Works with your stack
Cookie consent for SlimStat Analytics
switch on its compliance mode
With default settings, SlimStat Analytics checks no consent. It sets a cookie from the first page, keeps full IP addresses and can record a logged-in user’s name and email with the visit. It follows WP Consent API only once you turn on its GDPR Compliance Mode and choose WP Consent API.
By VeronaLabs · wp-slimstat.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
SlimStat Analytics
WordPress plugin
- Tested version
- 6.0.0
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 6.0.0 tested
- Active installs
- 70,000+
What SlimStat Analytics adds to your visitors’ browser
Trackers it loads
- Slimstat Analytics →Statistics
Cookies seen in our test
slimstat_tracking_code
Browser storage
slimstat_transport_memory
What matters for consent with SlimStat Analytics
Turn on its compliance mode
SlimStat reads WP Consent API only when GDPR Compliance Mode is on and Via WP Consent API is chosen. It then waits for the statistics category, on the server and in the browser.
Personal data by default
Full IP addresses are kept, and the name and email of logged-in users or past commenters can be stored with the visit. Its anonymise and hash options are off by default.
A fingerprint, and a rare call out
Unless anonymous mode is on, SlimStat sends a browser fingerprint with each visit. Now and then, its fingerprint library also contacts its maker’s servers.
Hard to spot by address
Its script can sit at a hidden address, or come from a public CDN if you turn that on. In server-side mode, the visit is recorded while the page is built, before any script runs.
What our tests found on SlimStat Analytics
Set before the choice · Cookie RocksThree statistics plugins held until consent
Cookie Rocks 2.11.1 holds Independent Analytics, Burst Statistics and Slimstat until consent. Before the choice and after Refuse, none of them records a visit. After Accept, Independent Analytics and Burst count the page without a reload. Slimstat starts without a reload but only counts from the next page.
Seen in our tests, 6 November 2026, Cookie Rocks.
Good to know · SlimstatSlimstat's cookie cannot be erased from the browser
Slimstat 6.0.0 writes its cookie slimstat_tracking_code as HttpOnly in its session code, so no script in the browser can erase it. After a withdrawal, a consent tool can stop Slimstat but the cookie stays until it expires.
Read in its code, 6 November 2026, Slimstat.
Depends on a setting · SlimStat AnalyticsSlimStat Analytics follows WP Consent API only when you turn it on
- Needs GDPR Compliance Mode on and Via WP Consent API chosen.
- Its own banner (off by default) stores slimstat_gdpr_consent for 1 year.
- Its script can come from cdn.jsdelivr.net or from an address that hides its name.
- In server-side mode, the visit is recorded while the page is built.
Read in its code, 16 October 2026, SlimStat Analytics 5.5.0.
Full detail
SlimStat Analytics follows WP Consent API only after GDPR Compliance Mode is on and Via WP Consent API is chosen (statistics category), reading it in PHP and in the browser. Its own banner (off by default) stores slimstat_gdpr_consent for 1 year. Its script can be served from cdn.jsdelivr.net (option off by default) or from an obfuscated /<md5>.js/ address that hides its name; in server-side mode the visit is recorded while the page is built.
Depends on a setting · SlimStat AnalyticsSlimStat Analytics by default checks no consent and stores full IP addresses
setting “GDPR Compliance Mode” · by default: off
- GDPR Compliance Mode is off, so no consent is checked.
- Full IP addresses are stored (anonymize and hash off).
- Sets the cookie slimstat_tracking_code from the first page, for 30 minutes.
- Records the name and e-mail of logged-in users or commenters with the visit.
Read in its code, 16 October 2026, SlimStat Analytics 5.5.0.
Full detail
With default settings, SlimStat Analytics checks no consent (GDPR Compliance Mode off), stores full IP addresses (anonymize and hash off) and sets slimstat_tracking_code from the first page: a PHP cookie in the tracking response, HttpOnly, SameSite=Lax, 30 minutes. While personal data is allowed (the default), it records the logged-in user's name and e-mail, or the name and e-mail read from WordPress comment cookies, with the visit.
Set before the choice · SlimStat AnalyticsSlimStat Analytics sends a browser fingerprint with each visit
Unless anonymous mode is on, it sends a FingerprintJS fingerprint with each visit. About one page load in a thousand also contacts m1.openfpcdn.io. It keeps several keys in browser storage.
Read in its code, 16 October 2026, SlimStat Analytics 5.5.0.
Full detail
SlimStat Analytics bundles FingerprintJS 4.6.2 and, unless anonymous mode is on, sends a browser fingerprint (parameter fh) with each visit. FingerprintJS is loaded without monitoring:false, so on about one page load in a thousand it sends a GET to m1.openfpcdn.io. Its script keeps slimstat_transport_memory, slimstat_stale_id_guard and two consent-upgrade keys in sessionStorage, and a queue of unsent hits (slimstat_offline_queue, up to 200) in localStorage.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- SlimStat Analytics 6.0.0, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: SlimStat Analytics 6.0.0 on 7 November 2026, with WordPress 7.1.3.
Analytics and ad pixels
Other plugins of the same kind.
Questions
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For SlimStat Analytics users
Detailed statistics, after the choice.
one setting to switch
Every feature of the complete plugin for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.