About this plugin
Bouzin Download Stats Manager counts downloads of files already stored in a chosen folder of a WordPress installation.
It is intended for sites that already contain many direct links to PDF, EPUB, MOBI, ZIP, or other downloadable files. The plugin rewrites matching front-end links to a secure local download endpoint, so existing links do not need to be edited manually.
Main features:
- Choose a folder relative to the WordPress installation root.
- Safely create a missing custom folder when settings are saved.
- Optionally monitor the native WordPress Media Library uploads folder and manage files with the standard Media screen.
- Choose the file extensions to track.
- Support files stored in subfolders.
- Rewrite matching links without modifying post content in the database.
- Validate every requested path against the configured folder and allowed extensions.
- Block directory traversal and symbolic-link escapes with canonical path checks.
- Store new-installation download events directly in indexed, per-site WordPress database tables.
- Preserve a controlled, verified CSV migration only for sites upgrading with historical statistics.
- Optionally store only a server-provided two-letter country code and a broad Computer/Mobile category.
- Display sortable and paginated download statistics in WordPress administration.
- Allow every logged-in WordPress role to view statistics while keeping settings and destructive actions administrator-only.
- Show an at-a-glance dashboard with the total, downloaded files, top three files, three latest downloads, and optional detected country/device rankings.
- Display an accessible, dependency-free SVG download-evolution chart with automatic daily, weekly, monthly, or yearly grouping.
- Display the last download date and time for each file in the WordPress timezone, with its optional country and device metadata on the same line group.
- Search and filter statistics by period, exact detected country, and broad device category.
- Choose among disabled, standard, enhanced, and strict bot-filter levels without blocking downloads.
- Request strict-mode click proofs at download time so cached pages do not contain expiring tokens.
- Stream a real CSV export from either storage mode and reset all active statistics.
- Filter database statistics by the existing periods or by an available calendar year.
- Optionally remove all plugin data during uninstallation.
- Avoid external services, remote scripts, telemetry, and third-party tracking.
Privacy
By default, the plugin records only:
- the local WordPress date and time of the download;
- the relative path of the downloaded file.
If an administrator explicitly enables the optional classifications, new rows may also contain:
- a validated two-letter country code already supplied locally by the server or CDN;
- desktop, mobile, or unknown.
It does not record IP addresses, full user-agent strings, account identifiers, or cookies and does not send visitor data to external services. Request headers may be examined temporarily for bot detection and optional classification but are not persisted. Strict mode requests a short-lived signed token from the local WordPress REST API after a trusted click; the token contains no personal data and the response is not cached.
When upgrading from an older version, legacy log rows remain readable and legacy privacy migration removes previously stored IP addresses and user-agent strings.
New installations store events directly in two indexed tables that use the site’s WordPress table prefix. Sites upgrading from a legacy CSV version keep the journal intact until an administrator starts a small-batch, resumable migration and its normalized rows are verified in source order. New events are not duplicated in the retained CSV after cutover.
The export action always generates a downloadable CSV and is protected by an administrator capability check and nonce.
Credits
- Denis PIERREHUMBERT
- Adrien Bouzin
- Aurélien Bouzin
- ChatGPT