WP Statistics – Simple, privacy-friendly Google Analytics alternative

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

1088 searches this plugin appeared in over the last 90 days, 20 listed. 961 left out as unrelated or noise (years, numbers, stray words). 1 of its tags isn't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

Share of active installs on each version of this plugin · 63% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 28 days ago and the previous band took 5.3 years to cross, so the real count is still just under 600K.

1. ★★★★★ Graham Stott

   4mo ago

   A really useful plugin giving a wealth of information on who is visiting your site. Having used the technical support I can say that they are very helpful at resolving issues you may have with the plugin. Definitely recommended. This topic was modified 3 days, 3 hours ago by Graham Stott.

   Read on wp.org ↗
2. ★★★★★ skorodimos

   4mo ago

   It is very useful application Congratulations

   Read on wp.org ↗
3. ★★★★★ Gennady Kurushin

   5mo ago

   This is an excellent statistics plugin! It provides essential data in a clear and concise format, which makes it ideal for most websites. No-cookie integration makes it better than many third-party implementations, such as Matomo. Email summaries are simple and useful. Strongly recommend!

   Read on wp.org ↗
4. ★★★★★ soulx

   5mo ago

   This works fine, and I have used it frequently to analyse how users behave on my page.you get a lot in free mode.

   Read on wp.org ↗
5. ★★★★★ aikotimmer

   6mo ago

   Great plugin. Works like a charm!

   Read on wp.org ↗
6. ★★★★★ revelnode

   6mo ago

   I hit the paywall with Jetpack, over 5000 visitors in a month… told I had to pay… Dropped Jetpack entirely. I now use other tools like WP Statistics to monitor my traffic instead.

   Read on wp.org ↗
7. ★★★★★ sonyamakepeace

   6mo ago

   We installed this plugin yesterday, having been disappointed with other site statistic plugins. This one was the worst of them all. I set a page counter on the blog pages, then logged out, and tried viewing the pages from different parts of the world using our VPN. Not one page shows any visitors. So we uninstalled it. Not only this, but the nags to buy the premium version really got me, when even the basics don’t work. This plugin was even worse than StatCounter, and that’s saying something. Statcounter worked fine on my static sites, when all I needed to do was add some code to the footer.

   Read on wp.org ↗
8. ★★★★★ ambientblog

   7mo ago

   (Edit 15-04) I have changed my feedback from 2 to 5 stars because of the extensive support (even when I’m a free user) which solved the issue. More details below in the reactions.Original feedback:I was happy with the versatility of this plugin and its many options. It looks and works great! But over time I noticed it was way too flattering in the statistics, especially when I compare the results to Google’s Site Kit. It looks like Statistics count all bots as visits!?! Since I don’t know how to interpret the statistics I deleted the plugin for now. This topic was modified 3 months ago by ambientblog. This topic was modified 3 months ago by ambientblog. This topic was modified 3 months ago by ambientblog. Reason: title corrected

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-10-23 Version 14.16.18 Fix: CookieYes integration: visits are recorded again on sites using the older CookieYes banner (“legacy mode”), after the visitor accepts it (issue #1175 ). Enhancement: Tracker Debugger shows when the last visit was re 14.16.18
2. 2026-10-14 Version 14.16.17 Enhancement: The Tracker Debugger now checks the tracker URL served on the public homepage and warns when cached pages reference an unavailable tracker ( #1167 ). Fix: Obfuscated tracker URLs cached by page or CDN caches 14.16.17
3. 2026-10-12 Version 14.16.16 New: Added a separate AI Assistants traffic channel for ChatGPT, Perplexity, Gemini, Claude, Copilot, DeepSeek, Grok, Mistral Le Chat, Meta AI, You.com, and Phind. Existing visits are not reclassified (issue #1152 ). New 14.16.16
4. 2026-10-01 Version 14.16.15 Enhancement: Hardened URL escaping in the filter dropdowns of the Referrals and Author Analytics reports. Enhancement: Removed the unused tracker.min.js file. The tracker loads js/tracker.js . 14.16.15
5. 2026-09-19 Version 14.16.14 Enhancement: DuckDuckGo noai, html, lite and start endpoints now count as DuckDuckGo search traffic (issue #1142 ). Enhancement: Hardened link escaping in admin reports. Fix: Taxonomy archive views are now attributed cor 14.16.14
6. 2026-09-05 Version 14.16.13 Fix: Corrected report links in Category Analytics. Fix: Date filters no longer trigger PHP warnings when the period name is unrecognized (issue #1130 ). Fix: Analytics page access and the date range picker now work corre 14.16.13

