=== ConvertNow Analytics ===
Contributors: prateekzare
Donate link: https://paypal.me/prateekzare16
Tags: analytics, ai traffic, bot detection, privacy, cookieless
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.4.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Human only analytics in your own database. AI crawlers, bots and headless browsers counted apart, never as visitors. Cookieless, no paywall.

== Description ==

Most analytics tools count anything that runs JavaScript, so a self hosted counter can report several times the traffic a site really has. Screenshot services, uptime checks, SEO auditors and a growing crowd of AI agents all run a full browser now.
ConvertNow counts people. A pageview has to render on screen, then somebody has to move, scroll, tap, or stay for two seconds. It also has to come from somewhere people actually read from, not a cloud data center. Everything refused is kept, named, and shown to you under Filtered Traffic, never quietly dropped.

**AI and machine traffic, measured, not mixed in**

Nobody else treats this as the main event. ConvertNow gives you a chart of people against machines, the pages GPTBot, ClaudeBot and the other crawlers read most, the assistants that actually send readers to you, what every refused request was and when it came, and a Proof of Presence report that shows what convinced the plugin each counted view was real. A crawler is never a visitor, and an assistant fetching a page on somebody's behalf is interest, not attendance.

**Everything else you expect**

Visitors, visits, views, real bounce rate and time on page. Pages, entry and exit pages, referrers, channels, campaigns, countries, languages, browsers, devices. Goals, funnels, journeys, retention, segments and cohorts. Traffic by author and content type. WooCommerce and Easy Digital Downloads revenue attributed to the visit behind it. A weekly email, a shareable read only dashboard, CSV and JSON export.

**Runs on your own database**

No account, no key, no external service, no tier held back. The tracker inlines into the footer at about 1.5 KB. Raw hits roll up into daily summaries hourly, so a year of history costs the same queries as a day. Every chart is plain SVG.

**Private by design**

No cookies, no localStorage, no persistent identifier. Visitors are a one way hash of IP, user agent and a salt that rotates daily, so nobody is followed past midnight. Raw IP addresses are never stored. Refused requests are stored as counters only: a date, an hour, a kind, a published name, a path on your site. Never an address.

**Links**

* [convertnow.tools/convertnow-analytics](https://convertnow.tools/convertnow-analytics/) for docs and screenshots
* [contact@convertnow.tools](mailto:contact@convertnow.tools) or [prateekzare@gmail.com](mailto:prateekzare@gmail.com), both reach me

== Installation ==

From your dashboard:

1. Go to **Plugins → Add New** and search for **ConvertNow Analytics**.
2. Click Install Now, then Activate.
3. Open **ConvertNow** in the admin menu. Data starts appearing immediately.

Or by hand:

1. Upload the `convertnow-analytics` folder to `/wp-content/plugins/`.
2. Activate it from the Plugins screen.
3. Open **ConvertNow** in the admin menu.

Either way that is it. No key, no account, no configuration. Country data is built in, so the map and the Countries panel fill in on their own. Your own visits are not counted while you are logged in as an administrator or editor, which is why the numbers stay at zero until real traffic arrives.

== Frequently Asked Questions ==

= Do I need an account or a licence key? =

No, and there is nowhere to put one. There is no account, no key, no activation and no paid tier. The plugin contains no code that makes an outbound request, so there is nothing to opt out of either.

= Why are my numbers lower than Jetpack, Google Analytics or my host's stats? =

Four ordinary reasons, in the order they usually matter.

1. **You installed it partway through the period.** Days before the install are empty because nothing was recorded then, not because they were quiet.
2. **Administrators and editors are not counted**, by default. Your own visits, and your team's, are missing on purpose. Settings → Tracking changes it.
3. **Do Not Track.** If that setting is on, those readers are dropped entirely, and most other tools ignore the signal. New installs default to off; a site upgrading from an earlier version keeps it on until changed.
4. **Bots.** ConvertNow refuses crawlers, monitors, previewers and AI training bots before a row is written. Some tools count a share of them, which raises their numbers rather than lowering yours.
5. **A pageview needs a person.** The page has to render on screen and then somebody has to move, scroll, tap, type, or stay on it for two seconds. Anything that fetched the page and ran the script without a person behind it is not counted, and a good deal of what reads the web does exactly that. Filtered Traffic shows you exactly what was left out, so a low number can be checked rather than believed.

