DevDome Analytics – WordPress Analytics, Visitor Stats & AI Bot Tracking

WordPress Analytics & Visitor Tracking

DevDome Analytics is a WordPress analytics plugin for real-time visitor statistics, website traffic analytics, visitor tracking, bot detection, AI crawler tracking, traffic sources, pageviews, sessions, and outbound click tracking.

See how many real people visit your WordPress site while bots and AI crawlers are measured separately, so automated traffic does not inflate your human visitor statistics.

A lightweight Google Analytics alternative for WordPress that stores no analytics data in custom tables inside your WordPress database.

Real-Time WordPress Analytics

Track visitors, pageviews, sessions, live visitors, top pages, traffic sources and referrers, countries, devices and browsers, outbound link clicks, bots, AI crawlers, and AI referral traffic.

Key visitor statistics appear directly inside WordPress, while your DevDome dashboard provides detailed website analytics reports covering periods from the last 24 hours up to 12 months.

Separate Real Visitors From Bots

Search engines, SEO crawlers, monitoring services, and AI bots constantly request WordPress websites. DevDome Analytics detects known bots and reports them separately from human visitors.

Detected crawlers include Googlebot, Bingbot, GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Google-Extended, CCBot, AhrefsBot, SemrushBot, and other known crawlers.

Unknown or deliberately disguised bots may not always be identifiable.

AI Crawler Tracking & AI Referral Traffic

See which AI crawlers visit your WordPress website. Known AI bots are identified separately from search-engine bots and human traffic, helping you understand when services such as ChatGPT, Claude, Perplexity, and Google-Extended access your content.

The plugin reports detected crawlers. It does not block them.

DevDome Analytics can also identify visits referred by supported AI assistants such as ChatGPT and Perplexity, helping you measure AI referral traffic separately from other website traffic sources.

Outbound Click Tracking

Track clicks on links that take visitors away from your WordPress site, including affiliate links, product links, partner websites, social profiles, and other external destinations.

Outbound clicks can be relayed through your own WordPress server so they can continue to be measured when ordinary third-party analytics requests are blocked.

Cookieless & First-Party Analytics

General website analytics are cookieless on new installations.

Returning-visitor tracking is optional and disabled by default. Outbound click tracking can use random visitor and session identifiers when a visitor clicks an external link and can also be disabled independently.

First-Party Delivery is available on supported DevDome plans. When enabled, the analytics script is served from your own domain and tracking events are relayed through your WordPress server using randomized site-specific paths.

This can reduce analytics data loss caused by browser extensions and ad blockers that target known third-party analytics domains, although no tracking method can guarantee detection of every visit.

Privacy Controls

You can independently enable or disable analytics tracking, returning visitor tracking, outbound click tracking, AI referral tracking, and bot and crawler tracking.

Administrators and editors are excluded by default, additional WordPress roles can be excluded, and the browser Do Not Track signal is respected by default.

DevDome Analytics does not collect form field values, post content, WordPress user accounts, customer data, order data, or activity inside wp-admin.

No Analytics Tables in WordPress

Analytics events are processed by the hosted DevDome Analytics service instead of being stored in custom analytics tables inside your WordPress database.

A free DevDome account is required because analytics events are processed and reports are generated by the hosted service.

Nothing is tracked or sent until the site is connected.

External services

Plugin catalog (devdome.com). The DevDome Dashboard inside wp-admin fetches the list of DevDome plugins (names, descriptions, logos, links, WordPress.org slugs) from https://devdome.com/wp-plugins/catalog.json at most once every 12 hours, so the list stays current. Only the bundled core version is sent in the request; no site or visitor data. Service provider: DevDome. Terms: https://devdome.com/terms-of-service Privacy policy: https://devdome.com/privacy-policy

DevDome Analytics is a connector for the DevDome Analytics service. It talks to two hosts, both operated by DevDome.

Terms of service: https://devdome.com/terms-of-service Privacy policy: https://devdome.com/privacy-policy

analytics.devdome.com – the analytics service

The tracking script, https://analytics.devdome.com/track.js Loaded in your visitors’ browsers on public pages, once the site is connected and Enable Tracking is on. It is not added to your pages before you connect. With First-Party Delivery on, a copy of this script that ships inside the plugin is placed in your uploads folder and served from your own domain instead; nothing is downloaded from DevDome for it.

