Why a lightweight PHP counter is better than heavy analytics tools

The honest answer to the question in the title is: it depends what you are asking your statistics to tell you. A visitor counter and a full analytics suite are not two grades of the same tool. They answer different questions, and they charge different prices for the answer. This article is about what those prices actually are.

What the counter costs your visitors

Measured on this site today, not estimated. A Stats4U counter costs a visitor two requests:

the script, s4u.js — 3,311 bytes gzipped (8,709 raw)
the counter image — 3,325 bytes as a PNG

That is about 6.6 KB, once, and it is the whole story. There is no framework, no first script that loads a second, no tag manager container sitting in between. If you choose the invisible counter there is no image at all, and it costs less still.

Nothing runs on your server either. Your page embeds an image and a small script; the counting, the storage and the charts happen here. There is no package to install, no database to keep, no cron job to forget about.

No cookie, and nothing read from the device

The counting path sets no cookie. That is not a promise, it is something you can check from a terminal:

curl -sk -D - -o /dev/null 'https://www.stats4u.net/index.php?action=pic&s4uid=1' | grep -i set-cookie

No output is the expected result.

Visitors are told apart by a day hash built from the IP address, the user agent, the counter ID, the date, and a salt that is replaced every day. The hash is 16 bytes and is kept for two days. The IP address itself is never written down. The daily salt is deleted after two days, which means that from then on nobody can recompute a given day's hash for a suspected address — including whoever runs this site.

What is stored, and for how long:

the page address — 400 days
the referring domain, the domain only and not the full link — 400 days
the browser language, as a count and not per visitor — 400 days
country and city, worked out from the address at the moment of the request
the day hash — 16 bytes, two days

What is not stored: the IP address, the screen resolution, and anything at all on the visitor's device.

This describes what the software does. Whether it is enough for the obligations you have where you live is a different question, and one for somebody qualified to answer it. This article is not that answer.

What a counter cannot do

An article that only listed advantages would not be worth your time, so here is the other side. A counter cannot tell you:

how visitors move through a multi-step funnel, and where they drop out
whether the people who arrived in March came back in June
which campaign paid for itself, in money
what happened inside the page — buttons pressed, videos started, form fields abandoned
that the phone visitor on Tuesday and the desktop visitor on Thursday were one person
which of two versions of a page did better

Every one of those needs an identity that persists, events sent from inside the page, and a long retention window. Those are exactly the things given up above. If your work depends on any of them — if you run a shop and need to know which advert earned its cost — then a counter is the wrong tool, and no amount of lightness makes up for it. Use the heavy one, accept what it brings with it, and tell your visitors plainly that you did.

Who is better off with a counter

A counter fits when the question is smaller and the answer is enough:

personal sites, blogs, portfolios, club and school pages
static hosting — GitHub Pages, Neocities, and anywhere else with no server log to read
anyone whose real question is is anybody reading this, and how did they find it
anyone who would rather not pass their visitors to a third party in order to find out

Most of the web looks like this. The analytics industry is built for the part that does not, and it is easy to forget that the rest of us are allowed to want less.