Works with your stack
Cookie consent for WP Statistics
no cookie is not the whole story
WP Statistics counts your visitors on your own server, without cookies and without sending anything to another company. That does not settle consent on its own: it counts each visit before the visitor chooses, unless its consent setting is on, and some of its settings keep personal data.
By VeronaLabs · wp-statistics.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
WP Statistics
WordPress plugin
- Tested version
- 14.16.18
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 14.16.18 tested
- Active installs
- 500,000+
What WP Statistics adds to your visitors’ browser
Trackers it loads
- WP Statistics →Statistics
What WP Statistics puts on your pages
- A small tracking script
- Runs on every page and sends one page view to your own site, through its REST API. Nothing goes to another server, and nothing is written in the visitor’s browser: no cookie, no local storage.
- Visitor records on your server
- Each visit is saved in your database. By default the IP address is shortened, then mixed with the browser and a key that changes every day, so the same visitor cannot be followed from one day to the next.
- A consent setting
- Under Settings, Privacy, it can wait for the visitor’s choice read from WP Consent API. It offers that setting only when a consent plugin from its own built-in list is active.
- Server-side tracking, if you pick it
- Instead of the script, the visit can be recorded while the page is built. That happens before any banner can act.
What matters for consent with WP Statistics
No cookie, still a visit counted
WP Statistics sets no cookie, so it is easy to think it needs no banner at all. It still records a visit, with a hashed address, before the visitor chooses. Whether that needs consent depends on your settings and on the visitor’s country.
Its consent setting can be greyed out
WP Statistics reads the visitor’s choice from WP Consent API, but only with the consent plugins it lists itself. With any other banner the setting stays greyed out, and goes back to None when you open its settings. It then counts everyone.
Some settings make it personal data
Keeping full IP addresses, turning off the daily hashing, or storing the full browser string turns a visitor count into personal data. Keep the defaults if you want a measurement that waits for nobody where the law allows it.
Keep client-side tracking
Server-side tracking records the visit while the page is built, before any banner can act. Client-side tracking, the default, lets the visitor’s choice decide.
Cookie Rocks with WP Statistics
- Turns on its WP Consent API setting, which it greys out for consent plugins outside its own list: no visit is counted before the choice or after a refusal, and the current page is counted right after consent, without a reload. Nothing is written in its settings.
What our tests found on WP Statistics
Depends on a setting · WP StatisticsWP Statistics consent setting works only with plugins on its own list
setting “Consent integration” · by default: None
WP Statistics offers its WP Consent API setting only when a consent plugin from its own built-in list is active; with any other banner the setting is greyed out and goes back to None when the admin is opened.
Seen in our tests, 17 October 2026, WP Statistics 14.16.17.
Depends on a setting · WP StatisticsCookie Rocks Pro turns on WP Statistics consent integration by itself
setting “Consent integration”
With WP Consent API active, no page view is counted before the choice, and one after Accept all, without a reload. WP Statistics' settings are not changed.
Seen in our tests, 17 October 2026, WP Statistics 14.16.17.
Full detail
With WP Consent API active, Cookie Rocks Pro turns on WP Statistics' consent integration by itself, without writing to WP Statistics' settings: no page view is counted before the choice, and one after "Accept all", without a reload.
Good to know · WP StatisticsWP Statistics sets no cookie but counts visits before the choice
WP Statistics sets no cookie and uses no browser storage. Without a consent integration, it counts the visit before the visitor chooses.
Seen in our tests, 17 October 2026, WP Statistics 14.16.17.
Depends on a setting · WP StatisticsWP Statistics Bypass Ad Blockers hides the tracker's name
setting “Bypass Ad Blockers” · by default: off
With this option on (off by default), the tracker loads from an address without the plugin name. Only the tag ID wp-statistics-tracker-js stays recognisable.
Read in its code, 16 October 2026, WP Statistics 14.16.17.
Full detail
With Bypass Ad Blockers on (off by default), WP Statistics serves its tracker from an address like /?<6-character key>=<hash>, without the plugin name, and sends hits to admin-ajax.php; only the tag ID wp-statistics-tracker-js stays recognisable.
Good to know · WP StatisticsWP Statistics anonymises and hashes IP addresses by default
The IP address is anonymised, then hashed with a salt renewed every day. Hits go to the site itself, and visitors' browsers contact no other site.
Read in its code, 16 October 2026, WP Statistics 14.16.17.
Full detail
By default WP Statistics anonymises the IP address with WordPress' wp_privacy_anonymize_ip, then hashes it with sha256 of a salt renewed every day, the IP and the user agent; the full user agent is not stored. Hits are POSTed to the site's own REST route (or admin-ajax.php). Its geolocation database is downloaded by the server from cdn.jsdelivr.net or MaxMind; visitors' browsers contact no other site.
Sent from your server · WP StatisticsWP Statistics server-side tracking records visits before any banner can act
setting “Tracking method (use_cache_plugin)” · by default: JavaScript (client side)
With JavaScript tracking off, the visit is recorded while the page is built. Cookie Rocks 2.5.2 flags this mode on its dashboard, with a button to WP Statistics' settings.
Read in its code, 16 October 2026, WP Statistics 14.16.17.
Full detail
When WP Statistics' JavaScript tracking is turned off (server-side tracking), it records the visit in PHP while the page is built, before any banner can act, conditioned only on its consent integration read with wp_has_consent in PHP; it also cannot work with a page cache. Cookie Rocks 2.5.2 flags this mode on its dashboard with a button to WP Statistics' settings, and the warning disappears when client-side tracking is chosen again.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- WP Statistics 14.16.18, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Its own tags, set with a test ID, do not load before the choice and load after “Accept all”.
- Settings of the test: Default settings after activation.
- Last run: WP Statistics 14.16.18 on 7 November 2026, with WordPress 7.1.3.
Analytics and ad pixels
Other plugins of the same kind.
Questions
Does WP Statistics need consent?
It depends on your settings and on the visitor’s country. With its defaults it sets no cookie and stores a hashed address, which some countries accept without consent for a site’s own audience measurement and others do not. If you keep full addresses or turn off the hashing, treat it as statistics that need consent.
Which WP Statistics settings should I check?
Three. Keep the IP address anonymised and hashed, the defaults. Keep client-side tracking, so the visit can wait for the choice. And look at its consent integration under Settings, Privacy: it is the setting that makes it wait for the visitor.
Why did my visitor count drop after adding a banner?
Once its consent integration is on, WP Statistics counts only visitors who accept statistics. Visitors who refuse, or who leave without choosing, are no longer counted. That is the expected effect of asking first, not a fault of the counter.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For WP Statistics users
Your visitor counts, after the visitor’s choice.
wp statistics stays on
Every feature of the complete plugin for 30 days, no card. WP Statistics keeps counting as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.