Download websites that use WP-Statistics

About WP-Statistics

Analytics choices leak intent. A site that ships visitor data to a hosted service has made one decision about privacy, procurement and where its logs live, and a site that keeps counting in its own database has made a different one. WP-Statistics belongs to the second group, an Analytics plugin that runs inside WordPress and stores what it collects on the site's own server.

Available since 2010 and licensed under GPL v2, the plugin is written in PHP like the platform it extends. Keeping visitor data local is the entire point of the design, and the appeal is easy to state: no third-party script in the page, no data processing agreement to sign, no dependency on an outside vendor continuing to offer a free tier. For operators in jurisdictions where consent for external analytics is contested, a self-hosted counter is the shortest route to something defensible in front of a regulator.

Version data is where an installed base like this becomes revealing. We record 44 distinct versions in the wild, and the value we encounter most often is 12.6.13. A spread that wide on a plugin which releases frequently says something plain about maintenance: a large share of these installations are sites nobody is actively administering. Stale plugin builds matter both to security researchers cataloguing attack surface and to anyone selling hosting, maintenance or managed updates, because an out-of-date counter usually travels with an out-of-date everything else.

As of October 2026 WP-Statistics appears on 5,905 sites. A per-domain lookup answers whether one site uses it. The downloadable list answers the questions that only exist in aggregate: how many sites run a self-hosted counter instead of a hosted service, which of them carry nothing else in the Analytics category, how the version distribution has shifted since the last export, and what content management stack sits underneath. Privacy tool vendors use that to size a market of operators who have already demonstrated they care. Security teams use it to find hosts on outdated builds. Hosting companies use it to learn what their own customers install without asking anyone.

Detection depends on the plugin leaving something visible in the page or in a request path, and a plugin whose purpose is to avoid loading external scripts is by nature quieter than one built around a hosted tag. Some installs are missed, particularly where a caching layer serves fully static HTML or where an administrator has renamed or restricted the plugin directory. Version strings come only from installs that expose them, so the version breakdown describes a subset of the sites in the total rather than all of them.