Pick the measurement model
Umami, Plausible, Matomo and GoatCounter represent different feature sets and operating choices. Review current requirements, licences and actual data collection. A product’s name is not a substitute for reviewing its configured behaviour.
Minimise event contents
Avoid recording passwords, tokens, private page parameters or sensitive identifiers. Consider aggregate counts, short retention and limited access before collecting user-level journeys. Review what the reverse proxy logs as well as the analytics application.
Treat consent as a real design question
A cookie-free setup is not automatically outside every privacy or consent rule. Applicable requirements depend on the data, technology, users and jurisdiction. Explain the implementation accurately and obtain appropriate review.
Keep the service dependable
Protect the dashboard, restrict writes where supported, monitor the database and prune old data. Test that blocked analytics does not break the primary site. Back up configuration and only retain the history you actually need.
Inspect one real event
Open the browser’s network inspector and review the request produced by a page view. Check the path, query parameters, referrer, identifiers and event payload. Compare what is sent with the policy shown to users. This simple inspection often finds unnecessary data before it accumulates in a database.
Define useful retention
Decide which reports need daily aggregates and which, if any, need individual events. Schedule deletion or aggregation and verify that it actually occurs. Keep dashboard access restricted and prevent the analytics failure path from delaying the primary website.
Compare the collection model and operating stack
Choose a tool around the questions you need to answer. Umami’s current self-hosted setup uses PostgreSQL; Plausible Community Edition, Matomo and GoatCounter have their own stacks and feature boundaries. Review the current release and database requirements rather than assuming the hosted product and self-hosted edition are identical. Sessions, replay and custom identifiers add data and responsibilities beyond an aggregate page counter. Start with the smallest collection model that answers a real product question.
Official documentation: Umami installation · Plausible self-hosted edition · Matomo installation · GoatCounter self-hosting project
Keep administration and collection on separate rules
Use a supported deployment, a private database connection and TLS. Change any default administrator password immediately. Create the site/project entry and add only the required tracking snippet to pages you control. Protect the dashboard and administrative routes; a public collection endpoint does not mean its reports should be public. Keep database migrations, application secrets and a recovery export in the update plan.
- Exclude private configuration, checkout details and token-bearing query strings from events.
- Record the exact script origin and endpoints for the site privacy policy.
- Check licensing and edition limits before offering dashboards to other organisations.
Official documentation: Umami setup and default account
Inspect the event rather than trusting a product label
Use a disposable page view and a harmless custom event. Inspect the network request for its URL, referrer, identifiers, payload and storage/cookie behaviour, then compare the dashboard entry. Repeat with analytics blocked: the primary site must remain functional. A collection endpoint returning success with an empty report can indicate the wrong project identifier, origin rule, blocked script or a queue/database issue. Do not put a real password or payment reference into a diagnostic event.
Make retention a task with an observable result
Choose deletion or aggregation windows before a database fills up. Inspect reverse-proxy and database logs as well as the analytics settings; they can retain more detail than the reporting UI. Test an export, a restoration and the actual removal of an expired test event. Cookie-free is a technical description, not a blanket legal exemption. Review the actual data, purposes, audience and applicable rules rather than promising automatic compliance from a product name.