What Matomo does on your WordPress site
Matomo Analytics installs a full copy of the Matomo web analytics platform inside WordPress. The tracking code added to every page loads the matomo.js file from the plugin folder and sends each visit to your own server: the data stays in your WordPress database and never goes through a third-party service. Reports (visits, pages, referrers, goals, real time, visitor profiles, segments) open from the Matomo Analytics menu, in the familiar Matomo interface.
Reports are processed in the background by a WordPress scheduled task that runs every hour through cron. The plugin also downloads a geolocation database (DB-IP) into the uploads folder to locate visitors, and it ships with Matomo Tag Manager, ecommerce tracking for WooCommerce, Easy Digital Downloads and MemberPress, and an import of your history from Google Analytics or WP Statistics.
The plugin is free and released under the GPL by the Matomo team. Advanced features are paid add-ons sold separately on the Matomo Marketplace: heatmaps and session recordings, form and media analytics, funnels, custom reports, cohorts, users flow and SEO keyword rankings. If you already use Matomo On-Premise or Matomo Cloud, the vendor says you need the Connect Matomo plugin instead.
Which sites Matomo is a good fit for
Matomo fits when you want full web analytics without handing your data to Google:
- Small business, nonprofit and public sector sites: your analytics stay on your server, which makes “where does our data go?” an easy question to answer.
- Small to mid-size WooCommerce stores: revenue, carts and products sold show up without setup, next to your traffic sources.
- Sites leaving Google Analytics or WP Statistics: importing your history means you don’t start from zero.
- Teams that want to segment: segments, period comparisons and visitor profiles go much further than a simple visit counter.
It is not the right choice for a high-traffic site or a large multisite network: in that case the vendor recommends Matomo On-Premise on a separate server or Matomo Cloud. For a small blog that only wants to count visits, WP Statistics or Burst Statistics are lighter.
Matomo for WordPress strengths and limitations
Strengths
- Your data, on your server. Visits and reports are stored in your WordPress database, with no third-party transfer and no data sampling.
- IP anonymization on by default. Out of the box, the plugin masks two bytes of every visitor’s IP address.
- A real analytics platform for free. Real time, segments, goals, ecommerce, JavaScript error tracking and Tag Manager at no cost.
- Built-in GDPR tools. An opt-out form as a shortcode or block, export and deletion of a visitor’s data, and configurable data retention.
Limitations
- Extra load on your server. Every page view adds a tracking request; the vendor requires at least 128 MB of PHP memory and recommends 256 MB.
- Advanced add-ons priced one by one. Heatmaps, funnels or form analytics are bought separately, each with its own subscription.
- Matomo 6 requirements. PHP 8.1 and MySQL 8.0 or MariaDB 10.6 will be required; without them, the plugin stays on version 5.
- No Tag Manager on multisite. The vendor states that it does not work in network mode.
- Data wiped on uninstall. By default, deleting the plugin deletes your entire history, with no way back except a backup.
The Matomo settings we recommend
These settings live under Matomo Analytics > Settings in the current free version. Choices about cookies and consent depend on your legal analysis: our article on GDPR, IP addresses and retention periods covers the right questions.
| Setting | Recommended value | Why |
|---|---|---|
| Tracking mode Matomo Analytics > Settings > Tracking | Auto (recommended) | Matomo generates and inserts the tracking code itself; Manual mode is only for writing your own code. |
| Tracking filter Matomo Analytics > Settings > Exclusions | Administrator checked, plus your team’s roles | Your own visits don’t skew the numbers. |
| Track WordPress User ID Matomo Analytics > Settings > Tracking | Disabled (default) | The other options tie visits to an account, even to an email address, which makes them personal data. |
| Disable cookies Same screen | Depends on your consent policy | Without cookies, Matomo recognizes returning visitors less well, but compliance can be simpler. |
| Custom consent screen Same screen | None, unless you build your own consent screen | The vendor reserves these modes for a custom-coded consent screen. |
| Track 404 and Track search Same screen | Enabled | You spot broken links and what visitors search for without finding it. |
| Tracker Debug Mode Same screen | Disabled (recommended) | The vendor asks you to enable it only for the length of a diagnosis, for security and privacy reasons. |
| Anonymise data and IP addresses Matomo Analytics > Settings > Privacy & GDPR | Anonymization on, at least two bytes masked (default) | The full address is never stored; don’t reduce the masking without a reason. |
| Delete all data on uninstall Matomo Analytics > Settings > Advanced | Unchecked if you want to keep your history | A test or accidental uninstall no longer erases years of analytics. |
- Open your site in a private browsing window, then the real-time visits report: your visit should appear.
- Open Matomo Analytics > Diagnostics > System Report: no error should show, and it lists your PHP and MySQL versions so you can prepare for Matomo 6.
- If your host disables WP-Cron, make sure a real scheduled task calls WordPress, or your reports will stop updating.
- Add the
[matomo_opt_out_form]shortcode or the “Matomo opt out” block to your privacy policy, then test opting out.
Matomo security: few flaws, one update not to miss
The Patchstack database lists two patched vulnerabilities in the plugin, both of medium severity and exploitable only if a logged-in user clicks a booby-trapped link:
- CVE-2023-6923, fixed in 5.0.1: reflected XSS through the
idsiteparameter, triggerable without an account, up to version 4.15.3 (CVSS 6.1). - CVE-2024-38766, fixed in 5.1.2: cross-site request forgery (CSRF) that could make an admin dismiss a notice (CVSS 4.3).
On its wordpress.org page, the vendor also flags an important security fix from version 5.11.1 onward and urges you to update. Matomo runs a bug bounty program, but the best protection is still updating quickly: turn on automatic updates for the plugin (see our guide to automatic plugin updates). The tracking code wrapped in “Matomo” HTML comments and the matomo.js address give the plugin away: WP Masquerade Pro removes those comments and rewrites the file address, while the _paq variable and the _pk_ cookies stay visible.
What WP Masquerade hides for Matomo Analytics
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Matomo Analytics: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- signed HTML comments
- folder name
- tag IDs
Still visible
- JavaScript variables
_paq - cookies
_pk_id.*, _pk_ses.*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Matomo frequently asked questions
Is Matomo for WordPress really free?
Yes: the plugin and its core features (reports, ecommerce, Tag Manager, GDPR tools) are free. Only the advanced add-ons are paid, for example Heatmap & Session Recording at €109 per year for one site.
Do I need a cookie banner with Matomo?
It depends on your configuration and on the law that applies to your site. Matomo gives you the levers (cookies you can turn off, anonymized IPs, opt-out); if you keep a banner, a consent plugin such as Complianz can control tracking.
Does Matomo slow WordPress down?
The tracking script loads in the footer by default, but every visit adds a request handled by your server, and reports are processed every hour. On modest hosting with heavy traffic, the vendor recommends Matomo On-Premise or Matomo Cloud.
What happens to my analytics if I delete the plugin?
By default, they are erased. Uncheck “Delete all data on uninstall” in the Advanced tab before deleting Matomo, and back up your database.