About this plugin
Trackless measures your site’s traffic (and, on WooCommerce stores, your real revenue and margin) entirely server-side. No own analytics cookies, no JavaScript snippet, and consent-banner needs depend on your site setup. You read the reports in your Trackless account dashboard.
cz, a collection of WordPress and WooCommerce plugins. cz/produkt/trackless/.
How visitors are counted (privacy by design):
- The visitor key is a daily-rotating HMAC-SHA256 hash of IP + User-Agent + day, keyed with a secret salt that exists only on your server. It cannot be reversed and changes every day.
- The raw IP address is never stored and never transmitted, only a keyed hash.
- Global Privacy Control (the Sec-GPC browser signal) is honoured: opted-out visitors are not tracked at all.
- No data is written to the visitor’s browser: no cookies, no localStorage, no fingerprinting scripts.
What it measures:
- Visits and sessions with source / medium / campaign and a GA4-style channel group
- Page views and events: product view, category view, search, add to cart, cart, checkout, 404
- Device, browser, OS, country and language (one row per visitor per day)
- With WooCommerce: orders, revenue, refunds, payment and shipping methods, first-order flag, order attribution (computed server-side from the cookieless visitor match), ordered items, including per-unit purchase cost for margin reporting if you store it ( _wc_cog_cost, _alg_wc_cog_cost, _cost or the trackless_wholesale_price filter)
Events are collected into a small queue table in your own database and flushed once a day via WP-Cron (or manually with the “Send now” button). The delivery is HMAC-SHA256 signed and idempotent, so retries are safe.
WP Super Cache in Simple mode also counts cached HTML pages on the server, without JavaScript. The temporary local queue contains keyed hashes, never the raw IP, and is imported by the same daily batch. Pages served without PHP (Expert mode, WP Rocket or LiteSpeed) are not counted; the settings page shows a warning.
WooCommerce is optional: on a plain WordPress site you get cookieless web analytics; with WooCommerce you also get the e-commerce metrics.
External service: Trackless (please read)
cz), a hosted analytics service. cz/ingest.
When data is sent: only after you enter your API key and explicitly tick the Data Processing Agreement (DPA) consent checkbox in the plugin settings. Until you do both, the plugin collects and sends nothing.
What is sent (once a day, HMAC-signed):
- Pseudonymous traffic aggregates: hashed visitor identifiers (keyed HMAC, daily-rotating), hashed IPs, page URLs, referrers, UTM parameters and click IDs, the raw User-Agent (used server-side to derive device/browser/OS and to flag bots, not stored), country code, language
- With WooCommerce: order data including order ID, totals and refunds (amounts), currency, payment method, shipping method, order status, and line items with prices and (if configured) per-unit purchase costs
- Site metadata: site name, domain, timezone, currency, order statuses, product categories, carriers, payment gateway names
gz (refreshed about once a week) and resolves the country locally. The visitor IP never leaves your server for this. 0.
gz (also refreshed about once a week) listing IP ranges that belong to datacentres, clouds and VPNs, and checks the visitor IP against it locally. Again, the IP never leaves your server. Consumer ISPs and Apple iCloud Private Relay ranges are excluded from that database, so an ordinary customer is not affected.
0.
json, a small list naming the network operator each range belongs to. It is what lets a visit that was treated as datacentre traffic be traced back to the network responsible, so a mistake can be found and corrected instead of guessed at. Fetched in the same step as the database itself, and like it, nothing about your visitors is sent anywhere.
json (also refreshed about once a week). If your site sits behind a CDN, this is what lets the plugin tell a visitor’s own IP from the CDN’s. Without it, every visitor would look like the same person.
A copy ships with the plugin, so this works from the very first request.
None of these three downloads sends anything about your site or your visitors: they are plain requests for public files.
Terms and pricing: Trackless is a paid service with a 30-day free trial; you need a Trackless account and API key to use this plugin.
- Terms of Service: https://trackless.cz/en/obchodni-podminky
- Data Processing Agreement (DPA): https://trackless.cz/en/zpracovatelska-smlouva