Track your website visitors for free, without cookies

What you see about your visitors

Every verified site gets a dashboard with visitors and pageviews over time, and breakdowns by page, referrer, country, device, browser, operating system, UTM source, medium and campaign, and custom event. Ranges up to 4 days are drawn per hour, longer ranges per day, and any period up to 400 days can be queried. Click a row to filter the whole dashboard by it; up to 12 filters stack.

Sources prefer utm_source, then the referring domain, so a visitor from ChatGPT shows up as chatgpt.com and one from a newsletter as whatever you tagged. Clicks without either show up as Direct / none.

How visitors are counted without cookies

The tracker sets no cookies and writes nothing to local storage. Each pageview is tied to a visitor hash made from the UTC day, a random daily salt, the site, the request IP and the browser's user agent. The IP address is only an input to that hash and is never stored, and the salt is deleted a minute after the UTC day ends, so the hash cannot be reversed later. Country comes from the browser's time zone, never from the IP.

That gives you unique visitors per day, per page and per source. It does not give you a person: no names, no IP lists, no cross-day profiles and no session replays.

Returning visitors are measured separately with weekly retention cohorts over 12 weeks. The only state is a small response the browser keeps in its own HTTP cache until midnight; clearing it makes the browser a new visitor.

Watch visitors live

The Live view opens with the last 5 minutes of hits and then shows new ones usually within a second: page, source, country and device per hit, the newest 500 on screen. A workspace map plots every site you own at once. An "only my traffic" switch shows just the hits from your own browser, which is the quickest way to check an install. Visitors online now means visitors in the last 5 minutes.

Where it works

Any page where you can add a script tag: plain HTML, WordPress, Ghost, Hugo, Jekyll, Astro, Next.js, React, Vue or a site on GitHub Pages, Netlify, Vercel or Cloudflare Pages. Single-page apps are tracked through pushState and popstate; hash routers use data-mode="hash". A noscript pixel counts browsers with JavaScript off.

Limits

Not included: session replay, heatmaps, individual visitor profiles, A/B tests and revenue tracking.

Set it up

Sign in with Google, add your domain and paste the tracking script from your site settings into your HTML:

<script
  async
  src="https://totallytics.com/latest.js"
  data-hostname="example.com"
  data-verify="YOUR_SITE_VERIFY_TOKEN"
></script>

The first pageview verifies the site, and the dashboard fills from there. Custom events like signups or downloads are one call: window.tt_event("signup").

FAQ

Can I see exactly who visited my website?

No. Totallytics counts visitors with a daily hash and never stores IP addresses, so there are no names, addresses or visitor profiles. You see how many people came, from where, on which pages and devices.

Does it count my own visits?

Yes, unless you exclude them. The "only my traffic" switch in Live shows which hits are yours while you check an install, and visitors with Do Not Track switched on are not counted at all.

Does it count bots and crawlers?

The tracker only runs in a browser that executes JavaScript, so crawlers that do not run JavaScript never appear in your visitor stats. To see which AI and search bots crawl your site, connect Cloudflare on the AI crawler analytics page.

Where is the data stored?

In Frankfurt, Germany, collected on Cloudflare's network. No cookies, no local storage, and IP addresses are never stored.