Cookieless WordPress analytics

Cookies on visitors

None

Browser storage

None: no local storage or session storage

Visitors told apart by

A scrambled mix of IP address and browser, with a secret that changes every day

Cost

Free. All of this is in the free plugin on WordPress.org.

What Vireo counts without cookies

• Pageviews, exact over any date range
• Visitors, as a true unique count within each day
• Time on page, counted only while the tab is in front of the reader
• Bounce rate: the share of a day’s visitors who viewed one page
• Referrers, countries, devices and browsers
• Core Web Vitals from real visits
• Clicks, form submissions, custom events and missing pages
• The Google searches behind each post, which come from your Search Console account

What’s counted and what isn’t has the exact rules for each one.

How it tells visitors apart

Every request to your site carries the visitor’s IP address and browser details. Vireo combines the two with a secret that changes every day and keeps only the scrambled result. That’s enough to count someone once however many pages they read today.

Vireo keeps today’s secret and yesterday’s, and deletes older ones. Once a day’s secret is gone, nobody can work out which address a result came from, and the same reader tomorrow produces a different result. The records that tell visitors apart are deleted after two days.

The raw IP address sits in a short-lived file on your server while the view is processed, usually for under a minute, and is used to look up the country. It never goes into the analytics tables.

What cookieless counting can’t tell you

The same daily reset that keeps readers from being followed sets real limits. Here’s what you give up:

• Unique people over a week or a month. Visitors over a longer range is the sum of each day’s visitors, and the card says so.
• New against returning visitors across days. A reader who comes back tomorrow looks new.
• A reader’s path from one day to the next.
• Two people on the same network with the same browser look like one visitor that day.
• With Vireo Pro, a sale can only be matched to a visit from the last two days, so a buyer who read a post last week shows as direct.

Visitors whose browser sends Do Not Track or Global Privacy Control aren’t counted at all. It’s on by default, with no setting.

Do you still need a cookie banner?

Vireo puts nothing on the visitor’s device. Whether that lets your site drop its banner depends on everything else the site loads and on the rules where you and your readers are, so the decision is yours, or your adviser’s. Jean Galea, who makes Vireo, went through the rule itself and what it covers in WordPress analytics without a cookie banner.

If you’d rather Vireo waited for consent, it can. It works with consent plugins that use the WP Consent API, and one filter tells it to wait for statistics consent:

add_filter( 'vireo_require_consent', '__return_true' );

Privacy and GDPR lists everything Vireo stores and every outside service it can contact, for you or your adviser to check.

Questions

Does Vireo use local storage or anything else in the browser instead?

It doesn’t. The tracker writes no cookie and uses neither local storage nor session storage. It sends the page’s path, the referrer and the post ID, and the server tells visitors apart from the IP address and browser that come with every request.

Does cookieless counting work with page caching?

Yes. The visitor’s browser sends each view once the page is showing, so cached pages are counted like any other. Do Not Track and bot checks happen in the browser and at Vireo’s endpoint, never in the cached HTML.

Can I make Vireo wait for consent anyway?

Yes. With a consent plugin that uses the WP Consent API, one filter makes Vireo wait for statistics consent. Views made before the visitor agrees are held in the page and sent once they do. How to turn it on.