About this plugin
No Cookie Analytics – By Arfa is a privacy-first analytics plugin. It records every visit on your own server, with no cookies, no tracking script, and no third-party services . Because nothing is measured in the browser, there is nothing to slow your pages down and no analytics cookie banner to show. Your visitors’ raw IP addresses are never stored. Reports and dashboards Dashboard with KPI tiles, visitor and page-view trends, a live activity feed, and a countries map Acquisition report — marketing channel grouping (direct, organic and paid search, organic and paid social, email, affiliate, display, referral) and full UTM campaign performance Content report — views broken down by post type, author, category and tag Behavior report — entry pages, exit pages, internal site search (including searches that found nothing), and a cookieless new-vs-returning visitor split Conversions report — goals, conversion rates, and revenue attribution Pages, Referrers, Users and 404 reports A sortable “Views (30d)” column on the Posts and Pages list tables, and a per-post analytics box in the editor Goals, conversions and revenue Define goals by exact path, prefix, suffix, substring, regular expression, or “viewed this post”, with an optional value per conversion First-touch and last-touch attribution captured for every session WooCommerce revenue attribution by channel, campaign and landing page — only the order id and total are stored, never customer details Keep years of history without keeping years of personal data Raw page-view records are short-lived by design. Before they are deleted, each day is condensed into anonymous per-dimension totals, which are kept for a much longer window (two years by default). Long-term trend charts survive a short raw-data retention setting. Privacy and compliance built in Honors the Do Not Track and Global Privacy Control browser signals — those visits are never recorded A cookieless visitor opt-out, as the [ncaba_optout] shortcode or the “Analytics opt-out” block, that also erases whatever was already recorded for that visitor Registers with the WordPress Privacy Tools (personal-data exporter and eraser) and adds suggested privacy-policy text Exclude traffic by path, IP address or CIDR range, user agent, post type, or user role Delivered to you A designed weekly, monthly or daily email digest with a fully brandable header and footer, plus a live preview and one-click test send Traffic-anomaly alerts and busy-404 alerts, by email and as an admin notice Timeline annotations to mark launches and campaigns on your charts For developers Filters and actions throughout the tracking, channel, email and reporting pipeline Authenticated REST routes under ncaba/v1 for stats, reports, time series and annotations WP-CLI commands: wp ncaba stats , report , rollup , purge , export , send-summary , alerts Privacy This plugin stores analytics records in your WordPress database ( wp_ncaba_hits ), including: Page URL/path Referrer host and the marketing channel it maps to Browser/OS/device type Anonymized IP hash Session key Country code Whether the request resulted in a 404 (not found) Whether the request was an internal site search, and the term used (can be disabled) Whether the visitor had been seen before UTM campaign parameters (utm_source, utm_medium, utm_campaign), when present in the visited URL Timestamp No raw IP address is stored in the plugin database. The plugin honors the DNT (Do Not Track) and Sec-GPC (Global Privacy Control) request headers by default: those visits are never recorded at all. Visitors can also opt out themselves through the [ncaba_optout] shortcode or the “Analytics opt-out” block, which erases the anonymous records already stored for them and suppresses future ones — without setting a cookie. Registered users’ records are exposed through the WordPress Privacy Tools, so Tools → Export Personal Data and Tools → Erase Personal Data both cover this plugin. Country detection behavior: Uses server-provided geolocation headers when available (for example Cloudflare or GeoIP headers). Optional external IP geolocation lookup can be enabled by admin consent in plugin settings. When external geolocation is enabled, visitor IP is sent to: Service: ipapi.co (primary) and ipwho.is (fallback) Purpose: country lookup only Site owners must disclose this in their privacy policy before enabling external lookup. External services This plugin can optionally use the third-party services ipapi.co and ipwho.is for country lookup. The lookup is disabled by default and only runs after a site administrator explicitly enables the “Allow External Geo Lookup” option in plugin settings. Services: ipapi.co (https://ipapi.co/) and ipwho.is (https://ipwhois.io/) as fallback What is sent: the visitor’s IP address (only when the option is enabled and no server-provided geo headers are available). When: at most once per visitor IP per week on success; failed lookups are retried after one hour. Why: to determine the visitor’s country code for the analytics dashboard. ipapi.co Terms of Service: https://ipapi.co/terms/ ipapi.co Privacy Policy: https://ipapi.co/privacy/ ipwho.is Terms: https://ipwhois.io/terms ipwho.is Privacy: https://ipwhois.io/privacy If the option is left disabled, the plugin never contacts ipapi.co or ipwho.is. No other external service is contacted. All scripts, styles and fonts are bundled locally. Features Privacy and compliance Server-side tracking with no frontend cookies and no tracking script Honors Do Not Track and Global Privacy Control signals Cookieless visitor opt-out shortcode and block, which also erases past records WordPress Privacy Tools exporter and eraser, plus suggested privacy policy text Exclude traffic by path, IP address or CIDR range, user agent, post type, and user role Reports Dashboard with KPI tiles, visitor and page-view trends, countries, and live activity Acquisition report: marketing channel grouping and campaign performance Content report: views by post type, author, category and tag Behavior report: entry pages, exit pages, internal site search, and new vs returning visitors Conversions report: goals, conversion rates, and revenue attribution Pages, Referrers, Users and 404 reports Sortable “Views (30d)” column on the Posts and Pages list tables Per-post analytics meta box in the editor Attribution and conversions Goal tracking by exact path, prefix, suffix, substring, regular expression, or post ID First-touch and last-touch attribution captured per session Channel grouping: direct, organic and paid search, organic and paid social, email, affiliate, display, referral WooCommerce revenue attribution by channel, campaign and landing page Data lifecycle Daily rollups condense each day into anonymous totals before raw records are purged, so you can keep years of trends while retaining only a few weeks of raw data Separate retention windows for raw hits and aggregated rollups Conversion records are stripped of visitor identifiers once the raw window passes Reporting and workflow Scheduled daily, weekly or monthly email digest with a fully brandable template Traffic anomaly alerts and busy-404 alerts, by email and as an admin notice Timeline annotations to mark launches and campaigns on your charts CSV export and settings import/export Developer surface Filters: ncaba_should_track , ncaba_hit_data , ncaba_channel , ncaba_retention_days , ncaba_summary_email_data, ncaba_email_html , ncaba_email_header_html , ncaba_email_footer_html, ncaba_email_footer_links , ncaba_email_headers , ncaba_banner_campaigns, ncaba_banner_eligible_screen , ncaba_search_engine_hosts , ncaba_social_hosts, ncaba_bot_user_agent_pattern Actions: ncaba_hit_recorded , ncaba_goal_converted , ncaba_visitor_opted_out , ncaba_alerts_raised, ncaba_email_sent , ncaba_cleanup_complete Authenticated REST routes under ncaba/v1 : stats , report/<name> , timeseries , annotations WP-CLI: wp ncaba stats , report , rollup , purge , export , send-summary , alerts