{ "title": "WP Statistics", "seo_title": "WP Statistics: review, recommended settings and limits", "h1": "WP Statistics", "description": "WP Statistics free or Premium: who it suits, limitations, pricing, recommended privacy settings and patched vulnerabilities.", "lead": "WP Statistics measures WordPress traffic with no cookies and no outside account, storing the data in your own database. Our take on the free and Premium versions, the privacy settings to check and the XSS vulnerabilities worth knowing about.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/wp-statistics/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/wp-statistics/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/wp-statistics/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/wp-statistics/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:33:00+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "WP Statistics", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/wp-statistics/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/wp-statistics/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/wp-statistics/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "WP Statistics", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wp-statistics/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wp-statistics/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wp-statistics/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "WP Statistics", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wp-statistics/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wp-statistics/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wp-statistics/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "WP Statistics", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wp-statistics/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wp-statistics/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wp-statistics/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "WP Statistics", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wp-statistics/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wp-statistics/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wp-statistics/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "WP Statistics", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wp-statistics/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wp-statistics/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wp-statistics/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "WP Statistics", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wp-statistics/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wp-statistics/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wp-statistics/index.json" } ], "headings": [ { "level": 1, "text": "WP Statistics" }, { "level": 2, "text": "What WP Statistics does on your site" }, { "level": 2, "text": "Which sites WP Statistics suits best" }, { "level": 2, "text": "WP Statistics strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "Our recommended WP Statistics settings" }, { "level": 2, "text": "WP Statistics security: anonymous visitors writing into your reports" }, { "level": 2, "text": "WP Statistics FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for blogs and business sites that want their stats inside WordPress, without Google Analytics.\n- Main caveat: recurring unauthenticated XSS flaws, so updates need to go in fast.\n- Free; Premium costs $119 a year for one site and adds real-time stats, UTM campaigns and Search Console.\n\n## What WP Statistics does on your site\n\nWP Statistics measures your traffic without any outside service: no sign-up, no Google account, and every visit is stored in tables in your own database. On each public page, the plugin loads a small tracking script that sends the visit to a WordPress REST API route. Because the request comes from the browser, counting keeps working behind a page cache or a CDN.\n\nReports live under the Statistics menu in the dashboard: visitors and page views, who is online, top posts and categories, authors, traffic sources grouped by channel (search, social, and since October 2026 a dedicated channel for AI assistants such as ChatGPT or Perplexity), countries and cities, browsers and devices, and bounce rate. Email reports and XML, CSV or TSV export round it out. On the privacy side, the plugin sets no cookies and, by default, truncates and then hashes IP addresses.\n\nThe developer, VeronaLabs, sells paid add-ons (Data Plus, Marketing, Real-Time Stats and more), individually or bundled as WP Statistics Premium. They add real-time stats, tracking for custom post types, outbound clicks and downloads, UTM campaigns, goals and a Google Search Console integration.\n\n![Diagram: WP Statistics works on visitors and bots, wordpress, external services. Public traces: signed HTML comments (hidden with Pro); folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); REST routes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/wp-statistics/diagram-en.svg?v=0988bf8e)\n\n## Which sites WP Statistics suits best\n\nWP Statistics answers one clear need: knowing who reads what, without handing the data to a third party.\n\n- **Blogs and business sites**: top content, traffic sources and visitor countries are all you need, and you read them inside WordPress.\n- **Sites that want to skip Google Analytics**: the data stays on your server, and the plugin can be tuned to collect as little personal data as possible.\n- **Multi-author publications**: author and category reports are free.\n- **Agencies and freelancers**: the free version runs on unlimited sites with no visit cap.\n\nIt is not the best fit for a store that runs paid ad campaigns: conversions, events and detailed UTM campaign reports are paid features. On a very high-traffic site on shared hosting, keep in mind that every visit writes to your database. [Matomo](https://www.wp-masquerade.com/features/camouflaged-plugins/matomo/) and [Burst Statistics](https://www.wp-masquerade.com/features/camouflaged-plugins/burst-statistics/) are the two other self-hosted analytics plugins worth comparing.\n\n## WP Statistics strengths and limitations\n\n### Strengths\n\n- **Your data stays with you.** No outside account: statistics are stored in your WordPress database and only you can access them.\n- **Privacy-friendly defaults.** No cookies, truncated and hashed IP addresses, a Do Not Track option, a privacy audit tool, plus data export and erasure tools.\n- **A generous free version.** Unlimited sites and visits, content, category and author reports, traffic channels, geolocation, devices and email reports.