內容簡介
Statinform 是一款自我託管的 WordPress 分析外掛，所有數據均儲存在自己的伺服器上。它不使用 cookies，並且不會將數據發送給第三方，對網站性能影響極小。
【主要功能】
• 無需 cookies，使用 sessionStorage 進行會話識別
• 所有數據儲存在自己的 MySQL 數據庫中
• 追蹤進入/退出頁面及完整會話頁面鏈
• 源檢測，分類流量來源
• 追蹤外部連結點擊
• 數據導出為 CSV 格式
外掛標籤
開發者團隊
② 後台搜尋「Statinform: Cookieless Analytics (No Consent Banner)」→ 直接安裝（推薦）
原文外掛簡介
StatInform is a self-hosted analytics plugin for WordPress that keeps all data on your own server. It does not use cookies, does not send data to third parties (Google, Yandex, or anyone else), and has a minimal impact on your site’s performance.
Key features
No cookies. Session identification uses sessionStorage, which is cleared when the browser tab closes. No long-lived identifiers, no cross-visit tracking.
No external services. All data is stored in your own MySQL database. Nothing is sent anywhere.
Minimal server load. The collection endpoint runs outside of WordPress core. It does not load wp-load.php, does not touch the database, and simply appends a line to a buffer file.
Page-level detail. Tracks entry/exit pages, full session page chains, time on each page, and transitions between pages.
Source detection. Classifies traffic by referrer and UTM tags. Recognizes search engines, social networks, and messengers (Telegram, WhatsApp, Viber, and others).
Outbound link tracking. Tracks clicks on external links, mailto:, and tel: links.
Bot filtering. Detects known bots by User-Agent and Accept-Language headers.
Bounce rate. A session is a bounce when it has <= 1 unique page and total time < 15 seconds.
Data export. Export any table to CSV for a chosen period. Create ZIP archives on the server. Delete old data with optional pre-archiving.
No cookie consent banner required for this plugin’s own data collection, because no cookies are used and no personal data is stored in identifiable form.
Performance and architecture
StatInform’s collection endpoint intentionally runs outside of WordPress core. This means:
No wp-load.php. The endpoint is a standalone PHP script. It does not load WordPress, does not connect to the database, and does not fire any hooks.
The endpoint lives in wp-content/uploads/eistat/. It is copied there on activation from a template file inside the plugin folder. WordPress.org guidelines require plugins to store user data in uploads/, not in the plugin directory.
No SQL in the collection path. Events are appended to hourly .jsonl buffer files. Aggregation into the database happens separately via WP-Cron or the manual “Update now” button.
Data files are protected from direct access. .htaccess files in the buffer and archives folders block direct HTTP access. On Nginx, these files are ignored and equivalent server-level rules should be configured.
Notes for reviewers
A few static-analysis warnings appear when running Plugin Check (PCP) on this plugin. They are false positives:
InterpolatedNotPrepared on SQL queries. All queries use $wpdb->prepare() for values. Table names are built as $wpdb->prefix . 'eistat_' and cannot be parameterized through prepare(). The table prefix is a controlled value that never comes from user input.
NonceVerification.Recommended on GET parameters. The admin views read filter parameters (days, view, date, source, link_type, paged) directly from $_GET. These are read-only filters that do not change state, so a nonce is not required. All values are sanitized with sanitize_text_field(), sanitize_key(), or absint().
DirectDatabaseQuery and NoCaching. The plugin uses custom tables with the prefix wp_eistat_. These tables are not part of the WordPress object cache, so caching them would provide no benefit.
The plugin does not write any PHP code to user files. The buffer path is stored as plain JSON in uploads/eistat/buffer-path.json and read with file_get_contents() + json_decode().
