Cookieless WordPress analytics

What cookieless actually means

A conventional analytics tool sets a cookie the first time someone arrives, then reads it back on every later visit. That cookie is what lets it say "this is the same person as last Tuesday". It is also what makes the tool a tracker: the identifier persists, it is tied to a device, and it can follow someone across months.

Cookieless analytics does not write that identifier. Nothing is stored on the visitor's device, so there is nothing to read back, and no way to connect this visit to one from three weeks ago.

Why the analytics cookie became a problem

Three things happened at once. Regulators became specific about non-essential cookies needing consent. Browsers began blocking third-party cookies by default and capping the lifetime of the rest. And visitors got tired of clicking through a banner to read a blog post.

The result is that a cookie-based analytics setup on a typical site now measures a shrinking, self-selected slice of your traffic: the people who accepted the banner, using browsers that did not interfere. You are still paying the cost of the banner, but you are no longer getting the completeness the cookie was supposed to buy.

How Honest Analytics counts without one

A visitor is a short hash of a random daily salt, the request address, the user agent and the site. That hash is enough to tell two people apart within a day, which is what a visitor count needs.

The salt is then overwritten in place every 24 hours. Not rotated and archived. Overwritten. Once it is gone, yesterday's hashes cannot be recomputed by anyone, including someone holding the database and the original address. There is no key left to do it with.

The address itself is never written down. It exists as a variable inside one function, gets hashed, and is gone. It is not in a table, a log, a cache key or the write spool.

What you give up, honestly

This is a real trade and it would be dishonest to pretend otherwise.

• Unique visitors are daily estimates, not people. Somebody who reads you on Monday and again on Thursday counts once on each day. There is no cross-day or lifetime unique figure, because that number cannot be produced honestly from this model.
• No returning-visitor rate in the conventional sense, for the same reason.
• No months-long user journeys. Funnels work inside the daily window unless you deliberately opt into something longer-lived, which changes the privacy position and says so before you switch it on.

What you keep is everything most people actually use: how many, which pages, where from, on what, and how that is trending.

Does cookieless mean no consent banner?

Honest Analytics is designed so that it does not itself require an analytics consent banner in its default configuration. That is a claim about this plugin, not about your site.

Whether your site needs a banner overall depends on everything else it runs: embedded video, fonts, maps, chat widgets, advertising, and where your visitors are. If anything else on the page sets a non-essential cookie, that is the thing driving your banner, not your analytics. We are not going to tell you that installing a plugin makes a legal question go away.

Is cookieless the same as GDPR compliant?

No, and anyone selling you that equivalence is overreaching. Compliance is a property of how your whole organisation handles data, not of one plugin.

What can be said precisely: no analytics cookie in the default configuration, no stored IP addresses, no full referrer URLs, no permanent visitor profiles, and nothing transmitted to us or any third party. The privacy documentation sets out exactly what is kept and what is discarded, and the plugin has a Privacy screen that says the same thing inside your admin, in language you can hand to a client.

Cookieless, and still worth reading

The free edition gives you pageviews, daily unique visitors, sessions, bounce rate, real-time visitors, your top pages, where traffic came from and what people were using. None of that needs a cookie, and none of it is held back for a paid tier.