If the gap still looks wrong after that, the usual cause is the beacon being blocked: a security plugin that hardens `/wp-json/`, or a firewall rule. Since 1.2.0 the plugin retries on a front end URL when that happens, and counts readers with no JavaScript at all.

= Will data centre filtering drop my VPN readers? =

Some of them. A VPN whose exit sits in a cloud range looks the same as a headless browser on that range, and the plugin cannot tell the two apart by anything they send. Those readers are counted under Filtered Traffic as Data centre address rather than lost, so you can see how many there are, and Settings, Tracking, Accuracy and privacy has the switch if the number is bigger than the machines it keeps out.

= How do you tell an AI visitor from an AI crawler? =

They arrive by completely different routes and are handled at different points. A crawler identifies itself in the user agent, and GPTBot, ClaudeBot, CCBot, PerplexityBot, Bytespider, Applebot and Amazonbot are all refused by the collector before a row is written, so they never become traffic. A visitor is a browser carrying a referrer from an assistant's own domain. Only the second one reaches the AI screens, which is why every figure there is a person who read an answer and followed the citation.

= An assistant is missing. Can I add it? =

Yes, with the `cnwa_ai_sources` filter. Each entry is a pattern matched against the referrer host and the name to show. The list is checked in order, so a narrow host goes above a broad one.

= Is the AI insights screen actually AI? =

It is statistics, and the screen says so at the bottom of every run. Least squares fits for direction, median absolute deviation for outliers, share and concentration comparisons against the previous period of equal length. It runs on your server against your own rows, no model is called and nothing leaves the site. The name reflects what the screen is for, reading your numbers the way an analyst would, not a claim about how it works.

= Will generating insights slow my site down? =

It cannot touch your front end, because it only runs from the dashboard when somebody presses the button. The run itself reads the selected period and the one before it across several dimensions, which on a large site takes a few seconds, and the result is cached for five minutes so a second press costs nothing. Nothing runs on opening the screen.

= Can I count returning visitors? =

Yes, but it is off by default. Settings → Tracking → Visitor recognition widens the salt window from one day to 30, 90 or 365 days, or to never, where the same person is recognised for as long as the raw rows are kept. Until you change it the salt rotates daily and a reader returning tomorrow is a new visitor, which is the honest default for a plugin that stores nothing on the reader's device. Widening it changes what you are doing with visitor data, so update your privacy disclosures before you do.

= Does it work with caching plugins? =

Yes. The beacon is client side and posts to a REST endpoint, so a cached HTML page still reports its own view.

= Why do my visitor counts differ from other analytics tools? =

ConvertNow filters bots aggressively and counts a visitor as unique within a single day. Tools that use persistent cookies count differently. Neither number is wrong, they measure different things.

= Where is my data stored? =

In your own WordPress database, in nine tables prefixed `cnwa_`. Deleting the plugin removes all of them. The country lookup table is a read only file inside the plugin folder and holds nothing about your visitors.

**Clicks, downloads and searches**

On from the moment you install, because a Clicks screen that stays empty until you find a switch is a setup step, and the plugin promises none. A click is one row per interaction rather than per page, so events keep their own retention window, ninety days by default, which keeps the table bounded. Each type can be switched off on its own:

* Outbound links, with the destination and the domain
* File downloads, matched by extension
* Email and phone links
* Anything you name with a CSS selector, labelled by `data-cnwa-label` or its own text
* Page views that returned a 404, and the pages that linked to them
* What people typed into your search box

The last two are effectively free: they ride along with a page view that is already being recorded, so they cost one row and no extra request. Broken links and empty searches are usually the fastest wins on any site. The settings screen shows what event capture costs on your site, from your own traffic over the last thirty days.

**Notes on the chart**

A spike six weeks ago is just a shape unless something tells you what it was. Mark the day you redesigned, sent the newsletter or changed your prices, and the note stays on the chart with the traffic it explains. They are stored in one option row, so there is no table and nothing left behind.

**A weekly email**

Last week against the week before, your five most read pages and five biggest sources, in an email you can read in fifteen seconds. It comes from your own site, contains no tracking pixel, and reads from the daily summaries, so it costs the same whether you had a hundred visitors or a million. Off until you ask for it, and there is a button to send one now and find out whether email leaves your site at all.

