Plausible CE

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build the analytics I actually need instead of running Plausible's community edition — and read the trade first, because self-hosting the original is a real option and it is heavier than it looks.

The community edition wants a columnar database alongside the application, which is more to operate than most small sites need. If you want six numbers you can defend, one Node process and SQLite will hold years of traffic on the smallest machine you can rent.

STACK
- Node 20+ with Fastify
- SQLite through better-sqlite3, WAL mode
- A tracking script under 2KB gzipped, served from your own domain — not a third-party host, which is what gets a script blocked
- Server-rendered dashboard, charts as inline SVG drawn by hand
- Caddy in front

THE DATA MODEL
- sites: id, domain, name, timezone, salt, is_public, public_token
- pageviews: id, site_id, path, referrer_host, referrer_url, utm_json, country, lang, device, browser, os, screen_bucket, status, visitor_hash, session_id, is_entry, is_exit, duration_ms, bot, prefetch, created_at
- events: id, site_id, name, path, props_json, value_num, visitor_hash, bot, created_at
- goals and conversions
- Record more than you publish. A signal not captured today starts from zero the day somebody wants it

NO COOKIE
- visitor_hash is HMAC-SHA256 of address, user agent and a per-site salt that rotates daily; the inputs are discarded immediately
- Nothing is written to the visitor's browser
- The rotation means 'visitors today' is exact and 'visitors this month' is an estimate — say so beside the number
- Carry the previous salt for a grace period so a session spanning the rotation is not counted twice

WHERE THE COLLECTOR RUNS
- On a different machine from the site it measures. If the site is down you still want to know what traffic tried to arrive
- Serve the script from your own domain, ideally from a first-party path proxied to the collector. A script on a well-known analytics hostname is on every blocklist within a week
- The collect endpoint answers 204 in a couple of milliseconds and writes after responding

BOTS AND PREFETCHES
- Flag, never drop, and exclude through a SQL view so the filtering lives in one place rather than fifteen chances to forget it
- Detection from the user agent list, from whether the script executed at all, and from behaviour — no referrer, one page, zero time, arrivals too regular for a person
- Referrer spam counted separately rather than let into 'top sources'
- Prefetches and prerenders identified from request headers and kept out of the view count. Two refreshes must not produce six views
- Redirects do not count, and only a 2xx GET is a page view

THE DASHBOARD
- One screen: headline numbers, one chart, then pages, sources, countries, devices and goals
- Every figure filterable by every dimension, with a comparison against the previous period
- Definitions written beside the numbers, because everybody computes bounce rate differently
- A public sharing link per site, read-only — publishing your own numbers is a small act of credibility

OPERATIONS
- .env: DATABASE_PATH, BASE_URL, HASH_SALT, GEOIP_DB_PATH, SESSION_SECRET
- Migrations on boot, each once; country from a local database file, never an external API
- Nightly backup off the machine, restore script
- Health endpoint

WHAT MATTERS MOST
Bot filtering and the first-party script path. Build collection, flagging and the excluding view before the dashboard, then reconcile a week against the access log and account for every difference.