plugins

BareProxy Analytics Plugin: Visit Stats From Proxy Records, With No JavaScript and No Cookies

Status: planned, number 16 of 21 in BareProxy’s build order. The plugins are built easiest first, and this one is about three days of coding: counting, daily hashing and a report page. It comes after the OpenTelemetry export plugin. This post describes what it will do, and it will be updated as it is built.

Most site analytics work by adding a script to every page. The script slows the page down, sets cookies that need a consent banner, and misses everyone who blocks it, which on some sites is a third of the audience. Meanwhile the proxy in front of the site already sees every single request.

BareProxy already writes one record per request. The analytics plugin reads those records as they’re made and turns them into the numbers a site owner actually looks at.

What It Will Do

  • Pages, referrers, countries, devices. The usual reports, by day and by hour, from requests the proxy has already handled.
  • People and bots apart. Crawlers, uptime checkers and scrapers are counted separately, so a jump in AI crawler traffic doesn’t look like a jump in readers. It shares its view of bots with the AI crawler control plugin.
  • No cookies, no script, no personal data kept. Unique visitors are estimated from a hash of the address and browser that changes every day, the same method privacy-first analytics tools use. Addresses themselves are never stored.
  • A small report page. Served by the plugin itself at a path the config names, behind an auth gate if you like.

A config will look something like this:

plugin stats /etc/bareproxy/plugins/analytics.wasm
  config /etc/bareproxy/plugins/stats.json
  store 512MB

site example.com
  use stats
  route /* -> files /var/www/example/public

What It Can’t See

Proxy analytics count requests, not what happens in the browser afterwards. Scroll depth, clicks on buttons and time on a page stay invisible without a script. For most sites the trade is worth it: exact counts of what was actually served, nothing slowing the page down, and nothing to ask permission for.

The whole program is on the plugins page.