL audience-measurement criteria and EDPB Guidelines 2/2023.
- Fix: Resolved an issue in the Campaigns widget where sub-tabs would fail to update their data when clicked.
- Added: The Campaigns tab now automatically shows the landing page URL associated with each campaign, making it easier to track which campaign points to which page.
- Fix: Prevent plugin settings from being accidentally reset when saving options from different tabs.
- Fix: Replace warning emojis with native WordPress Dashicons for the SMTP status indicator to fix broken images in some environments.
- New: a dismissible review request appears once on the dashboard after the plugin has been in use for a while.
- Improved: WordPress admin notices shown on the dashboard now line up with the dashboard content instead of sitting against the page edge.
- Improved: polished email report typography — better font stack, increased spacing, larger call-to-action button, and subtle card shadow for a more professional look in Gmail, Outlook, and Apple Mail.
- New: added an optional previous-period comparison line to the main dashboard chart. You can compare the last 7 days with the previous 7 days, the last 30 days with the previous 30 days, or today with yesterday using the new "Compare previous period" checkbox.
- Changed: renamed the "New vs Returning" widget to "New vs Repeat" to better match the privacy model. "Repeat" now means visitors with more than one session in the same day. Cross-day returning visitors are not tracked because fingerprints rotate daily for privacy. Added an info tooltip to explain this.
- Improved: faster dashboard loading on busy sites. Added a covering database index for country and city geography queries, so they no longer need to scan the full hits table on each load.
- Visitor fingerprint salt now rotates every 24 hours at midnight UTC. The same visitor returning the next day is counted as a new unique visitor — the privacy-first standard for consent-free analytics. This aligns the plugin with the EDPB Guidelines 2/2023 reading of ePrivacy Article 5(3) and the CNIL audience-measurement criteria (July 2025), which require fingerprints to have a "limited lifespan". Why this matters: the prior static salt produced a fingerprint that persisted for months, which made the "no consent banner" posture harder to defend in the EU. After this change the plugin matches the privacy-by-design industry standard.
- Expected impact on numbers: the "Returning Visitors" share in New vs Returning will drop, because cross-day returns are no longer detected — only same-day returns count as returning. Within a single day, visitor counts are unchanged. This is a deliberate privacy trade-off, not a bug.
- Updated author description in the plugin readme to reflect current site direction.
- Fixed the device breakdown ("Devices" widget on the Overview tab) showing "No device data yet" even when device data existed.
- Tested up to WordPress 7.0.
- Geolocation now runs entirely on your own server. The plugin downloads a public IP geolocation database (DB-IP City Lite, CC-BY 4.0) from jsDelivr CDN about once a month and resolves visitor country and city locally. Visitor IP addresses are never sent to a third-party service.
- New "External services" section in the readme documents every outbound request the plugin can make.
- Settings → General gains a "Geolocation" toggle (on by default) that fully disables external traffic when off, and an "Update database now" button with a status block (Ready / Outdated / Downloading / error states).
- Privacy disclosure page lists DB-IP and jsDelivr with the source URL, license, and a one-click way to disable.
- Defeated stale-data caching across LiteSpeed Cache (private tier), Cloudflare APO, BunnyCDN, Varnish, Fastly, Akamai, nginx FastCGI and the WordPress object cache. Dashboard now reads fresh data on every load.
- Dashboard JS in-memory cache now expires after 30 seconds instead of forever.
- Asset URLs versioned via plugin version (matches WP core convention) so version bumps invalidate browser disk-cache cleanly.
- Fixed map gradient legend showing duplicate "1" labels for sites with a single visitor.
- Fixed AJAX action names for the tracker fallback, custom event tracking, Clear All Data form and the test-email button (hooks were still registered under the old prefix after the 1.1.0 rename)
- Shipped unminified JavaScript and CSS sources alongside the minified bundles
- Moved third-party notices into the readme
- Renamed to ZenMarkup Privacy Analytics
- Internal prefix migration (classes, functions, options, CSS, data attributes) to meet WordPress.org naming requirements
- Rewrote plugin description in neutral, non-comparative tone
- No functional changes — all features from 1.0.0 preserved
- Initial release
- Cookieless visitor tracking
- 4-tab dashboard (Overview, Traffic, Geography, Behavior)
- Interactive Canvas line chart with metric toggle
- Donut chart for new vs returning visitors
- Interactive SVG world map with zoom and pan
- UTM campaign tracking with automatic URL cleanup
- Event tracking (outbound links, downloads, mailto, tel, 404)
- Smart Insights (exit intelligence, dead pages, user journeys)
- Weekly/monthly email reports
- CSV export on every tab
- Server-side geolocation from a self-hosted database (optional)
- Role-based dashboard access control
- Configurable data retention (7–365 days)
- Compatibility with common caching plugins