Open Source Cloudflare Analytics Alternatives

Umami is a privacy-first analytics platform that puts traffic, campaigns, behavior, conversions and revenue in one place. It sets no cookies and does not follow people around the web, so a team gets the numbers it needs without building a profile of every visitor who lands on the site.

The application runs on Node.js version 18.18 or later and stores everything in PostgreSQL version 12.14 or newer. A single DATABASE_URL entry in an env file is enough to start, and the build step creates the tables on first install along with an initial admin login you should change straight away.

A handful of choices shape how an installation behaves.

• Self-hosted or cloud: run the platform on your own server or use the hosted service, with the same product either way.
• Docker deployment: an official image and a compose file bring up Umami together with a PostgreSQL database in one command.
• Two-factor authentication: a 64-character hex encryption key switches it on, and it stays unavailable until that key exists.
• Configurable API base: the API_URL setting points internal interface calls at a relative path or an absolute host proxied through the local route.
• Plain upgrades: pull the repository, install dependencies and rebuild, or pull the new Docker image and recreate the containers.

Umami suits site owners who want to answer questions about visits and revenue while keeping the raw data on infrastructure they control. The requirements stay modest, a Node server and a Postgres instance, which makes it a reasonable fit for a small virtual machine.

Betterlytics measures site traffic without cookies, which takes the consent banner and the third party data sharing out of the picture. It is GDPR, CCPA and PECR ready out of the box, and the data it collects is never handed to anyone else.

The ingestion path is written in Rust and events land in ClickHouse, with a Next.js and React dashboard in front and Postgres holding account data. Sites are instrumented with a script tag under 2KB, or through the React and Next.js SDKs.

Reporting is grouped into several areas of the dashboard.

• Core analytics: page views, visitors, bounce rate, traffic sources, geography, devices, custom events and real time data.
• Deeper analysis: session replay, user journeys, funnels, annotations, outbound link tracking and comparisons across time periods.
• Performance monitoring: Core Web Vitals, uptime and SSL certificate checks, and public status pages on a domain of your own.
• Privacy defaults: cookieless tracking, data anonymization and EU hosting on the managed service.
• Access control: roles, two factor authentication and OAuth sign in with Google or GitHub.

Two ways to run it are documented. The managed cloud is EU hosted, updates itself and has a free tier, while the self-hosted route is a manual Docker installation where the servers, the updates and the data location are yours. The code is AGPL 3.0, with third party components attributed separately.

HitKeep is web analytics that ships as one Go binary with DuckDB and NSQ embedded, so there is no separate database, queue or cache to operate. It also removes the usual split between a free edition and a paid one holding the features teams actually need, since custom tracking domains and team SSO live in the same MIT-licensed codebase.

The browser tracker sets no analytics cookies, respects Do Not Track, and collects aggregate website evidence instead of building a cross-site identity. Pageviews and automatic events such as outbound clicks, file downloads and form submissions start flowing as soon as the script tag is on the page.

Reporting follows acquisition through to the outcome.

• Conversion reporting: pages, custom events, goals, funnels, ecommerce revenue and Web Vitals sit in one place.
• AI as a channel: crawler fetches, AI-referred visits and chatbot outcomes stay distinct from ordinary traffic.
• Ask AI: answers cite the aggregate evidence behind them, and a read-only MCP endpoint gives approved assistants governed access.
• Search Console: clicks, impressions, click-through rate and position land beside the rest of the traffic data.
• Open exports: complete takeout, APIs, webhooks, share links and permissions keep the data useful outside HitKeep.

Install it with Homebrew on Apple silicon macOS or x86_64 Linux, pull an ARM64 binary, or run the published Docker Compose file and create the first account on port 8080. HitKeep is deliberately web-focused, so anyone who needs session replay, mobile SDKs or built-in experimentation should look elsewhere.

Prisme Analytics collects page views and custom events without cookies and stores only anonymized data, which takes most of the compliance work out of measuring a website. Setup is a script tag plus a noscript pixel, and numbers show up in a web analytics dashboard within minutes.

The ingestion server is written in Go and ships as a Docker image, while the dashboards run on Grafana. That choice brings user management, teams, permissions, multiple organizations and custom dashboards along with it, instead of a second set of account features written from scratch.

Several details set it apart from heavier analytics stacks.

• Small payload: the tracking script is around 2 kB, roughly 22 times smaller than Google Analytics, and the pixel for visitors without JavaScript is 35 bytes.
• Bot filtering: scrapers and spam traffic are dropped automatically.
• Campaign tracking: UTM parameters attribute visits to newsletters and campaigns.
• Single page apps: any pushState based router is followed without extra wiring.
• Throughput: the project's own load test ingested more than 50,000 requests a second on one AMD Ryzen 7 machine with the load generators running beside it.
• No paywall: every feature is available in the open source version.

You can follow the self-hosting guide for Docker or sign up for the hosted cloud, and the same feature set applies either way. The code is AGPL-3.0 with MIT exceptions listed in a separate licensing file.