About this plugin
GreenOrb Statistics is a self-hosted WordPress analytics plugin and Google Analytics alternative that shows you how much of your traffic is automated. Known bots and referrer spam are filtered, likely bots are flagged for you to review, and it itemises what it found so you can see what your traffic is really made of.
Your statistics stay in your own WordPress database, nothing is sent to Google or any other analytics service, and it can run with zero cookies. It is built as independent modules, so you only run the tracking you actually use.
Watch a three-minute tour of the dashboard:
Highlights
- Bot filtering — known bots, headless browsers and referrer spam are filtered; bots that get past those checks are flagged by their behaviour, including waves of look-alike visitors who each view one page and leave; an optional check flags or excludes visits from data-centre networks, and one button deletes them all. Details below.
- Page views & visitors — raw pageviews with a configurable cooldown, unique visitors, sessions, engaged sessions, and bounce rate.
- Time on page — engaged time measured with the Page Visibility API (heartbeat-based) and gated on real activity: idle tabs stop counting shortly after the last scroll/mouse/key interaction, while playing audio or video keeps counting. Server-side caps stop background tabs inflating durations.
- Referrers & traffic sources — referrers, UTM campaigns, search terms, affiliates (Pretty Links short links are counted automatically), and outbound-link clicks.
- Devices — device type, browser, and operating-system breakdowns.
- Geography — country (and optional city) detection via Cloudflare headers, MaxMind, or the free DB-IP Lite database. No account or API key required for the DB-IP option.
- Content reports — popular posts, authors, taxonomies, entry/exit pages, journeys, and per-post detail.
- Dashboard widget & admin bar — a 30-day sparkline, “today so far,” and a live “online now” count at a glance.
- Email reports — scheduled summaries delivered to your inbox.
- Tracked clicks — count clicks on any element, by CSS selector or a data-greenorb-track attribute.
- Annotations — mark events on your charts.
- CSV export — export any report.
- Writes your privacy policy — adds a settings-aware section to WordPress’s Privacy Policy Guide describing exactly what is recorded, what is not, and your own retention setting, so the published policy matches how the plugin is actually configured.
Also available in Pro
These are part of GreenOrb Statistics Pro and are not included in the free plugin:
- WooCommerce — revenue overview, product performance, sales funnel, and order insights.
- Goals & conversions — custom conversion goals, conversion paths, and landing-page conversion rates.
- Web Vitals — Core Web Vitals (LCP, CLS, INP) collected from real visits.
- Media plays & downloads — SoundCloud / YouTube play detection and titles.
- Form tracking — submissions from Contact Form 7, WPForms, Gravity Forms, Elementor, and Divi.
- Traffic spike alerts — get notified when traffic jumps unexpectedly.
- SPA tracking — pushState / client-side navigation for single-page themes.
- Ask AI — ask questions about your statistics in plain English, plus a weekly AI summary.
- Excluded countries — leave visitors from chosen countries out of your statistics. It hides them from your reports only; it does not block anyone or stop a sale.
Bot filtering
Automated traffic is filtered using an open-source bot-signature list, with a headless-user-agent check and an optional per-IP daily hit cap. A daily behaviour scan also flags the bots that pass every filter: real-browser traffic that keeps coming back to one page, reloads one page over and over in a single visit, or arrives as a wave of brand-new visitors from the same country and device who each view one page and do nothing else.
A post going viral is not flagged, because real readers always include some who scroll, click or stay. It also skips referrer spam (fake visits from known spam sites, using Matomo’s public referrer-spam list bundled with the plugin), tracking hits a browser says were sent from another website, and any bot names you add yourself.
Optionally, the plugin can also check which network each visit comes from. Visits from cloud and hosting companies’ networks (Tencent Cloud, Amazon, Google Cloud, DigitalOcean and about 40 more) are almost always automated, because real people rarely browse from rented servers. You choose whether those visits are flagged for you to review or left out of your statistics.
The lookup uses DB-IP’s free network database on your own server; it is off until you switch it on and download the database. The setup wizard offers to switch it on, and the Bot Filtering report has a button that deletes every flagged data-centre visitor at once and recalculates your totals.
Privacy first
- Data is stored only in your WordPress database — nothing is sent to an external analytics service. See “External services” below for the short list of optional, non-visitor-data calls the plugin can make.
- Optional IP anonymization and configurable data retention (default 365 days), with never-pruned monthly rollups so year-on-year comparisons survive pruning.
- You choose what is stored in a visitor’s browser. The returning-visitor cookie and the browser-storage note that stops quick reloads counting twice can each be switched off, and with both off the plugin stores nothing there.
- Plays nicely with consent managers (e.g. Complianz) and includes GDPR-oriented settings.
Video tutorials
- Install and set up GreenOrb Statistics (3:23)
- How GreenOrb Statistics filters bots (3:12)
- Cookie consent settings in GreenOrb Statistics (2:46)
Credits & attributions
Bundled third-party code, with each project’s full licence text included alongside it in the plugin:
- Bot detection uses the open-source bot-signature list from the Matomo device-detector project (https://github.com/matomo-org/device-detector) — LGPL v3, text at includes/lib/MatomoBots/LICENSE.txt.