The event ingest, https://analytics.devdome.com/api/event This is where analytics events are recorded, and there are four ways it is reached.

1. From the visitor’s browser, by the tracking script above. Each event carries: your Site ID (this site’s domain), your DevDome Account ID, the page URL and path, the page title, the referring URL, browser, operating system, device type, user agent, browser language, country, the target URL of a click, and a visitor ID and session ID only when the browser is storing them (see Privacy). The browser contacts the service directly, so its IP address is visible to it, as with any web server.
2. From your server, when it forwards an outbound-link click. The visitor’s browser sends the click to the /dd-e path on your own domain and your server relays it. Your server adds two fields to that relayed event: the visitor’s country code and the visitor’s IP address, so location and per-visitor counts stay correct when the event arrives from your server instead of from the browser.
3. From your server, when First-Party Delivery is on: the visitor’s browser sends every tracking event (the same fields as item 1) to a randomized path on your own domain and your server relays it, authenticated with this site’s secret token. The relay adds the same two fields as item 2, the visitor’s country code and the visitor’s IP address, and forwards nothing else: each event is rebuilt from an allowlist and the site and account identity always come from the plugin’s own settings.
4. From your server, when a known crawler requests a page and Track Bot Visits is on. That event carries the crawler’s user agent, the bot name and type, the requested URL and path, your Site ID and a timestamp. No human visitor data is in it.

The plan check, https://analytics.devdome.com/api/plugin/entitlements Asks whether this site’s DevDome plan includes First-Party Delivery. Sent only while that switch is on (once a day) or when you turn it on, carrying your Site ID and this site’s secret token. No visitor data.

The connection handshake, https://analytics.devdome.com/api/plugin/status Sent when you connect the site and when the connection is re-verified. Contains your Site ID, this site’s secret token, your Account ID, the site URL, the site name, the site administrator’s email address, the WordPress version, the PHP version, the plugin version, the active theme name, the timezone, the site language and whether this is a multisite install. No visitor data.

A shorter form (Site ID and secret token only) also runs when you open the plugin’s screen, at most once per 15 minutes: a site already connected on devdome.com shows as connected here without a second connect step. No visitor data, nothing on public pages.

The one-click connect handshake, https://analytics.devdome.com/api/plugin/connect/start and /api/plugin/connect/claim connect/start runs only when you press the “Connect Via DevDome Account” button, never on its own (opening the plugin’s screen makes only the connection-status check described above). It sends this site’s domain, its secret token and the wp-admin address to return to, and receives a short-lived connect link. connect/claim runs when your browser returns from devdome.com and exchanges that link for your Account ID.

The stats read, https://analytics.devdome.com/api/plugin/stats Sends your Site ID, this site’s secret token (so only your own site can read its numbers) and the selected day range. Used to fill the Overview tiles in wp-admin, and the bot-visit figure shared with DevDome Bot Protection when that plugin is installed.

Deleting your data, https://analytics.devdome.com/api/plugin/purge Sends your Site ID and this site’s secret token, and only when you press Reset Analytics, or tick “Also delete my data on DevDome” while disconnecting.

api.devdome.com – DevDome account services

These two are made by the shared DevDome library bundled with every plugin in the suite.

The account check, https://api.devdome.com/plugin/account A GET carrying this site’s domain and its secret token, answered with the Account ID and account email address that the token belongs to, so the DevDome screen can show which account this site is linked to. It runs when the DevDome screen is displayed, at most once every twelve hours, and never before you have acted: until you press a Connect button, save an Account ID or complete a connection, this check is not made at all.

Disconnecting, https://api.devdome.com/plugin/disconnect A POST carrying this site’s domain and its secret token, sent only when you press Disconnect, to unlink the site from the account.

Not contacted on this WordPress.org build

The bundled shared library also references endpoints this build never calls: the https://api.devdome.com/bot-protection/ signature feeds (used by other DevDome plugins; never fetched here, no cron scheduled) and https://api.devdome.com/plugin-updates/ (self-hosted updates, disabled here; updates come from WordPress.org).

devdome.com

Never sent, in any request

• Passwords and password hashes.
• Form field values submitted by visitors.
• Post, page, comment or any other WordPress content.
• User accounts, user lists, or the email addresses of your registered users. The one exception is the site’s administration email address, which is sent once during the connection handshake described above.
• Customer, order or payment data.
• Anything at all about what happens inside wp-admin.