All 44 disclosed vulnerabilities are patched in the current version (14.16.18). Sites still on an older version should update.

1. Patched Medium · 6.1 WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting ↗
   2026-10-02 CVE-2026-97276 Improper Neutralization of Input During Web Page Generation Affects <= 14.16.14 Patched in 14.16.15
2. Patched Medium · 6.1 WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key ↗
   2026-10-01 CVE-2026-97652 Improper Neutralization of Input During Web Page Generation Affects <= 14.16.14 Patched in 14.16.15
3. Patched High · 7.2 WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.13 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-09-24 CVE-2026-93770 Improper Neutralization of Input During Web Page Generation Affects <= 14.16.13 Patched in 14.16.14
4. Patched High · 7.2 WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.11 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-09-02 CVE-2026-84774 Improper Neutralization of Input During Web Page Generation Affects <= 14.16.11 Patched in 14.16.12
5. Patched High · 7.2 WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter ↗
   2026-08-18 CVE-2026-15780 Improper Neutralization of Input During Web Page Generation Affects <= 14.16.8 Patched in 14.16.9
6. Patched Medium · 4.3 Statistics <= 14.16.9 - Authenticated (Subscriber+) Information Exposure ↗
   2026-08-03 CVE-2026-16562 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 14.16.9 Patched in 14.16.10
7. Patched High · 7.2 WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.6 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-06-01 CVE-2026-48839 Improper Neutralization of Input During Web Page Generation Affects <= 14.16.6 Patched in 14.16.7
8. Patched Medium · 6.5 WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation ↗
   2026-04-16 CVE-2026-3488 Missing Authorization Affects <= 14.16.4 Patched in 14.16.5
9. Patched High · 7.2 WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter ↗
   2026-04-16 CVE-2026-5231 Improper Neutralization of Input During Web Page Generation Affects <= 14.16.4 Patched in 14.16.5
10. Patched High · 7.2 WP Statistics <= 14.15.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header ↗
    2025-09-26 CVE-2025-9816 Improper Neutralization of Input During Web Page Generation Affects <= 14.15.4 Patched in 14.15.5
11. Patched Medium · 4.3 WP Statistics <= 14.15 - Missing Authorization ↗
    2025-08-14 CVE-2025-55716 Missing Authorization Affects <= 14.15 Patched in 14.15.2
12. Patched Medium · 5.4 WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update ↗
    2025-04-29 CVE-2025-3953 Missing Authorization Affects <= 14.13.3 Patched in 14.13.4
13. Patched High · 7.2 WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-03-11 CVE-2024-2194 Improper Neutralization of Input During Web Page Generation Affects <= 14.5 Patched in 14.5.1
14. Patched High · 7.2 WP Statistics <= 13.2.16 - Authenticated (Admin+) SQL Injection ↗
    2023-03-06 CVE-2023-0955 Improper Neutralization of Special Elements used in an SQL Command Affects <= 13.2.16 Patched in 14.0
15. Patched High · 8.8 WP Statistics <= 13.2.10 - Authenticated (Subscriber+) SQL Injection ↗
    2023-01-31 CVE-2022-38074 Improper Neutralization of Special Elements used in an SQL Command Affects <= 13.2.10 Patched in 13.2.11
