How to add privacy-friendly analytics to WordPress

To add privacy-friendly analytics to WordPress, choose a tool, install its tracker once, configure consent where required, and verify a visit in both the browser and the dashboard. You do not need to edit your theme to do this.

This guide uses Databuddy and a script-injection plugin. The plugin inserts the tracker; it is not an official Databuddy analytics plugin. Databuddy collects analytics without analytics cookies, but it uses browser storage. Whether your site needs consent depends on your setup and the applicable rules.

Before you start

You need administrator access, a Databuddy account and a website ID from your dashboard. On self-hosted WordPress, check that you can install plugins. On WordPress.com, check the current custom-code requirements: custom JavaScript requires an eligible plugin-enabled plan with hosting features activated.

Back up the site using your usual process. Make a note of any analytics already installed through your theme, plugins or Google Tag Manager. Choose one owner for the new tracker so a later theme change or plugin installation does not add it again.

1. Create the website in Databuddy

Open Databuddy, add the website you want to measure, and copy its website ID. Use the website ID in the browser snippet, not a private API key. Give each unrelated client site its own website entry.

For an agency, decide who should own the account before installing the tracker. Client ownership and access are easier to manage when they are part of the setup rather than an offboarding task.

2. Review collection and consent

Databuddy stores a random visitor ID in first-party localStorage and session information in sessionStorage. Ingestion hashes visitor IDs with a rotating daily salt by default. These choices do not make every payload anonymous or automatically remove consent requirements. See the collection guide and privacy and consent guide.

If consent is required, configure your consent manager to load the tracker only after consent and test refusal as well as acceptance. Adding a normal script to the site header does not perform that gating for you. Keep consent controls needed for any remaining advertising, embeds or other tracking.

Start with the measurements you need. Review optional interactions, errors, replay and user identification before enabling them. Check page paths, titles and event properties for personal information, and update your privacy notice to describe the processing you actually use.

3. Install a script-injection plugin

In WordPress, open Plugins → Add New and find WPCode – Insert Headers and Footers. Confirm the plugin name and publisher, then install and activate it. If your site already has a maintained tool for inserting scripts, you can use that instead.

Open the plugin's header-and-footer script settings. Its menu labels can change, so use the interface for inserting site-wide header HTML rather than a PHP execution field.

4. Add the tracking snippet

Paste the following into the appropriate header area, replacing YOUR_WEBSITE_ID:

<script
  async
  src="https://cdn.databuddy.cc/databuddy.js"
  data-client-id="YOUR_WEBSITE_ID"
></script>

Apply any consent gating established in step 2 before making collection active. Save the configuration. Purge your WordPress cache and any CDN cache so visitors receive the new page markup.

Avoid editing a parent theme's header.php or functions.php for this installation. Theme updates can replace those edits, and a PHP mistake can interrupt the site. The Databuddy WordPress reference documents alternative methods when your deployment requires one.

5. Verify a visit and check for duplicates

1. Open a public page of your site in a separate browser window.
2. Use the browser Network panel to confirm databuddy.js loads from cdn.databuddy.cc.
3. Follow your site's consent flow. Confirm analytics requests go to basket.databuddy.cc when collection is allowed and use the expected website ID.
4. Visit two or three pages. Check the correct website and date range in Databuddy after processing.
5. Inspect the page markup and plugin settings to make sure the script was installed only once. Check your theme and tag manager too.
6. Test refusal or opt-out behavior with your intended configuration. A visit appearing in the dashboard does not prove that refusal works.

Privacy preferences, blockers, network failures and consent decisions can prevent collection. Test in a controlled browser to diagnose installation, while preserving visitors' choices on the live site.

6. Measure a useful action

For a lead-generation site, start with a confirmed contact-form success or a quote request. Follow your form plugin's success callback or use a confirmation page that visitors reach only after a successful submission. A click on Submit measures an attempt, including attempts that fail validation.

Use an event name such as quote_request_completed and avoid including names, email addresses or message contents. Complete a synthetic submission and verify the result before using it as a conversion metric. The tracker reference explains custom events.

Troubleshooting

If a new snippet disrupts the site, disable that snippet, clear the cache, and confirm the site recovers before investigating. You can remove the installation without editing application code.

Does cookieless analytics let me remove my cookie banner?

Possibly, but the word “cookieless” cannot establish that. Rules can cover localStorage and other tracking technologies, and audience-measurement exemptions have conditions. Review your complete site, including advertising and embedded services, before changing consent behavior. CNIL explains the limits and national variation.

Once installation, consent behavior and one meaningful action are verified, use the dashboard to review the pages and sources that bring useful visits. Add further tracking only when it answers another concrete question.

After installation, follow the UTM campaign walkthrough to test a tagged visit and a completed action. If you are still deciding which service to install, compare free privacy-friendly analytics options before adding another tracker.