OSSEngine Analytics Connector

Description

OSSEngine Analytics Connector is an independent WordPress plugin built by OSSEngine. It connects your website to the UmamiEngine managed analytics service (umamiengine.com), or to your own self-hosted Umami analytics instance.

UmamiEngine is managed hosting for the open source Umami Analytics software, published under the MIT license. This plugin is an independent third-party connector. It is not affiliated with, endorsed by, sponsored by, or supported by the Umami project, and it is not an official Umami plugin. The name “Umami” is used only to describe the open source software this connector works with.

What data is transmitted?

Pageviews send the page URL, referrer, browser language, screen size, and device type to your analytics instance — the same data the standard Umami Analytics tracker collects. WooCommerce events additionally send product IDs/SKUs, product names, prices, item counts, and order values with currency. The plugin never sends customer email, name, address, phone, or payment information.

External services

This plugin talks to the following external services. It does not contact any other external servers on its own.

UmamiEngine integration API

This plugin connects to the UmamiEngine integration API at https://api.umamiengine.com (the plugin’s default API URL) to link your WordPress site to UmamiEngine and to configure or manage the analytics integration and its associated functionality.

UmamiEngine service: https://umamiengine.com
Terms of Use: https://umamiengine.com/terms
Privacy Policy: https://umamiengine.com/privacy

These are server-to-server requests made by your WordPress install, not by your visitors’ browsers. They are only made while an administrator is setting up or managing the integration.

What data is transmitted:

• Your WordPress site URL (the value of home_url()), so the correct site can be connected and registered.
• A name for your analytics website — your WordPress site title, or the site hostname if no title is set.
• A one-time authorization code and a one-time security (CSRF) state value, used to complete the connection you approved on the UmamiEngine dashboard.
• The site token that UmamiEngine issued for this integration, sent in the Authorization header as a Bearer credential. This is a token created specifically for the plugin integration; your WordPress login credentials, email, or other account data are never sent.
• The plugin’s own version string, sent in an X-Plugin-Version header with every request.
• The word “DELETE” as a confirmation value, sent only when you confirm disconnection.

When it is transmitted:

• When an administrator completes the “Connect UmamiEngine” flow: after you approve the connection on the UmamiEngine dashboard, the plugin exchanges the authorization code for the integration details, registers your Umami website, and downloads the tracking configuration. If the website registration did not complete earlier, it is retried on a later status refresh.
• When an administrator clicks “Refresh status” on the settings page.
• Once per week through a scheduled WordPress event, as long as a managed connection is active, to revalidate the connection and refresh the cached tracking configuration. It does not run on page views.
• When an administrator opens the plugin settings page while a managed connection is active, a single status request is made to detect a disconnection done from the UmamiEngine dashboard side. Transient server failures do not change anything on your site.
• When an administrator confirms disconnection by typing DELETE, which permanently deletes the Umami website and its analytics data at the service.

No page content, post data, email addresses, visitor data, or other site content is transmitted through this API.

UmamiEngine dashboard (connect page)

When an administrator clicks “Connect UmamiEngine” (or “Reconnect”), the browser is redirected to the UmamiEngine dashboard at https://dashboard.umamiengine.com where the connection is approved. The redirect URL contains your site URL and a one-time random security (state) value that ties the round trip to your site. No files, credentials, or content are sent; the plugin returns to WordPress afterwards. This happens only when an administrator starts the connect flow.

Umami analytics tracking script

When the plugin is connected and tracking is enabled, it adds the Umami analytics tracking script to your site’s public pages. Your visitors’ browsers load that script from your configured analytics host — the Umami instance hosted for you by UmamiEngine, or your own self-hosted Umami instance in “Existing Umami” mode — and the script sends pageview data to that same host while visitors browse your site.

Pageviews send the page URL, referrer, browser language, screen size, and device type. If WooCommerce is installed, the WooCommerce event tracking is enabled in the plugin settings, and tracking is active, e-commerce events add product ID/SKU, product name, price, item count, and order value with currency (for purchase events, also the order ID and total). The script does not send customer email, name, address, phone, or payment information. Administrators are excluded by default, and tracking is off until you connect, so activation alone makes no external requests.

Terms of Use: https://umamiengine.com/terms
Privacy Policy: https://umamiengine.com/privacy

Your own Umami instance (Existing-Umami mode)

If you choose “Existing Umami” mode, the plugin connects only to the Umami base URL you enter, which points at your own installation — not to UmamiEngine. When an administrator saves the settings with Existing-Umami mode enabled, the plugin validates the instance with two GET requests to that URL (the Umami website endpoint for the Website ID you entered, and the /script.js tracker file) to confirm the instance and ID are usable. These requests carry no data in the body; the Website ID is part of the request URL. They are made only during this validation, never during normal page loads. After validation, tracking data is sent by visitors’ browsers to your own instance as described in the tracking section above.