Plausible Analytics

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me analytics that replace Plausible: one screen, no cookie, no consent banner, and the collector somewhere other than the site it measures.

Read this first: Plausible is open source and self-hosting it is a real answer — what the fee buys is hosting, upkeep, and a script kept working as browsers change. Build this when you want the collection to be exactly yours, and put the collector on separate infrastructure, which is one of the things the hosted product quietly gives you.

STACK
- Node 20+ with Fastify
- SQLite through better-sqlite3, WAL mode
- A tracking script under 2KB gzipped, served from my own domain — not a third-party host, which is what gets a script blocked
- Server-rendered dashboard, charts as inline SVG drawn by hand
- Caddy in front

THE DATA MODEL
- sites: id, domain, name, timezone, salt, is_public, public_token
- pageviews: id, site_id, path, referrer_host, referrer_url, utm_json, country, region, lang, device, browser, os, screen_bucket, status, visitor_hash, session_id, is_entry, is_exit, duration_ms, bot, prefetch, created_at
- events: id, site_id, name, path, props_json, value_num, visitor_hash, bot, created_at
- goals: id, site_id, name, kind, config_json — a path, an event name, or an outbound link
- Record more than you publish. A signal not captured today starts from zero the day somebody wants it, and a missing year cannot be bought back

NO COOKIE, WHICH IS THE ENTIRE POSITION
- visitor_hash is HMAC-SHA256 of the address, the user agent and a per-site salt that rotates daily. Nothing is written to the visitor's browser
- The address and raw user agent are discarded immediately
- Daily rotation means no cross-day tracking: 'visitors today' is exact, 'visitors this month' is an estimate, and the dashboard says so next to the number
- Carry the previous day's salt for a grace period so a session spanning the rotation is not counted twice
- Nothing is sent to any third party, ever. That property is what makes everything else defensible
- Write a page in your own words explaining what is collected and what is never done with it, and link it from the dashboard. If you cannot explain your collection in six sentences, collect less

WHY THERE IS NO BANNER, AND THE CAVEAT
- No storage on the visitor's device is what puts this outside the cookie rules
- Whether the processing needs a lawful basis is a separate question and depends on where you and your visitors are. State the design in the README and say plainly that it is not legal advice

WHERE THE COLLECTOR RUNS
- On a different machine from the site it measures. If the site is down, you still want to know what traffic tried to arrive; if the site is overloaded, the collector must not be competing with it
- Serve the script from your own domain, ideally from a first-party path proxied to the collector. A script on a well-known analytics hostname is on every blocklist within a week
- The collect endpoint answers 204 in a couple of milliseconds and writes after responding

BOTS AND PREFETCHES
- Flag, never drop, and exclude through a SQL view so the filtering lives in one place rather than fifteen chances to forget it
- Detection from the user agent list, from behaviour — no referrer, one page, zero time, arrivals too regular for a person — and from referrer spam patterns
- Referrer spam is a real category: hosts that appear in your referrers purely to make you visit them. Maintain a block list and count them separately rather than letting them into 'top sources'
- Prefetches and prerenders identified from request headers and kept out of the view count. Two refreshes must not produce six views
- Redirects do not count, and only a GET can be a page view

THE DASHBOARD
- One screen. Headline numbers, one chart, and the tables underneath: pages, sources, countries, devices, goals
- Every number filterable by every dimension, with a comparison against the previous period
- Definitions written beside the numbers, because everybody computes bounce rate differently
- A public sharing link per site, read-only, optionally password-protected — publishing your own numbers is a small act of credibility
- Dark and light, fast, no framework. Resist adding a second page: the product being replaced is chosen precisely because it fits on one screen

BEYOND PAGE VIEWS
- Custom events with properties, and goals defined over them
- Outbound links, file downloads and form submissions tracked automatically by the script
- Campaign parameters parsed into their own columns
- A server-side fallback for visitors whose script never runs, from the reverse proxy's log, marked as such

OPERATIONS
- .env: DATABASE_PATH, BASE_URL, HASH_SALT, GEOIP_DB_PATH, SESSION_SECRET
- Migrations on boot, each once
- Country from a local database file. Never an external geolocation API
- Nightly backup off the machine, restore script
- Health endpoint

WHAT MATTERS MOST
Bot filtering and the first-party script path. Build collection, flagging and the excluding view before the dashboard, then serve the script from your own domain and compare a week against the access log. Analytics whose numbers you cannot defend in a sentence are worse than none.

Give me the repository, the tracking script, migrations, .env.example, and a README with deploy steps behind Caddy, the separate collector, and the privacy page written out.