How to use analytics without cookies on WordPress

Going cookieless is less a technical migration than a decision about what you are willing to stop knowing. The mechanics take an afternoon. Understanding the trade takes a bit longer, and skipping that part is how people end up thinking their new analytics is broken.

If you want the concept first, the cookieless page covers what it means and how the counting works. This is the practical route.

Step one: find out what is actually setting cookies

Before changing anything, look at what you have. Open your site in a private window, open the browser’s developer tools, and look at the cookies on a normal page load. Then do it again on a page with a form, an embedded video and anything else unusual.

You are likely to find more than you expect, and analytics is often not the biggest contributor. Ad tags, embedded players, chat widgets and marketing pixels all set them. Knowing which is which matters, because removing analytics cookies while a chat widget is still setting three does not change your position much.

Step two: pick the counting model you want

Cookieless analytics still has to tell two visitors apart. There are broadly three ways, and they are not equivalent.

A hash of request attributes. The address and user agent, combined and hashed. No cookie, and it works immediately. Whether it is genuinely privacy-preserving depends entirely on whether the inputs are stored and how long the hash stays stable.

A hash with a rotating salt. The same, plus a random value that is replaced periodically. Once the old salt is destroyed, previous identifiers cannot be recomputed, even by someone holding the database. Honest Analytics overwrites its salt every 24 hours, which is what makes unique visitors a daily estimate rather than a person.

Counting nothing per visitor at all. Pure pageview counting. Simplest, and it cannot report uniques.

The second is the usual answer, and the thing to check is that the salt is genuinely overwritten rather than rotated into an archive that still exists.

Step three: install and run in parallel

Do not remove the old tool on day one. Run both for a few weeks. You are not looking for the numbers to agree, because two analytics tools never agree. You are looking for the gap between them to be stable.

A steady gap means two tools measuring the same reality differently. A gap that swings wildly week to week means something is genuinely misconfigured, and that is worth chasing before you switch.

Step four: check cached pages are counted

This is the step people skip and then regret. If a page is served from a cache, the PHP that would have recorded the visit does not run, so a cookieless tool that counts server-side can undercount badly. It is worse behind a CDN, where the request may not reach your server at all.

Test as a logged-out visitor in a private window, on a page you know is cached. Logged-in visits usually bypass the cache, which is exactly why the problem looks invisible from an admin account.

Removing the analytics cookie may remove a reason for your banner. It does not automatically remove the banner, and it does not make a compliance question go away.

Work through everything else the page loads first. If anything non-essential is still setting a cookie, that is the thing driving the banner. Get advice on your own site rather than taking a plugin’s word for your legal position, including this one’s.

What the numbers will do

Expect these, and expect them to be permanent rather than a settling-in period:

Unique visitors become daily estimates. Someone reading on Monday and Thursday counts once on each day.
Returning-visitor rate goes away. There is nothing durable to compare against.
Session counts may rise slightly, because a session that would have been stitched across a gap by a cookie is now two.
Totals may go up rather than down. This surprises people. A cookie-based tool behind a consent banner only counts the visitors who accepted it. A cookieless tool counts everybody. The gap can go either way depending on how many people were declining.

That last point is the one worth telling whoever reads your reports, before they see the change and draw their own conclusion.

What you keep

Pageviews, daily uniques, sessions, bounce rate, top pages, referrers, devices, and when during the week people actually turn up. That is the list most sites look at, and none of it needs a cookie.