SFR Analytics

SFR Analytics is a self-hosted analytics plugin for WordPress. All visitor data is stored in your own database — nothing is sent to third-party services. No cookies, no external scripts, no tracking pixels.

Get a clear picture of your site’s traffic without compromising your visitors’ privacy.

Dashboard at a Glance

• Views, Visitors, Sessions — core metrics with period-over-period comparison
• Bounce Rate & Pages per Session — engagement indicators
• Traffic Over Time — interactive line chart with date range presets
• Top Content — your most viewed posts and pages
• Traffic Sources — where your visitors are coming from
• Top Referring Sites — individual domains sending you traffic
• Entry & Exit Pages — first and last pages in each visit
• Device Types — desktop, mobile and tablet breakdown
• Browsers & Operating Systems — which browsers and OS your visitors use
• Geographic Distribution — visitor countries (only available if using a CDN like Cloudflare that provides country headers; all other tracking works without a CDN)
• Campaign Performance — UTM campaign results with source/medium drill-down

All dashboard sections are collapsible — show only what matters to you.

Campaign Manager & UTM Link Builder

Plan and track marketing campaigns without leaving WordPress:

• Create campaigns with notes and track their performance over time
• Build UTM links with a visual tool — pick a page, choose source/medium/campaign, and get a ready-to-use URL
• Smart page picker — search across all your content types with post type and category filtering
• Preset sources and mediums — common options (Facebook, Google, newsletter, etc.) with clear descriptions
• Save generated links for quick reference and reuse
• Custom sources and mediums — add your own and they’re saved for next time
• Auto-lowercase campaign names to prevent data fragmentation

Smart Bot Detection

Not all traffic is human. SFR Analytics filters out noise automatically:

• 200+ known bot patterns — search engines, AI crawlers, SEO tools, monitoring bots, headless browsers, security scanners and more
• JavaScript verification — a lightweight inline script confirms real browser execution, so bots that don’t run JavaScript are never counted
• Missing header detection — flags requests without User-Agent or Accept-Language headers
• Filterable patterns — add your own via the sfran_bot_patterns filter

The dashboard shows you exactly how much traffic was filtered: total requests vs verified human visits.

Privacy First

• No cookies — visitor identification uses anonymous hashed fingerprints
• No PII stored — IP addresses are hashed (SHA-256), never stored in plain text
• Optional IP anonymisation — strip the last octet before hashing
• Do Not Track support — respects the browser DNT header when enabled
• Local storage only — your data never leaves your server
• Configurable retention — automatically delete data after 30 to 3,650 days
• GDPR-ready privacy text — copy-paste paragraph for your privacy policy

IP & Country Filtering

• Exclude specific IP addresses or CIDR ranges (e.g. 192.168.1.0/24)
• One-click “Ignore My IP” button
• Exclude entire countries by country code
• Exclude logged-in users by role (administrators, editors, etc.)

REST API

A full set of authenticated REST API endpoints lets you access your analytics data programmatically:

• /sfran/v1/summary — overview stats with optional comparison
• /sfran/v1/top-content — most viewed content with pagination
• /sfran/v1/traffic-sources — referrer breakdown
• /sfran/v1/time-series — daily views/visitors/sessions
• /sfran/v1/campaigns — campaign performance
• /sfran/v1/entry-pages and /sfran/v1/exit-pages
• /sfran/v1/referrers — top referring domains
• /sfran/v1/devices, /sfran/v1/browsers, /sfran/v1/geographic

All endpoints require authentication (WordPress Application Passwords or other REST API auth) and the manage_options capability. Use these to build custom dashboards, export data, or integrate with other tools.

Performance

• Batch processing — pageviews are buffered and written in batches, reducing database load
• Indexed tables — optimised queries for fast dashboard rendering
• Lightweight frontend — a single inline verification script, no external files loaded for visitors
• No impact on page speed — tracking uses navigator.sendBeacon (non-blocking)