Privacy

What is stored on your site. Roughly thirty option rows: the tracking switches, the service addresses, this site’s ID and secret token, your Account ID and account email, the timestamp of the connection, and, for First-Party Delivery, the switch itself and the randomized path and file names generated for this site. When that switch is on, one JavaScript file (the tracking script copied out of the plugin’s own package) is placed under your uploads folder; it is removed at uninstall. Nothing else. No custom tables, no post meta, no user meta, and not one analytics event. The short-lived transients: a connect handle (10 minutes), the cached bot-visit figure (1 hour), the cached plan answer for First-Party Delivery (a day), and flood counters for the /dd-e and First-Party relay endpoints that live for 2 minutes and are keyed by an MD5 hash of the visitor’s IP address.

Public paths the plugin adds. Up to four. /dd-e (only while connected) accepts the outbound-click beacon described in External services; it answers empty to everything else, requires the browser’s own same-site Origin header, ignores requests from excluded roles, is rate limited per IP address and stores nothing. The First-Party Delivery relay (only while that switch is on) is a randomized path unique to your site that accepts the tracking events described in External services under the same rules and stores nothing. /.well-known/devdome-analytics.txt (only while connected) returns one short line of fixed text, so DevDome can confirm the plugin really is installed on the domain you connected. /.well-known/devdome-connect-proof.txt returns a one-way SHA-256 fingerprint of this site’s secret token (never the token itself), so DevDome can confirm during connection that the request really came from this site.

What is stored on a visitor’s device. Two settings decide this, and they are independent of each other.

• Track Returning Visitors, off on new installs. While it is off, the DevDome tracking script writes nothing at all: no cookie, no localStorage, no sessionStorage. Unique visitors are still counted, using an identifier DevDome derives on its own server from the request (site, date, IP address and user agent, combined with a secret key); it changes daily, differs per site, and cannot be reversed to identify a person. The trade-off: a visitor who returns tomorrow counts as new. Turning the setting on stores a random visitor ID in a first-party cookie and localStorage, plus a session ID in sessionStorage, so the same person is recognised across days and a click can be tied back to its visit. Random values, nothing personal in them, but they are storage on a visitor’s device, so you may need visitor consent for it. The setting says so where you switch it on.
• Track Outbound Links, on by default. This is the exception to “nothing is stored”. The built-in click detector stores two randomly generated IDs the first time a visitor clicks a link that leaves your site: td_vid in localStorage and td_sid in sessionStorage. It does this even when Track Returning Visitors is off, because a click has to be tied to the visit it came from to be worth anything. Visitors who never click an outbound link are unaffected. If you do not want it, switch Track Outbound Links off; a visitor whose browser sends the Do Not Track header never gets it either.

Sites upgrading from an earlier version keep returning-visitor tracking on, exactly as they behaved before, so nothing changes on a live site until you decide otherwise.

IP addresses. The plugin never stores a visitor’s IP address on your site in readable form. It reaches DevDome two ways: the tracking script connects to the service from the visitor’s browser, like any web request; and relayed events (outbound clicks, First-Party Delivery) deliberately carry the visitor’s real address, else they would all be attributed to your server. DevDome uses it for geolocation and per-visitor counts.

How to turn things off. Enable Tracking is the master switch, and turning it off stops all collection. Track Clicks, Track Outbound Links, Track AI Referrals and Track Bot Visits each switch off on their own. Do Not Track Admins is on by default. Excluded roles lets you name any role that must never be tracked; new installs start with Administrator and Editor. Respect Do Not Track is on by default and honours the browser signal.

How to remove your data. Disconnect stops everything immediately: the tracking script is no longer added to your pages, the /dd-e endpoint stops relaying, and the domain-verification file is no longer served. To delete what DevDome has already collected, either press Reset Analytics, or tick “Also delete my data on DevDome” while disconnecting. If you do neither, DevDome deletes it automatically after 90 days of inactivity. On your own site there is nothing to clean up beyond the option rows listed above: the plugin creates no tables and stores no analytics data locally.

Source code

All of this plugin’s PHP and JavaScript ships unminified and human-readable.

One file is generated: assets/devdome-tools-tw.css, the admin screen’s stylesheet. It is a Tailwind CSS v3 utility bundle built from src/tw.css and tailwind.config.cjs with:

Those two build inputs are not included in the distributed package. Ask for them at https://devdome.com/contact and we will send them.