No Cookie Analytics – By Arfa WordPress Plugin

Download Trends

Loading download data…

Vulnerabilities

✓

No known vulnerabilities

This plugin has no records in the Wordfence Intelligence vulnerability database.

About No Cookie Analytics – By Arfa

Privacy-focused analytics with server-side tracking, dashboard reports, and no frontend cookies.

No Cookie Analytics – By Arfa tracks visits server-side without setting cookies in visitors’
browsers. Data stays in your WordPress database with an admin dashboard, reports, and optional
CSV export.

Privacy

This plugin stores analytics records in your WordPress database (wp_ncaba_hits), including:

Page URL/path
Referrer host
Browser/OS/device type
Anonymized IP hash
Session key
Country code
Timestamp

No raw IP address is stored in the plugin database.

Country detection behavior:

Uses server-provided geolocation headers when available (for example Cloudflare or GeoIP
headers).
Optional external IP geolocation lookup can be enabled by admin consent in plugin settings.

When external geolocation is enabled, visitor IP is sent to:

Service: ipapi.co (primary) and ipwho.is (fallback)
Purpose: country lookup only

Site owners must disclose this in their privacy policy before enabling external lookup.

External services

This plugin can optionally use the third-party services ipapi.co and ipwho.is for country lookup. The lookup
is disabled by default and only runs after a site administrator explicitly enables the
“Allow External Geo Lookup” option in plugin settings.

Services: ipapi.co (https://ipapi.co/) and ipwho.is (https://ipwho.is/) as fallback
What is sent: the visitor’s IP address (only when the option is enabled and no server-provided
geo headers are available).
When: at most once per visitor IP per week on success; failed lookups are retried after one hour.
Why: to determine the visitor’s country code for the analytics dashboard.
ipapi.co Terms of Service: https://ipapi.co/terms/
ipapi.co Privacy Policy: https://ipapi.co/privacy/
ipwho.is Terms: https://ipwhois.io/terms
ipwho.is Privacy: https://ipwhois.io/privacy

If the option is left disabled, the plugin never contacts ipapi.co or ipwho.is.

Features

Server-side tracking
GDPR-aware design (configure to your legal requirements)
No frontend cookies
Admin dashboard and home screen widget
Pages, Referrers, and Users reports
CSV export and settings import/export
Local bundled frontend assets (no CDN required)

Frequently Asked Questions

Does this plugin set cookies?

No. Tracking is performed on the server when pages are requested.

Where is data stored?

In a custom table in your WordPress database (wp_ncaba_hits by default).

Ratings & Reviews

★★★★★

1 ratings

5★

4★

3★

2★

1★

Recent Reviews

Loading reviews…

View all reviews on WordPress.org (opens in a new tab)

Changelog

1.0.8

Dashboard: redesigned info tooltips to use Dashicons with cleaner markup and tooltip text via CSS ::after.
Dashboard: Visitors Overview chart now shows hourly data when the “Last 24 hours” filter is selected.
Fixed hourly chart data accuracy by bucketing visits in the WordPress site timezone.
Improved country detection with more server geo headers, better proxy IP resolution, and optional
external lookup via ipapi.co with ipwho.is fallback (removed browser-language country guessing).
Fixed recent activity timestamps by storing hits in site time and formatting relative times correctly.
Settings: added role-based tracking exclusion with a custom searchable multiselect when “Skip tracking
for logged-in users” is enabled.
Admin notices (including warnings) now render before the analytics layout wrapper to avoid layout issues.
Tracking now records page paths with query strings (for example /blog?123456) as separate entries in reports.

1.0.7

Removed UTF-8 byte order marks (BOM) from PHP sources so activation no longer sends accidental
output to the browser.
Uninstall: reliable table drop, clear all related and legacy cron hooks, and remove cached
geo lookup transients.
Deactivation: clear legacy cleanup cron hook names in addition to the canonical event.

1.0.6

Renamed plugin to “No Cookie Analytics – By Arfa”; text domain and translation template are
no-cookie-analytics-by-arfa (Domain Path: /languages).
Main bootstrap file is no-cookie-analytics-by-arfa.php; directory slug no-cookie-analytics-by-arfa.
PHP class and constant prefix NCABA_* (e.g. NCABA_VERSION, NCABA_Activator); runtime
identifiers use lowercase ncaba_* / ncaba- (database table {prefix}ncaba_hits, options,
hooks, AJAX, and asset handles). Legacy cfaba_*, cfba_*, and mistaken NCABA_* option keys
or table names migrate automatically on upgrade.
Plugin URI points to a reliable HTTPS profile page; localized admin strings and dashboard JS
escaping improvements.
Bumped tested-up-to header for current WordPress.

1.0.5

Previous branding and slug iteration; see older releases for detail.

1.0.4

Raised minimum WordPress version to 6.2 for safe %i identifier placeholders in
$wpdb->prepare().
Hardened admin and cron SQL (prepared statements, esc_like() for LIKE patterns).
Replaced parse_url() with wp_parse_url(); removed redundant fclose() on export stream.
Settings import notices use per-user transients; validated upload temp files with
is_uploaded_file().
Added readme short description; direct-access guard on settings view template.