- Referrer-spam filtering uses the Matomo referrer-spam list (https://github.com/matomo-org/referrer-spam-list) — Public Domain, bundled at includes/lib/ReferrerSpam/.
- Charts are rendered with Chart.js (https://www.chartjs.org/), bundled locally — MIT, text at assets/js/vendor/LICENSE.txt.
- The world map uses jQVMap (https://github.com/manifestinteractive/jqvmap) — dual MIT / GPL, text at assets/js/jqvmap/LICENSE.txt.
- Country/city geolocation can optionally use the free DB-IP Lite database (https://db-ip.com/) or MaxMind GeoLite2 (https://www.maxmind.com/), and the optional data-centre check uses the free DB-IP IP to ASN Lite database. None is bundled — the site owner downloads them, under those providers’ own terms (DB-IP Lite: CC BY 4.0).
GreenOrb Statistics is licensed GPL v2 or later. The “or later” is what allows the LGPL v3 component above to be distributed as part of the whole, so do not narrow the licence to bare GPL v2.
External services
GreenOrb Statistics stores all of your analytics data in your own WordPress database and never sends visitor data anywhere. It does, however, contact the following third-party services in the specific situations described below. Nothing here runs on plugin activation, and none of it is required for the plugin to work.
jsDelivr (CDN)
What it is: A free open-source CDN, used to fetch two files that would otherwise go stale: the Matomo device-detector bot list, and the DB-IP Lite geolocation database.
What is sent, and when: Only a standard HTTP request — your server’s IP address, and a User-Agent identifying the plugin and its version. No visitor data and no site data are ever sent. This happens only when:
- You tick “Keep the bot signature list up to date automatically” under Settings → Bots. This is off by default; once on, the check runs weekly. Bot detection works without it, using the copy bundled with the plugin.
- You tick “Keep the geolocation database up to date automatically” under Settings → Geography. This is off by default; once on, the check runs weekly.
- You press a Download button on the Geography settings screen, or choose the DB-IP option in the setup wizard.
Service provided by jsDelivr: terms of use, privacy policy.
DB-IP
What it is: The provider of two free databases used on your own server: DB-IP Lite city, which turns a visitor’s IP address into a country and city, and DB-IP IP to ASN Lite, which tells the optional data-centre check which network a visit comes from. Each file is downloaded, and every lookup after that is local — no per-visitor request is ever made to DB-IP.
What is sent, and when: The city database comes via jsDelivr, as described above. com — a standard HTTP request with your server’s IP address and a User-Agent identifying the plugin — only when you press Download the network database under Settings → Bot Filtering, or tick its monthly update ( off by default ). Visitor IP addresses are never sent to DB-IP.
Service provided by DB-IP: terms of service, privacy policy.
MaxMind GeoLite2
What it is: An alternative geolocation database, for site owners who already have a MaxMind account.
What is sent, and when: Only if you enter a MaxMind licence key under Settings → Geography. Your server then sends that key to MaxMind to download the database. Downloads happen when you press the button, and weekly thereafter if you have enabled automatic updates.
Lookups are local; visitor IP addresses are never sent to MaxMind.
Service provided by MaxMind: GeoLite2 EULA, privacy policy.
YouTube
What it is: Used for media-play tracking on pages that embed a YouTube video.
What is sent, and when:
- When a page on your site contains a YouTube embed, the visitor’s browser loads YouTube’s IFrame Player API so the plugin can tell when the video is played. This is the same connection the embed itself already makes; the visitor’s browser contacts YouTube directly, and your server is not involved.
- Normally the title comes from the player itself, in the visitor’s browser, and your server makes no request at all. Only if you tick “Look up missing track and video titles” under Settings → Tracking — which is off by default — will your server fall back to one request to YouTube’s oEmbed endpoint for the rare play whose title didn’t arrive. Only the public video ID is sent, and the result is cached permanently, so it happens at most once per video.
If your site has no YouTube embeds, neither request is ever made.
Service provided by Google/YouTube: terms of service, privacy policy.
SoundCloud
What it is: Used for media-play tracking on pages that embed a SoundCloud player.
What is sent, and when:
- When a page on your site contains a SoundCloud embed, the visitor’s browser loads SoundCloud’s Widget API so the plugin can tell when the track is played. The visitor’s browser contacts SoundCloud directly, and your server is not involved.
- Normally the title comes from the player itself, in the visitor’s browser, and your server makes no request at all. Only if you tick “Look up missing track and video titles” under Settings → Tracking — which is off by default — will your server fall back to one request to SoundCloud’s oEmbed endpoint for the rare play whose title didn’t arrive. Only the public track URL is sent, and the result is cached permanently, so it happens at most once per track.
If your site has no SoundCloud embeds, neither request is ever made.
Service provided by SoundCloud: terms of use, privacy policy.