16. Patched High · 7.2 WP Statistics <= 13.2.8 - Authenticated (Admin+) SQL Injection ↗
    2022-12-27 CVE-2022-4230 Improper Neutralization of Special Elements used in an SQL Command Affects <= 13.2.8 Patched in 13.2.9
17. Patched High · 8.8 WP Statistics <= 13.2.5 - Authenticated (Subscriber+) SQL Injection ↗
    2022-09-08 Improper Neutralization of Special Elements used in an SQL Command Affects <= 13.2.5 Patched in 13.2.6
18. Patched Medium · 4.3 WP Statistics <= 13.2.5 - Information Disclosure ↗
    2022-09-07 Exposure of Sensitive Information to an Unauthorized Actor Affects 13.2.5 Patched in 13.2.6
19. Patched Medium · 6.1 WP Statistics <= 13.1.7 - Cross-Site Scripting ↗
    2022-05-24 CVE-2022-27231 Improper Neutralization of Input During Web Page Generation Affects < 13.2.0 Patched in 13.2.0
20. Patched Medium · 6.1 WP Statistics <= 13.2.1 - Reflected Cross-Site Scripting ↗
    2022-05-11 CVE-2022-1005 Improper Neutralization of Input During Web Page Generation Affects < 13.2.2 Patched in 13.2.2
21. Patched High · 7.2 WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via platform ↗
    2022-02-17 CVE-2022-25307 Improper Neutralization of Input During Web Page Generation Affects <= 13.1.5 Patched in 13.1.6
22. Patched Critical · 9.8 WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via current_page_type ↗
    2022-02-16 CVE-2022-0651 Improper Neutralization of Special Elements used in an SQL Command Affects <= 13.1.5 Patched in 13.1.6
23. Patched Critical · 9.8 WP Statistics <= 13.1.5 - Unauthenticated SQL Injection ↗
    2022-02-16 CVE-2022-25148 Improper Neutralization of Special Elements used in an SQL Command Affects <= 13.1.5 Patched in 13.1.6
24. Patched High · 7.2 WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via IP ↗
    2022-02-16 CVE-2022-25305 Improper Neutralization of Input During Web Page Generation Affects <= 13.1.5 Patched in 13.1.6
25. Patched Critical · 9.8 WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via IP ↗
    2022-02-16 CVE-2022-25149 Improper Neutralization of Special Elements used in an SQL Command Affects <= 13.1.5 Patched in 13.1.6
26. Patched High · 7.2 WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via browser ↗
    2022-02-16 CVE-2022-25306 Improper Neutralization of Input During Web Page Generation Affects <= 13.1.5 Patched in 13.1.6
27. Patched Critical · 9.8 WP Statistics <= 13.1.4 - Unauthenticated Blind SQL Injection ↗
    2022-02-10 CVE-2022-0513 Improper Neutralization of Special Elements used in an SQL Command Affects <= 13.1.4 Patched in 13.1.5
28. Patched Medium · 6.5 WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation ↗
    2021-09-11 CVE-2021-4333 Cross-Site Request Forgery Affects <= 13.1.1 Patched in 13.1.2
29. Patched Medium · 6.1 WP Statistics <= 13.0.9 - Reflected Cross-Site Scripting ↗
    2021-08-30 Improper Neutralization of Input During Web Page Generation Affects <= 13.0.9 Patched in 13.1
30. Patched High · 7.5 WP Statistics <= 13.0.7 - Unauthenticated SQL Injection ↗
    2021-05-19 CVE-2021-24340 Improper Neutralization of Special Elements used in an SQL Command Affects < 13.0.8 Patched in 13.0.8
31. Patched High · 7.2 WP Statistics <= 12.6.6.1 - Unauthenticated Stored Cross-Site Scripting via IP Manipulation ↗
    2019-07-01 Improper Neutralization of Input During Web Page Generation Affects <= 12.6.6.1 Patched in 12.6.7
