Andresitaly Cookieless Country Reports

Andresitaly Cookieless Country Reports counts which pages your visitors read the most and where they come from — and nothing else. It exists for site owners who want a lightweight, privacy-first alternative to Google Analytics.

• Works behind page caches. The hit is captured by a tiny vanilla-JS beacon, so it counts even when pages are served by LiteSpeed / W3 Total Cache / any full-page cache that skips server-side PHP.
• Country detection, zero config — if the site is served through Cloudflare, the country comes from Cloudflare’s own header (no key, no download at all). Otherwise the plugin uses a locally hosted MaxMind GeoLite2 database (free license key, downloaded once from your own admin page). Lookups run on your server — the plugin never calls a remote service per visit.
• Reports only in the admin: view totals, sessions, top 20 pages, views by country, 30-day daily trend chart, CSV export.
• Privacy by design. No cookies are set, no IP addresses are stored, and the session identifier is a random per-tab string stored only hashed for at most your raw-hit retention (default 7 days).

How it works

• A ~2 KB vanilla JavaScript beacon sends one hit per page view to your own site’s REST endpoint.
• The hit carries a server-minted HMAC token, so only pages actually rendered by your site can be counted.
• Known bots (Googlebot, bingbot, Lighthouse, curl, most SEO crawlers) are filtered by User-Agent; logged-in users are never counted.
• The raw hit table is aggregated into a small daily table (page × country × device) and pruned after a configurable number of days.

What it does NOT do

• No public counters, no badges, no external branding.
• No cookies, no cross-site tracking, no third-party analytics calls.
• No IP address is stored anywhere (transient keys embed irreversible hashes only, and expire quickly).

Privacy

No cookies. No IP addresses. The plugin stores:

• Aggregated view counts (page × country × device × day) — kept as long as you configure.
• Raw individual hits with a random ephemeral session identifier (hashed) — deleted after your retention window (default 7 days).
• Two transient entries containing only irreversible hashes (a 10-second request dedupe and a 12-hour country cache) — neither is connected to identity.

The plugin is GDPR-friendly by design: it does not track individuals and does not require a consent banner. A suggested privacy-policy paragraph is offered in Tools → Privacy.

External services

Andresitaly Cookieless Country Reports uses one external service: MaxMind GeoLite2, used to tell which country your visitors read your pages from.

• What the service is and what it is used for. GeoLite2 is MaxMind’s free downloadable country database. Andresitaly Cookieless Country Reports downloads it once and then answers all country lookups locally on your own server — the plugin never calls MaxMind per page view, in any direction.
• What data is sent and when. Nothing is sent automatically and no visitor data is ever shared. The only request is the database download itself, made by your web server to https://download.maxmind.com. It happens (a) when you paste your own free MaxMind license key and click “Download / update GeoLite2 now” in the admin, or (b) at your optional daily refresh, only if you enable it. The request carries just that license key and standard HTTP headers — no page views, no URLs, no visitor information. If your site is behind Cloudflare, no MaxMind key or download is needed at all (the country comes from Cloudflare’s response header).
• MaxMind Terms of Service (GeoLite2 EULA): https://www.maxmind.com/en/geolite2/eula
• MaxMind Privacy Policy: https://www.maxmind.com/en/privacy_policy

GeoLite2 is licensed under the Creative Commons Attribution 4.0 license. The plugin does not bundle the database: you download it with your own key, as MaxMind’s EULA requires.