Analytics

The Analytics module counts your visitors on your own server: page views per day, your most-read pages, the sites that send you visitors, and how many different people came. It sets no cookie, runs no script in the visitor's browser and sends nothing to anyone else, so it needs no consent banner. It arrived in 1.13.0 and is off until you enable it.

Turning it on #

Enable Analytics under System ▸ Modules. The numbers appear in a card on the dashboard for anyone whose role has the View analytics permission — administrators by default.

The Analytics page #

Since 1.17.0, Site ▸ Analytics shows a range you choose against the period before: views, visitors, your top pages and the sites that send visitors, devices, the hour of day, campaigns (from a link’s utm_ tags) and pages not found, each with a Redirect it button. Download links you create under Site ▸ Redirects count their downloads, and the numbers export as CSV.

What it keeps, and what it never keeps #

• Views per page per day, counted under the page's own address, never whatever a visitor added to it.
• The site a visitor came from, as its name only (example.com), never the full address.
• A count of unique visitors per day. To tell two visits apart it uses a one-way code made from the visitor's address and browser with a secret that changes every day; the codes are deleted when the day ends, so no address or identifier outlives the day. A browser that sends Global Privacy Control or Do Not Track is counted as a view but not as a visitor.
• Nothing else: no cookie, no address, no browser details, no third party.

Search engines and other bots, staff previews of drafts, error pages and prefetches are not counted. Numbers are kept for 400 days, are not part of a backup, and disabling the module forgets the day's codes at once.