32. Patched Critical · 9.8 WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection ↗
    2019-07-01 CVE-2019-13275 Improper Neutralization of Special Elements used in an SQL Command Affects <= 12.6.6.1 Patched in 12.6.7
33. Patched Medium · 6.4 WP Statistics <= 12.6.5 - Stored Cross-Site Scripting ↗
    2019-05-31 CVE-2019-12566 Improper Neutralization of Input During Web Page Generation Affects <= 12.6.5 Patched in 12.6.6.1
34. Patched Medium · 6.1 WP Statistics <= 12.6.3 - Referer Cross-Site Scripting ↗
    2019-04-09 CVE-2019-10864 Improper Neutralization of Input During Web Page Generation Affects <= 12.6.3 Patched in 12.6.4
35. Patched Medium · 6.1 WP Statistics <= 12.0.9 - Authenticated Cross-Site Scripting ↗
    2017-07-07 CVE-2017-10991 Improper Neutralization of Input During Web Page Generation Affects <= 12.0.9 Patched in 12.0.10
36. Patched Medium · 6.1 WP Statistics <= 12.0.8.1 - Reflected Cross-Site Scripting ↗
    2017-07-03 Improper Neutralization of Input During Web Page Generation Affects <= 12.0.8.1 Patched in 12.0.9
37. Patched High · 8.8 WP Statistics <= 12.0.7 - Authenticated SQL Injection ↗
    2017-06-30 CVE-2017-18515 Improper Neutralization of Special Elements used in an SQL Command Affects <= 12.0.7 Patched in 12.0.8
38. Patched Medium · 6.1 WP Statistics <= 12.0.4 - Stored Cross-Site Scripting ↗
    2017-04-13 CVE-2017-2136 Improper Neutralization of Input During Web Page Generation Affects <= 12.0.4 Patched in 12.0.5
39. Patched Medium · 6.1 WP Statistics <= 9.5.1 - Cross-Site Scripting ↗
    2015-08-10 Improper Neutralization of Input During Web Page Generation Affects <= 9.5.1 Patched in 9.5.2
40. Patched High · 8.7 WP Statistics < 9.4.1 - Authenticated Blind SQL Injection ↗
    2015-07-09 Improper Neutralization of Special Elements used in an SQL Command Affects < 9.4.1 Patched in 9.4.1
41. Patched Medium · 5.5 WP Statistics < 9.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2015-04-15 Improper Neutralization of Input During Web Page Generation Affects < 9.1.3 Patched in 9.1.3
42. Patched High · 7.2 WP Statistics <= 8.4 - Stored Cross-Site Scripting ↗
    2014-12-03 Improper Neutralization of Input During Web Page Generation Affects <= 8.4 Patched in 8.5
43. Patched High · 7.2 WP Statistics < 8.3.1 - Multiple Cross-Site Scripting ↗
    2014-11-20 Improper Neutralization of Input During Web Page Generation Affects < 8.3.1 Patched in 8.3.1
44. Patched Medium · 6.1 WP Statistics <= 2.2.4 - Cross-Site Scripting ↗
    2012-05-15 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.4 Patched in 2.2.5

Translated into 55 languages, 13 at 90% or more

Plus 31 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-10-05 600K+ → 500K+ down after 1918 days in tier
2. 2021-07-05 500K+ → 600K+ up after 880 days in tier
3. 2019-02-06 400K+ → 500K+ up after 549 days in tier
4. 2017-08-06 300K+ → 400K+ up after 345 days in tier
5. 2016-08-26 200K+ → 300K+ up after 356 days in tier
6. 2015-09-05 100K+ → 200K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for WP Statistics – Simple, privacy-friendly Google Analytics alternative into a readme, a review or a deck. It updates itself.

WP Statistics – Simple, privacy-friendly Google Analytics alternative: 500K+ active installs, 4.1★ (758 reviews). Plugin Pulse (WP Mayor), as of 2026-11-02. https://plugins.wpmayor.com/plugin/wp-statistics