== Screenshots ==

1. The Overview: visitors, visits, views, bounce rate and time on page, with the chart's optional trend, average, unusual-day and forecast layers switched on
2. Filtered at a Glance: people against machines, what was refused and why, when machines come, and the pages they fetch most
3. AI at a Glance: which assistants send people, what they were sent to, and the pages the models are reading
4. Proof of Presence: every counted view grouped by what proved a person was there
5. Pages at a Glance: what gets read, where visits begin and where they end
6. Referrers at a Glance: channels, search engines and social networks together
7. Campaigns at a Glance: UTM sources, mediums and campaigns in one place
8. Geographic at a Glance: countries and languages, with a world map
9. Goals, with the builder open: each rule reads back in a sentence and says how many of your pages it matches
10. Settings: the presence rule, the bot filter level, data retention and the weekly summary email

== External services ==

ConvertNow uses no external service for anything it does. There is one optional service, off by default, described in full below.

Tracking, reporting, goals, funnels, journeys, retention, segments, cohorts, insights, country lookups and exports all run on your own server against your own database. There is no activation call, no licence check and no key. Nothing about your visitors ever leaves your site under any setting.

**Optional: anonymous usage reporting (off by default)**

If, and only if, you switch this on, the plugin sends one report a month to convertnow.tools, the author's site, at `https://convertnow.tools/wp-json/cnwa-hub/v1/report`. It exists so the author can see which versions are in use and how the plugin is actually being used, and it is used for nothing else.

It is off on every install. You are asked once, on the plugin's own screen, with the exact payload from your site shown to you before you decide. Declining is remembered permanently. If you never answer, nothing is ever sent. You can switch it on or off at any time in Settings → Data retention → Anonymous usage report, and switching it off removes the scheduled event immediately.

This is the complete payload, and there is nothing else in it:

* Your site address and site name
* The date this plugin was first activated on your site
* Your total pageviews and total visitors for the last 30 days, as two numbers
* The ConvertNow, WordPress and PHP versions, and your site locale

It contains nothing about your visitors: no page paths, no referrers, no IP addresses, no visitor hashes, no user accounts, no email addresses, no post or page titles. The request is sent once every 30 days, non blocking, and a failure is silent.

Terms of service: [convertnow.tools/terms](https://convertnow.tools/terms/). Privacy policy: [convertnow.tools/privacy](https://convertnow.tools/privacy/).

The country lookup tables ship inside the plugin as plain text files and are read from disk. There is nothing to download and nothing to import.

== Other Notes ==

**Links**

* Plugin home page: [convertnow.tools/convertnow-analytics](https://convertnow.tools/convertnow-analytics/)
* Support by email: [contact@convertnow.tools](mailto:contact@convertnow.tools)
* The author directly: [prateekzare@gmail.com](mailto:prateekzare@gmail.com)
* Support forum: [wordpress.org/support/plugin/convertnow-analytics](https://wordpress.org/support/plugin/convertnow-analytics/)
* Leave a review: [wordpress.org/support/plugin/convertnow-analytics/reviews](https://wordpress.org/support/plugin/convertnow-analytics/reviews/)

Both addresses reach the same inbox. Email is usually the faster of the two; the forum is the better place for anything another user might hit as well.

**Bundled data**

IP Geolocation by [DB-IP](https://db-ip.com), used under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).

Data centre detection reads two plain text tables built from the [X4BNet datacenter lists](https://github.com/X4BNet/lists_vpn), MIT licensed, plus a short supplement of documented cloud supernets: `assets/data/dc-ipv4.csv` and `assets/data/dc-ipv6.csv`, in the same boundary format as the country tables. The build script is `tools/build-dc-tables.py` in the development sources.

Country lookups read two plain text tables built from the DB-IP IP to Country Lite database: `assets/data/geo-ipv4.csv` and `assets/data/geo-ipv6.csv`. Every line is one boundary, written as an uppercase hex address prefix and an ISO 3166-1 alpha-2 country code, so both files can be opened and read in any text editor. The world map outlines are plain JSON path data at `assets/data/world.json`. Nothing in the plugin is compiled, minified or obfuscated.

