Visitor statistics
The site can load the script of one of three statistics services. All three count visits without cookies and without storing anything in the visitor's browser, so the site needs no consent banner for them.
| Service | Set | Costs |
|---|---|---|
| Cloudflare Web Analytics | CLOUDFLARE_ANALYTICS_TOKEN | Free. Page views, referrers, countries and devices. |
| Plausible | PLAUSIBLE_DOMAIN, and PLAUSIBLE_SCRIPT_URL for a server of your own | Paid at plausible.io, or free on your own server. Adds goals and events. |
| Umami | UMAMI_WEBSITE_ID, and UMAMI_SCRIPT_URL for a server of your own | A free tier at Umami Cloud, or free on your own server. Adds goals and events. |
Without any of these variables, no script loads and nothing is counted. With variables for more than one service, one is used: Cloudflare before Plausible, Plausible before Umami.
Setting it up #
- Add the site in the service. Cloudflare gives a snippet with a token, Plausible asks for the domain, and Umami gives a website id.
- Set the variable on the live site's server or platform, and restart the site. The variable is read at runtime, so the image needs no new build.
- Open the site in a browser and check that the service shows the visit. A browser's tracking protection, or an ad blocker, may stop the script: try another browser if nothing arrives.
The script loads after the page has become interactive, on every page outside the admin. All three services follow the address when a visitor moves between pages without a full reload.
Why an environment variable, not a setting in the admin #
Only the deployment that has the variable counts visits. A development machine, a staging copy or a database copied from the live site sends nothing, and the statistics show real visitors only. Leave the variables out of .env in development.
Other services and consent #
The kit loads only these three services. A service that sets cookies or tracks visitors across sites, such as Google Analytics, needs the visitor's consent first in the EU and the UK, and the kit has no consent banner.
The kit sends no Content Security Policy. If you add one, allow the service's script address and the address it reports to: static.cloudflareinsights.com and cloudflareinsights.com for Cloudflare, or your Plausible or Umami server.