No Cookie Analytics – By Arfa

No Cookie Analytics – By Arfa is a privacy-first analytics plugin. It records every visit on your
own server, with no cookies, no tracking script, and no third-party services. Because nothing is
measured in the browser, there is nothing to slow your pages down and no analytics cookie banner to
show. Your visitors’ raw IP addresses are never stored.

Reports and dashboards

• Dashboard with KPI tiles, visitor and page-view trends, a live activity feed, and a countries map
• Acquisition report — marketing channel grouping (direct, organic and paid search, organic and paid
  social, email, affiliate, display, referral) and full UTM campaign performance
• Content report — views broken down by post type, author, category and tag
• Behavior report — entry pages, exit pages, internal site search (including searches that found
  nothing), and a cookieless new-vs-returning visitor split
• Conversions report — goals, conversion rates, and revenue attribution
• Pages, Referrers, Users and 404 reports
• A sortable “Views (30d)” column on the Posts and Pages list tables, and a per-post analytics box
  in the editor

Goals, conversions and revenue

• Define goals by exact path, prefix, suffix, substring, regular expression, or “viewed this post”,
  with an optional value per conversion
• First-touch and last-touch attribution captured for every session
• WooCommerce revenue attribution by channel, campaign and landing page — only the order id and
  total are stored, never customer details

Keep years of history without keeping years of personal data

• Raw page-view records are short-lived by design. Before they are deleted, each day is condensed
  into anonymous per-dimension totals, which are kept for a much longer window (two years by
  default). Long-term trend charts survive a short raw-data retention setting.

Privacy and compliance built in

• Honors the Do Not Track and Global Privacy Control browser signals — those visits are never recorded
• A cookieless visitor opt-out, as the [ncaba_optout] shortcode or the “Analytics opt-out” block,
  that also erases whatever was already recorded for that visitor
• Registers with the WordPress Privacy Tools (personal-data exporter and eraser) and adds suggested
  privacy-policy text
• Exclude traffic by path, IP address or CIDR range, user agent, post type, or user role

Delivered to you

• A designed weekly, monthly or daily email digest with a fully brandable header and footer, plus a
  live preview and one-click test send
• Traffic-anomaly alerts and busy-404 alerts, by email and as an admin notice
• Timeline annotations to mark launches and campaigns on your charts

For developers

• Filters and actions throughout the tracking, channel, email and reporting pipeline
• Authenticated REST routes under ncaba/v1 for stats, reports, time series and annotations
• WP-CLI commands: wp ncaba stats, report, rollup, purge, export, send-summary, alerts

Privacy

This plugin stores analytics records in your WordPress database (wp_ncaba_hits), including:

• Page URL/path
• Referrer host and the marketing channel it maps to
• Browser/OS/device type
• Anonymized IP hash
• Session key
• Country code
• Whether the request resulted in a 404 (not found)
• Whether the request was an internal site search, and the term used (can be disabled)
• Whether the visitor had been seen before
• UTM campaign parameters (utm_source, utm_medium, utm_campaign), when present in the visited URL
• Timestamp

No raw IP address is stored in the plugin database.

The plugin honors the DNT (Do Not Track) and Sec-GPC (Global Privacy Control) request headers by
default: those visits are never recorded at all. Visitors can also opt out themselves through the
[ncaba_optout] shortcode or the “Analytics opt-out” block, which erases the anonymous records
already stored for them and suppresses future ones — without setting a cookie.

Registered users’ records are exposed through the WordPress Privacy Tools, so Tools → Export Personal
Data and Tools → Erase Personal Data both cover this plugin.

Country detection behavior:

1. Uses server-provided geolocation headers when available (for example Cloudflare or GeoIP
   headers).
2. Optional external IP geolocation lookup can be enabled by admin consent in plugin settings.

When external geolocation is enabled, visitor IP is sent to:

• Service: ipapi.co (primary) and ipwho.is (fallback)
• Purpose: country lookup only

Site owners must disclose this in their privacy policy before enabling external lookup.

External services

This plugin can optionally use the third-party services ipapi.co and ipwho.is for country lookup. The lookup
is disabled by default and only runs after a site administrator explicitly enables the
“Allow External Geo Lookup” option in plugin settings.

• Services: ipapi.co (https://ipapi.co/) and ipwho.is (https://ipwhois.io/) as fallback
• What is sent: the visitor’s IP address (only when the option is enabled and no server-provided
  geo headers are available).
• When: at most once per visitor IP per week on success; failed lookups are retried after one hour.
• Why: to determine the visitor’s country code for the analytics dashboard.
• ipapi.co Terms of Service: https://ipapi.co/terms/
• ipapi.co Privacy Policy: https://ipapi.co/privacy/
• ipwho.is Terms: https://ipwhois.io/terms
• ipwho.is Privacy: https://ipwhois.io/privacy

If the option is left disabled, the plugin never contacts ipapi.co or ipwho.is.

No other external service is contacted. All scripts, styles and fonts are bundled locally.

Features

Privacy and compliance

• Server-side tracking with no frontend cookies and no tracking script
• Honors Do Not Track and Global Privacy Control signals
• Cookieless visitor opt-out shortcode and block, which also erases past records
• WordPress Privacy Tools exporter and eraser, plus suggested privacy policy text
• Exclude traffic by path, IP address or CIDR range, user agent, post type, and user role

Reports

• Dashboard with KPI tiles, visitor and page-view trends, countries, and live activity
• Acquisition report: marketing channel grouping and campaign performance
• Content report: views by post type, author, category and tag
• Behavior report: entry pages, exit pages, internal site search, and new vs returning visitors
• Conversions report: goals, conversion rates, and revenue attribution
• Pages, Referrers, Users and 404 reports
• Sortable “Views (30d)” column on the Posts and Pages list tables
• Per-post analytics meta box in the editor

Attribution and conversions

• Goal tracking by exact path, prefix, suffix, substring, regular expression, or post ID
• First-touch and last-touch attribution captured per session
• Channel grouping: direct, organic and paid search, organic and paid social, email, affiliate,
  display, referral
• WooCommerce revenue attribution by channel, campaign and landing page

Data lifecycle

• Daily rollups condense each day into anonymous totals before raw records are purged, so you can
  keep years of trends while retaining only a few weeks of raw data
• Separate retention windows for raw hits and aggregated rollups
• Conversion records are stripped of visitor identifiers once the raw window passes

Reporting and workflow

• Scheduled daily, weekly or monthly email digest with a fully brandable template
• Traffic anomaly alerts and busy-404 alerts, by email and as an admin notice
• Timeline annotations to mark launches and campaigns on your charts
• CSV export and settings import/export

Developer surface

• Filters: ncaba_should_track, ncaba_hit_data, ncaba_channel, ncaba_retention_days,
  ncaba_summary_email_data, ncaba_email_html, ncaba_email_header_html,
  ncaba_email_footer_html, ncaba_email_footer_links, ncaba_email_headers,
  ncaba_banner_campaigns, ncaba_banner_eligible_screen, ncaba_search_engine_hosts,
  ncaba_social_hosts, ncaba_bot_user_agent_pattern
• Actions: ncaba_hit_recorded, ncaba_goal_converted, ncaba_visitor_opted_out,
  ncaba_alerts_raised, ncaba_email_sent, ncaba_cleanup_complete
• Authenticated REST routes under ncaba/v1: stats, report/<name>, timeseries, annotations
• WP-CLI: wp ncaba stats, report, rollup, purge, export, send-summary, alerts