== Changelog ==

= 1.4.1 =

Charts that disagreed with the numbers above them now agree. The trend on every AI screen was drawing its summarised days and silently dropping the current one, so AI at a Glance showed a headline of twenty four views above a line that added up to twenty one, and the line fell to zero on today whatever the traffic was. The same gap left today out of the stacked charts on Authors, Landing Pages and Exit Pages. Both are fixed, and the trend, the ranked rows and the stacked chart on every screen are now checked against each other.

Biggest assistant was measuring its share against the whole site rather than against assistant traffic, so a single assistant sending every AI visit on the site was reported as 0%. It now reads as a share of the views it is a share of.

The weekly summary email no longer loses a week to a mail server having a bad hour. The week was being marked as sent before wp_mail was asked, and a refusal left it marked, so the email never went and nothing said why. A refused send is now retried on the following hourly runs, and the settings card says when the last one went out, or that the last one was refused and by what.

Count a view after offers one second again, alongside two, three, five and ten.

The four Maintenance buttons no longer shift sideways when one of them reports back: the answer goes in a fixed slot below the row, so the button you were about to press is still where you were looking. The same applies to the shared link and weekly email buttons.

On the screens a filter cannot reach, because a refused request carries no country or device, the filter chips say so instead of sitting there looking active. Every trend panel is now drawn by one piece of code, which is how the revenue one had quietly lost its download control.

= 1.4.0 =

The human only release. Pageviews from data centre addresses are refused: two bundled tables of cloud and hosting ranges, about 45,000 of them, let the collector tell a headless browser on AWS from a reader at home even when everything else about the request looks right. It is on by default and switchable in Settings, and the refused requests are counted under Filtered Traffic as Data centre address. A pageview now waits two seconds for a reader who does nothing, up from one, and only trusted device events count as an interaction: a click dispatched by script proves nothing. A page that merely stayed on screen in a browser that also reports oddly is refused and filed as headless, and Headless Chrome is recognised from its client hints even under a rewritten agent string. Settings gains an interaction only rule for sites that want the strictest count there is.

Filtered Traffic is rebuilt. Refused requests are now counted by hour and by page as well as by name, so the screens carry a dated chart with an axis, an hourly chart for today, a stack of what the traffic was over time, a chart of people against machines, the pages machines fetched most, and when in the day they come. AI Visibility gains Pages AI Reads, the pages the models are fetching, next to the pages assistants send people to. Proof of Presence shows every counted view by what proved a person was there, and the Overview carries a Not people card. The weekly email says how much was refused.

Setup is now nothing: click, download, contact link, missing page and site search capture are on from install, and the settings screen shows only what matters, with the fine tuning folded away on its most accurate defaults. Saving one settings form can no longer reset a field on another, and the delivery settings (script mode, endpoint name, proxy header, allowed domains) finally have a save button of their own. The weekly email sends on the first cron run on or after its day rather than only on the day, so a quiet site no longer skips a week.

Bugs fixed: on a site without pretty permalinks every dashboard request was a 404 and the screens sat on Loading; the upgrade routine logged a database error on every run under WP_DEBUG; the sidebar collapse button and the section dropdowns shared a style, which left two controls fighting each other and pushed the menu off the screen on tablets. The collapse button is gone and the sidebar is one menu with section dropdowns, becoming a single dropdown below 960 pixels. The engagement table scrolls sideways on phones instead of widening the page.

= 1.3.2 =

A pageview now has to prove somebody was there: the page has to render on screen, and then either somebody does something on it or it stays in front of them. The collect endpoint no longer accepts anonymous POSTs, and a route change only counts after an interaction. Expect lower numbers after this update, and nothing already recorded is rewritten.

Everything refused is counted by name under Stats, so a low figure can be checked rather than taken on trust. AI crawlers and AI assistant fetches are kept apart from each other and from your visitors: a person who follows a citation out of ChatGPT is still a visitor, the machine that fetched the page on their behalf never was.

The bot list was also making the opposite mistake. It matched company names rather than crawler names, so it refused the DuckDuckGo browser, Yandex's and Naver's phone apps, Petal Search, the Pinterest app and anyone reading a page inside Slack: seven of the fifty two real browsers now in the test set. There is one list instead of two overlapping ones, it has to be able to name a machine before it will refuse it, and Do Not Track exclusions are counted so a site honouring that signal can see where its traffic went.

