MilkStats

Description

MilkStats keeps visitor statistics without collecting personal data.
All data stays local in your own WordPress database — nothing is shared with
external analytics services (no Google Analytics, no external scripts or
fonts).
A product by 5Names.

What is measured?

• Page views — counted and aggregated per page, per day
• Sessions — how many unique visitor sessions there were
• Time on page — how long someone stayed on a page
• Navigation paths — which page most often leads to which next page
• Sources — did the visitor arrive via a search engine, social media, a
  referring site, an AI assistant, or directly? Plus UTM campaign tags
  (utm_source, utm_medium, utm_campaign) if you use them in your own
  marketing links.
• Events — clicks on outbound links and download links are detected
  automatically, plus optional custom events via the data-milkstats-event
  attribute. See “Custom events” below.
• AI crawler visibility — how often known AI crawlers (GPTBot, ClaudeBot,
  PerplexityBot, and others) visit your site, separate from human traffic.

What is NEVER stored?

• No IP addresses
• No tracking cookies — the session ID lives only in the browser’s
  sessionStorage and disappears as soon as the tab is closed. The only
  cookie this plugin can ever set is the optional opt-out cookie described
  below, and only if you or a visitor chooses to set it.
• No browser fingerprinting
• No full referrer URLs — only the domain (e.g. “google.com”), never the
  path or a search query that might be contained in it
• No data sent to external parties

How does it work technically?

On every page view, a small, first-party JavaScript file (assets/tracker.js)
sends an AJAX request to your own admin-ajax.php. That request contains the
page URL, page title, a random session ID, and — only on the first page view
of a session — the hostname of the referring site and any UTM parameters.
When the page is left, the time on page is sent afterwards via
navigator.sendBeacon.

This data ends up in the following tables in your WordPress database:

1. wp_milkstats_pageviews — daily totals per page. Kept indefinitely: just
   counts, no session information.
2. wp_milkstats_session_events — individual page views per session, with
   time on page. Automatically deleted after the configured retention
   period.
3. wp_milkstats_sessions — one row per session with the traffic source
   (first-touch attribution). Also cleaned up after the retention period.
4. wp_milkstats_events — custom events (outbound link clicks, downloads,
   manual events). Cleaned up after the retention period, same as session
   data.
5. wp_milkstats_device_stats — daily aggregated device/browser/OS counts.
   Kept indefinitely, like page totals — never traceable to an individual.
6. wp_milkstats_ai_crawler_hits — daily aggregated hits from known AI
   crawlers. Kept indefinitely, like page totals.

A daily WP-Cron job cleans up session data older than the configured
retention period. Page totals are never deleted. Bots are recognized and
ignored based on the User-Agent.

Custom events

Besides page views, MilkStats also measures events, without any
configuration needed:

• Outbound links — a click on a link to another domain is automatically
  recorded, with the domain as the label.
• Downloads — a click on a link to a file with a known download
  extension (pdf, zip, docx, xlsx, and more) is automatically recorded, with
  the file name as the label.
• Manual events — add the data-milkstats-event="label" attribute to a
  link, button or <form> to track that click or submission as a custom
  event, for example:
  Request a quote
  or <form data-milkstats-event="Contact form submitted">…</form>.

Events count if the visitor is not excluded (see Settings) and are shown on
the statistics page under “Events”, with the top labels per type.

Excluding yourself (opt-out)

Besides the role exclusion (only works while logged in), you can also
exclude yourself — or an external tester — without logging in:

• Via the admin bar — administrators see a MilkStats item at the top
  (“tracking on”/”tracking off”) to flip this with one click.
• Via a link — visit ?milkstats_optout=1 to exclude yourself, or
  ?milkstats_optout=0 to be counted again. Also works while logged out,
  handy to share with external testers.
• Via the settings page — a button (“Exclude my visits in this browser”)
  showing the current status.

This sets a first-party cookie (milkstats_optout) in that one browser. The
cookie itself has no tracking purpose — purely a toggle — and works alongside
the role exclusion, not instead of it.

Settings

Under Site Analytics → Settings you can configure:

• Excluded roles — which user roles are never counted (default:
  administrator, editor, author, contributor)
• Exclude yourself — a button to exclude your own visits in the current
  browser, even while logged out (see “Excluding yourself” above)
• Member segment — optional: which role(s) should be counted separately
  as a “logged-in segment” (e.g. members, clients, subscribers), with a
  custom name for that segment in the statistics. Up to three additional
  named segments can be configured, each pickable from a dropdown on the
  statistics page.
• Retention period — after how many days session data (time on page,
  navigation paths, sources) is automatically deleted

Where do I see the statistics?

• A compact overview on the WordPress dashboard (widget)
• A full statistics page under Site Analytics in the main menu, with a
  rolling period filter (7/30/90/365 days) plus a calendar period picker
  (today/yesterday, this/last week, this/last month, this/last quarter,
  this/last year), bar chart, top pages, navigation paths, source breakdown,
  device/browser/OS breakdown, and AI crawler visibility

Credits

The admin screens use the Inter typeface by Rasmus
Andersson, bundled with the plugin under the SIL Open Font License 1.1
(assets/fonts/OFL.txt). It is served from your own site — never from an
external font CDN.