Matomo

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the analytics I actually need instead of a hosted Matomo — and note what the verdict means.

Matomo is open source and self-hosting it is free, so the fee is hosting. The reason this is ALMOST rather than YES is different: **fifteen years of accumulated reports** — cohorts, funnels, site search, campaign attribution, e-commerce — is a lot of reporting nobody wants to rewrite. If you need all of it, self-host the original. If you need six numbers you can defend, build.

STACK
- Node 20+ with Fastify
- SQLite through better-sqlite3, WAL mode
- A tracking script under 3KB gzipped, from my own domain
- Server-rendered dashboard, charts as inline SVG
- Caddy in front

THE DATA MODEL
- sites: id, domain, name, timezone, salt, is_public
- pageviews: id, site_id, path, query, referrer_host, referrer_url, utm_json, country, region, lang, device, browser, os, screen_bucket, status, duration_ms, visitor_hash, session_id, is_entry, is_exit, bot, prefetch, created_at
- events: id, site_id, name, category, action, label, value_num, path, visitor_hash, bot, created_at
- searches: id, site_id, keyword, result_count, path, at — site search, which is one of the most useful reports in the original and costs nothing to record
- goals, conversions, and for e-commerce: orders, order_items, with the currency
- Record more than you publish. A signal not captured today starts from zero the day somebody wants it

IDENTITY WITHOUT A COOKIE
- visitor_hash is HMAC-SHA256 of address, user agent and a per-site salt rotating daily; the inputs are discarded immediately
- Nothing written to the visitor's browser
- Daily rotation means 'visitors today' is exact and 'visitors this month' is an estimate, and the dashboard says so beside the number
- Carry the previous salt for a grace period so a session across the rotation is not counted twice
- Matomo can run with cookies for longer-horizon identity; doing without is a deliberate trade and the honest one for most sites

THE VISITOR LOG, WHICH IS THE FEATURE PEOPLE MISS
- A chronological list of sessions with the pages, referrer, country, device and goals for each
- It is what people open when a number looks wrong, and it is simply a query over the rows you already have
- It is also the most personal thing this stores, so it is behind authentication, retained for a stated window, and never published

WHAT TO BUILD, IN ORDER
- Views, visitors, sessions, bounce rate, time on page — each with its definition written beside it
- Top pages, referrers with the full URL kept, countries, devices, browsers, operating systems, languages
- Entry and exit pages, and campaign parameters parsed into their own columns
- Goals with conversion rates
- Site search: what people looked for and what returned nothing. That second list is a content backlog
- Funnels as an ordered set of paths or events with a window, computed at query time. Strict or loose ordering, stated
- Cohorts and retention only if you will actually use them
- Everything filterable by everything, with a comparison against the previous period

BOTS
- Flag, never drop, and exclude through a SQL view so the filtering lives in one place
- User agent list, whether the script executed at all, behavioural signals, and referrer spam counted separately rather than let into 'top sources'
- Prefetches excluded from views, redirects not counted, and only a 2xx GET is a page view

OPERATIONS
- .env: DATABASE_PATH, BASE_URL, HASH_SALT, GEOIP_DB_PATH, SESSION_SECRET
- Migrations on boot, each once; country from a local database file, never an external API
- Nightly backup off the machine, restore script
- Health endpoint

WHAT MATTERS MOST
Bot flagging and written definitions. Build collection and the excluding view before the dashboard, then reconcile a week against the access log. Six numbers you can explain beat sixty you cannot.