= 1.3.0 =

Revenue reporting: WooCommerce and Easy Digital Downloads orders are read from the shop and attached to the visit that produced them, across seven new screens. Correct counting behind a page cache or a CDN, which was losing whole pages of traffic: the beacon now ships to everybody and exclusion happens on the collect request, page optimisers are told to leave it alone, and a shared CDN address no longer throttles the site.

= 1.2.3 =

Accuracy release, and your figures will get smaller. Four faults were inflating visitors and views: the no script image was counting machines, forwarded IP headers were believed on sites with no proxy, a retried beacon could store the same pageview twice, and bot filtering was an agent list and nothing else. All four are fixed and the stored history is cleaned in the background. Ranked reports also page and search properly now, so a site with thousands of pages can see past the top twenty.

= 1.2.2 =

An optional anonymous usage report, off on every install and never sent unless you agree. You are asked once, shown the exact payload from your own site first, and never asked again if you say no. Nothing about your visitors is included under any circumstances.

= 1.2.1 =

Data, then AI insights, runs a statistical read of the selected period on demand and returns ranked findings with the figure and the confidence behind each one. Everything is computed on your own server against your own rows. Also adds an optional longer visitor recognition window for counting returning readers, off by default.

= 1.2.0 =

Fewer requests, and a beacon that stops when your host says stop: it reads 429 and 503, honours Retry-After, holds a budget per visit, and a page read now costs one request instead of two with nothing lost. Counting is more complete too: readers whose browser ran no JavaScript are recorded, a blocked REST route no longer means lost traffic, and Do Not Track is no longer skipped by default on new installs.

= 1.1.1 =

Deleting the plugin keeps your settings, your shared link and your history by default, so updating by hand no longer wipes them. The AI screens now describe assistant traffic and nothing else, and authors, content types, assistants, cited pages and campaigns can all be filtered on.

= 1.1.0 =

AI Visibility: visits arriving from an assistant become their own channel with four screens of their own, and Gemini is no longer miscounted as organic search. Four optional statistical layers for the main chart, every one off until you switch it on. Goals and funnels read their own rules back as a sentence and funnel steps can be reordered.

= 1.0.0 =

First public release. Editorial reporting is the point of it: traffic by author, posts separated from pages and archives, and read depth per post. Real bounce rate and time on page from an engagement beacon rather than guessed from timestamps. Cookieless, self hosted, no account, no API key and no paid tier.

== Upgrade Notice ==

= 1.4.0 =
Counts people only: data centre addresses refused, two second dwell floor, trusted input events, headless browsers refused. Filtered Traffic rebuilt with dated charts, hourly detail, pages machines fetch and pages AI reads. Click and event capture switches on. Fixes the dashboard on plain permalink sites and the sidebar on tablets. Numbers may drop; Filtered at a Glance shows why.

= 1.3.2 =
Your numbers will get smaller, and that is the fix. A pageview now has to render on screen and then show a sign of a person before it counts. What is left out is counted by name under Stats, so you can check it. Also stops the bot list refusing real browsers. Nothing recorded is changed.

= 1.2.3 =
Fixes four faults that were inflating visitors and views, sometimes by an order of magnitude, and cleans the stored history in the background. Ranked reports now page and search on the server. Recommended for everyone.

= 1.2.2 =
Adds an optional anonymous usage report, off by default. You are asked once, shown the exact payload first, and never asked again if you decline. Nothing about your visitors is ever included.

= 1.2.1 =
Adds an on demand insights screen under Data that reports what actually moved in the selected period, exportable as CSV or JSON. Also adds an optional longer visitor recognition window for counting returning readers, off by default.

= 1.2.0 =
Counts readers without JavaScript, survives a blocked REST route, and no longer drops Do Not Track readers on new installs. A page read now costs one request instead of two, and the beacon backs off when your host returns 429. Recommended if you see rate limiting.

= 1.1.1 =
Deleting the plugin now keeps your settings, shared link and history by default, so updating by hand no longer wipes them. The AI screens are scoped to assistant traffic only, and authors, content types, assistants and campaigns can now be filtered on.

= 1.1.0 =
Adds AI Visibility reporting and fixes Gemini being counted as organic search. Summaries are rebuilt on upgrade so past days are reclassified too.

= 1.0.0 =
First public release.
