The "Who is online" list, fourteen years late
On 25 August 2012, a post on this blog announced that the statistics fields had started refreshing by themselves, and finished with a sentence: "The planned feature, the 'Who is online' list is coming soon!"
That post is still here. Soon turned out to mean fourteen years. The list exists now.
What it shows
Your statistics page has a live panel: how many people are on your site at this moment, and the most recent of them listed out — the country they connected from, the city where that is known, which page of yours they are on, and how long ago they were last seen. Twelve at a time, newest first.
"At this moment" means the last five minutes. After an hour, the rows are deleted outright.
What "who" does not mean
Nobody in that list is identified. It is built from the same 16-byte daily hash described in the post about counting without a cookie — there is no name, no account, no cookie and no stored IP address behind any row of it.
It also keeps only the path of the page rather than the whole address: /shop/boots, not the full link with whatever a search engine or a newsletter appended to the end of it.
And two people from the same city looking at the same page are simply two rows. Nothing in the system can tell you whether that is two readers or one reader on a phone and a laptop. That is not an oversight waiting to be tidied up in a later version. It is the design, and it is the same trade the counter makes everywhere else: enough to be useful, not enough to follow anybody around.
Live without holding a connection open
The modern way to build this is a WebSocket, or server-sent events — the browser holds one connection open and the server pushes updates down it as they happen. It is the elegant answer and it would have been the wrong one here.
This site's web server uses one process per open connection, and its actual job is answering counter requests for a couple of thousand websites. A connection held open is a process that cannot answer anybody else. Fifty people watching their live page would mean fifty processes sitting idle, waiting to deliver a number that changes every few minutes.
So the page asks instead, every fifteen seconds, and fetches a small block of JSON. Around that sit three decisions that matter more than the interval:
- If requests start failing, it backs off to once a minute — rather than hammering a server that is evidently already having a difficult time.
- In a background tab it stops asking entirely, and refreshes the instant you switch back to it. Nobody is watching a hidden tab, and the request would cost exactly as much as a useful one.
- The updated N seconds ago line counts upward locally, once a second, and costs nothing at all. It only takes a request to change the data, not to age it.
None of this is clever. It is proportionate, which on a small server is the more valuable property of the two. A live view should not cost more to run than the thing it is watching.
One part that did not come back
In September 2015 there was a post about the Users tab learning to distinguish somebody actively reading your page from somebody who had opened it in a background tab and forgotten it existed.
That distinction is not back. The current list knows when a visitor was last seen; it does not know whether they are looking. It is genuinely worth knowing — a good share of any site's "visitors" are an abandoned tab — so it is on the list of things to build.
Hopefully not another fourteen years.
Try it
The 2012 post ended by linking to a live example, which seems like the right way to end this one too. That original link still resolves, incidentally: the counter behind it has been running the entire time and has passed 1.3 million visits.
There is a live example here, no account needed to look.