\n- **Works with consent banners.** Direct integration with CookieYes, Real Cookie Banner and Borlabs Cookie, and with Complianz or Cookiebot through the WP Consent API.\n\n### Limitations\n\n- **Recurring XSS flaws.** Several vulnerabilities exploitable without an account came in through visit data, as recently as 2026.\n- **Marketing features cost extra.** Real-time stats, custom post types, outbound clicks, downloads, UTM campaigns, goals and Search Console require Premium or an add-on.\n- **A growing database.** Every visit is written to your tables, so on a busy site the detailed retention period and your hosting matter.\n- **No free trial of Premium.** The developer offers a 14-day refund instead, and renewals are charged at full price.\n\n## Our recommended WP Statistics settings\n\nSettings live under Statistics > Settings, split into tabs. Several defaults are already the right choice.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Anonymize IP Addresses** Statistics > Settings > Privacy & Data Protection | Enabled (default) | The last segment of the IP address is masked before anything is stored. |\n| **Hash IP Addresses** Same screen | Enabled (default) | The address becomes a non-reversible hash with a daily salt, so you count unique visitors without storing their IP. |\n| **Consent Plugin Integration** Same screen | Your consent plugin, or None if you do not use one | Tracking then follows the visitor’s choice; test by declining and then accepting the banner. |\n| **Track Logged-In User Activity** Statistics > Settings > General | Disabled (default) | When enabled, it ties visits to your members’ accounts, which changes your compliance analysis. |\n| **Tracking Method** Same screen | Client Side Tracking (Recommended) | Server-side tracking is flagged as deprecated in the interface. |\n| **Administrator** and **Excluded IP Address List** Statistics > Settings > Filtering & Exceptions | Administrator excluded (default), your office’s static IP added | Your own visits do not skew the numbers. |\n| **Automatically Aggregate Old Data** Statistics > Settings > Advanced Options | 180 days (default) or less | After that, visit details are rolled up: the database stays lean and you keep less data. |\n| **Minimum Role to View Statistics** Statistics > Settings > Roles & Permissions | Administrator, or Editor if your team needs it | The SQL injection CVE-2022-4230, fixed in 13.2.9, became reachable by low-privilege accounts when this setting opened the reports to them. |\n| **Share Anonymous Data** Statistics > Settings > Advanced Options | Disabled (default) | This usage data helps the developer, not your site. |\n\n- Visit your site in a private window, then check that the visit shows up under Statistics.\n- If nothing comes through, open the Tracker Debugger (Open Debugger button on the General tab): it tests the tracking endpoint and flags a consent banner that blocks visits.\n- Turn on automatic updates for the plugin on the Plugins screen.\n\n## WP Statistics security: anonymous visitors writing into your reports\n\nAn analytics plugin, by design, accepts data sent by any visitor: page address, referrer, browser, UTM parameters. When one of those values is poorly filtered, an attacker with no account can slip in a script that later runs in the browser of the admin who opens the reports. That is the pattern behind most known WP Statistics vulnerabilities:\n\n- **CVE-2022-25148, fixed in 13.1.6**: unauthenticated blind SQL injection through the `current_page_id` parameter (CVSS 9.8).\n- **CVE-2024-2194, fixed in 14.5.1**: unauthenticated stored [cross-site scripting](https://www.wp-masquerade.com/glossary/xss/) through a parameter of the visited URL (CVSS 7.2).\n- **CVE-2026-5231, fixed in 14.16.5**: unauthenticated stored XSS through the `utm_source` parameter, output unescaped in a chart (CVSS 7.2).\n- **CVE-2026-15780, fixed in 14.16.9**: same family, through the `utm_campaign` parameter (CVSS 7.2).\n\nThe developer patches quickly and handles reports through Patchstack’s disclosure program, but the Patchstack database still lists XSS flaws published in September and October 2026, so keep automatic plugin updates turned on. Keep retention periods short as well (see GDPR, logs and IP addresses). WP Statistics also adds an “Analytics by WP Statistics” HTML comment to every page; WP Masquerade Pro removes it (see [HTML comments and the generator tag](https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/)), which makes the plugin harder for bots hunting these flaws to spot, without replacing updates.\n\n## WP Statistics FAQ\n\n**Do I need a cookie banner with WP Statistics?**\n\nThe plugin sets no cookies, and the developer describes it as GDPR compliant by default. The answer still depends on your settings (tracking logged-in members, storing full user agents): the Privacy Audit tool flags the ones that change the picture, and the final call is a legal question specific to your site.\n\n**Can I run WP Statistics and Google Analytics at the same time?**\n\nYes, the developer says so explicitly. Expect different numbers, since bot filtering and consent handling differ.\n\n**How much does WP Statistics Premium cost?**\n\nThe pricing page lists $119 per year for one site, $249 for five sites and $449 for unlimited sites (up to 100 under the fair use policy), with every paid add-on included. Add-ons are also sold individually; the developer notes that renewals are at full price and offers a 14-day refund, with no trial version.\n\n**What happens to the data if I delete the plugin?**\n\nBy default, it stays in your database. To erase it on deletion, enable Delete All Data on Plugin Deletion on the Advanced Options tab, after exporting anything you want to keep.\n\n## Key facts\n\n- Category: Analytics and tags\n- Vendor: VeronaLabs\n- Price: Free; WP Statistics Premium costs $119 per year for one site, all add-ons included\n- Active installations (wordpress.org): 500 000+\n- Version: 14.16.18\n- Official page: https://wordpress.org/plugins/wp-statistics/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: signed HTML comments, folder name, tag IDs\n- Still visible: JavaScript variables, REST routes", "catalog": "wp-statistics", "essentials": [ "Best for blogs and business sites that want their stats inside WordPress, without Google Analytics.", "Main caveat: recurring unauthenticated XSS flaws, so updates need to go in fast.", "Free; Premium costs $119 a year for one site and adds real-time stats, UTM campaigns and Search Console." ], "format": "application/json" }