Visitor Analytics
You do not need a third-party tool to understand your traffic. The site records its own lightweight, privacy-friendly analytics, and you can add external tools on top if you want.
Built-in analytics
Admin, Analytics shows pageviews over time (hourly, daily, weekly and monthly), your top content, and your tool ratings. Old rows are pruned automatically on a retention schedule you control, so the database stays lean. There is nothing to set up; it works from the first visit.
Confirmed views versus counted views
Every figure appears twice, and the difference between the two is the useful part.
Counted is every request that did not name itself as a crawler. It is the larger number and the less trustworthy one: crawlers are recognised by words in the User-Agent, such as bot, crawl or spider, which only catches the ones that announce themselves. A scraper that sends an ordinary Chrome User-Agent is counted here as a person, and on a site with useful content there are a great many of them.
Confirmed counts only views that a browser reported back after it had finished rendering the page. Bots that fetch your HTML without running it never do this, so they drop out. This is the number to plan against, and the one to compare with Google Search Console.
Expect the two to differ, sometimes by a lot. That gap is not a fault in your site; it is traffic that was never a reader. Confirmed counting begins the day you install the update that introduced it, so any period reaching further back reads low because those older views were never confirmed, not because your traffic fell. The dashboard prints that start date beside the figures.
One honest limit: a bot that executes JavaScript is still counted as a person. Every analytics product shares that limit, Google Analytics included. What this removes is the far larger population that never runs your page at all.
External tools (optional)
In Settings you can connect Google Analytics 4, Google Tag Manager, Facebook Pixel, Google Ads and AdSense. These are lazy-loaded, meaning they load on the first visitor interaction rather than during the initial page render, so they record almost every real visit without dragging down your page speed score.
Visitor country
The Analytics page shows a Top countries card. Country is captured from your CDN or host's edge header, for example Cloudflare's free plan adds it automatically, so no IP is ever stored, only the two-letter country code. If your host provides no such header the card stays empty until you either put the site behind Cloudflare or connect Google Analytics as below.
Country, age and gender from Google Analytics 4
If you use GA4 you can pull Country, Age and Gender straight into this dashboard, so you never have to open the Google Analytics site. In Settings, Tracking, add your GA4 numeric Property ID (from GA4 Admin, Property Settings; a number, not the G-XXXX measurement ID) and a Google service account JSON with Viewer access to the property, or leave it blank to reuse the Search Console service account. In GA4 Admin, Property access management, add that service account email as a Viewer. Age and gender also require Google Signals to be enabled in GA4, and Google hides very small numbers for privacy.
If this panel says "No data", it now shows the exact reason returned by Google. The most common one is that the Google Analytics Data API is not enabled in the Google Cloud project that owns your service account (having the Search Console API enabled is not enough). Open Google Cloud Console, APIs and Services, enable the Google Analytics Data API for that project, wait a few minutes, then reload. The dashboard no longer caches an empty result, so a fix shows on the next load.
Do I need cookie consent?
The built-in analytics are privacy-friendly, so a free site with no external trackers does not strictly need a banner. If you add GA4, Tag Manager, Meta Pixel, Google Ads or AdSense, enable the cookie consent banner in Settings, Site Features. When it is on, those tags are held with Google Consent Mode v2 at "denied" and only load after the visitor clicks Accept, so the banner is genuinely GDPR compliant. See the Security article for details.