=== GhostStat Analytics ===
Contributors: ghoststat
Tags: analytics, statistics, privacy, cookieless, visitors
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Cookieless, privacy-first website analytics. Adds the GhostStat tracker to your site and shows visitors, pages, sources and devices in WordPress.

== Description ==

**Know who visits your site, without cookies, without a consent banner and without leaving WordPress.**

GhostStat measures your visitors without cookies, without local storage and without fingerprinting, so it needs no consent banner. This plugin connects your WordPress site to your GhostStat account and puts your numbers where you already work: on your WordPress dashboard.

= Set up in a minute =

Paste your GhostStat site key under Settings → GhostStat and save. That's it: every page is measured. You can also paste the whole GhostStat snippet; the plugin takes the key out of it. The tracker is loaded with `defer`, so it never holds up your page.

= Your statistics, inside WordPress =

Add an optional read-only API key and you get a full statistics page under **Dashboard → GhostStat**:

* **Visitors, visits, pageviews, average visit and bounce rate** at a glance
* **Online now**: how many people are on your site right now
* **Visitors over time**: a clear chart of visitors and pageviews
* **Top pages, top sources and countries**: what people read and where they come from
* **Devices and browsers**: phone, desktop or tablet; Chrome, Safari, Firefox and more
* **7 days, 30 days, 90 days or 12 months**: switch with one click

And a **dashboard widget** with the last 7 days (visitors, pageviews, bounce rate, a trend line and your top pages), the first thing you see when you sign in.

= Only real visitors =

Choose which signed-in roles are not measured. Administrators are left out by default, so your own clicks while editing don't fill up your numbers.

= Built to stay out of your way =

* **Fast:** one small tracker script, loaded deferred. In wp-admin, reports are cached for five minutes.
* **Self-contained:** charts are drawn by the plugin itself; no chart library or other code is loaded from elsewhere in wp-admin.
* **Works with page caching:** the tracker tag is the same for every visitor.
* **Safe keys:** the API key is read-only, stays on your server and is never sent to a browser.
* **Check now:** one button tells you whether GhostStat knows your site key and whether your API key works.
* **Translation-ready.**

= Want to go deeper? =

The plugin shows the essentials. The GhostStat app adds the full reports: heatmaps, funnels, visitor journeys and more. One click on **Open GhostStat** takes you there.

A GhostStat account is needed. There is a free plan and no card is needed to start: [ghoststat.me](https://ghoststat.me/).

== External services ==

This plugin relies on GhostStat (https://ghoststat.me/), a web analytics service run by GhostStat. It talks to the service in two ways:

1. **The tracker (on your public pages).** Once you have saved a site key, every page of your site loads the GhostStat tracker script from `https://cdn.ghoststat.me/gs.js`. Your visitors' browsers then send GhostStat the address and title of the page viewed, the referring page, UTM campaign parameters, screen size and pixel ratio, language, browser and operating system details (including browser client hints where the browser offers them), and a few device capabilities such as touch support and dark mode, to `https://api.ghoststat.me`. Plugins you switch on in your GhostStat account (for example heatmaps or session recordings) load their own scripts from `https://cdn.ghoststat.me` and send what that feature measures. GhostStat sets no cookies, stores nothing in the visitor's browser and does not fingerprint. Signed-in users whose role you exclude are not measured, and nothing is loaded until a site key is saved.
2. **Your statistics (in wp-admin only).** If you save an API key, your WordPress server asks `https://api.ghoststat.me/stats/…` for this site's reports when someone opens Dashboard → GhostStat or the dashboard widget, and when you press "Check now" in the settings. These requests send the site key and the API key; answers are cached for five minutes. "Check now" also asks `https://api.ghoststat.me/collect/config` whether the site key exists.

* GhostStat terms of service: https://ghoststat.me/terms
* GhostStat privacy policy: https://ghoststat.me/privacy

== Installation ==

1. Install and activate the plugin.
2. In the GhostStat app (https://app.ghoststat.me), add your site and copy the site key from **Install**.
3. In WordPress go to **Settings → GhostStat**, paste the site key and save. Every page is now measured.
4. Optional: in the GhostStat app open **Site settings → API keys**, create a key, and paste it under **Statistics in WordPress**. Dashboard → GhostStat and the dashboard widget now show your numbers.
5. Press **Check now** to confirm both keys work.

== Frequently Asked Questions ==

= Do I need a cookie banner for GhostStat? =

GhostStat sets no cookies and stores nothing on the visitor's device, so it does not need cookie consent. Check your own legal situation if you are unsure.

= Is GhostStat free? =

There is a free plan, and no card is needed to start. See https://ghoststat.me/pricing for what each plan includes.

= Will it slow down my site? =

No. The tracker is one small script, loaded with `defer`, so your page shows first. The plugin adds nothing else to your public pages.

= Will my own visits be counted? =

Not while you are signed in as a role you excluded. Administrators are excluded by default; change this under Settings → GhostStat.

= Is the API key safe to store here? =

It is read-only: it can read this one site's reports and nothing else. It cannot change settings or sign in to GhostStat. It is kept in your WordPress database and only used server-side. You can revoke it at any time in the GhostStat app.

= Does it work with caching plugins? =

Yes. The tracker tag is the same for every visitor, so cached pages measure correctly. After saving the site key, clear your page cache once.

= Where are heatmaps, funnels and session recordings? =

Those are in the GhostStat app. Press **Open GhostStat** on the statistics page.

== Screenshots ==

1. Dashboard → GhostStat: visitors, visits, pageviews, average visit, bounce rate, visitors online, the visitors-over-time chart and top lists.
2. The dashboard widget: the last 7 days at a glance, right when you sign in.
3. Settings: site key, roles not counted, the read-only API key and the connection check.
4. The statistics page on a phone.

== Changelog ==

= 1.0.0 =
* First release: tracker on every page, roles not counted, statistics page, dashboard widget, connection check.

== Upgrade Notice ==

= 1.0.0 =
First release.
