Two ways to miscount an access log
A week of changes here rested on counts taken from one day of the access log: a million lines, a hundred thousand of them ours. To find out whether any of it worked, the same counts have to…
What stats2.gif actually is
There is a file in this project's image folder called stats2.gif. It is 366 bytes, dated March 2018, and it appears in exactly zero lines of source code. On 23 August 2026 it was served…
Six finished features and the way back to them
On 23 August 2026 this site answered 101,461 requests. In all of them, the owner token — the ?t= that unlocks the settings box on a statistics page — appeared exactly zero times. Not…
How we count clicks privately
A counter answers "how many came". The more useful question is usually "how many did something" — clicked the contact link, opened the download, went out to a social profile. This site has…
Visitor statistics without a cookie banner
Most analytics need a consent banner because most analytics store something on the visitor's device: a cookie, an entry in local storage, an identifier that survives until tomorrow. That…
Three columns left over from Stats4U 2
The main counter table here has 166,436 rows and a number of columns that look like they matter. Three of them are lastdomain, firstdomain and userdomain. They hold data: lastdomain not…
We stopped collecting screen sizes
This service used to record screen resolution. The browser script read window.screen and sent it along as res=1920x1080, and the statistics page had a panel for it. It does not any more.…
What a password costs on modest hardware
Statistics pages here can be protected with a password. Hashing that password is the one operation in this service that is supposed to be slow — that is what makes a stolen hash expensive…
How the toplist works, and opting out
stats4u.net has ranked its busiest counters since the beginning — a 2012 post already talks about improving it. The current version lives at /top, and it works differently underneath than…
A backup in the web root is a source leak
Before editing a large file, the natural move is to copy it first. cp index.php index.php.vor-aenderung, then work. If that file sits in the directory the web server publishes, the entire…
New privacy policy, terms and DPA
As of 19 August 2026, stats4u.net has three legal documents where it used to have one: a rewritten privacy policy, a terms of service, and — new — a data processing agreement (DPA) under…
A language code that looked like Perl
On 19 August 2026 we added a rule to .htaccess blocking a class of file that should never be served directly to a browser: leftover source-code copies sitting in the web root after an edit…