wp2shell: more than a month later. Confirm 6.8.6, 6.9.5, 7.0.2. Patched is not clean.

Read the advisory

Google Analytics and privacy-friendly alternatives

GA4 is the default for many WordPress sites. Alternatives trade features for privacy. Pick one tool, install it carefully, and treat analytics plugins like any other risk.

Topics Hardening & checklists

Lars Koudal

Lars Koudal

Updated Published

You need traffic data. You do not need five analytics plugins or a stale feature matrix that pretends every product stays the same for years.

Person reviewing analytics on a laptop

The short comparison

ApproachStrengthTradeoff
Google Analytics 4Familiar reports, free, huge ecosystemPrivacy policy work, consent banners in many regions, Google account dependency
Matomo (self-hosted or cloud)More control over dataYou operate (or pay for) the stack
Plausible / Fathom / similarLightweight, privacy-oriented marketingFewer deep exploration features than GA
Host or CDN analyticsOften “good enough” traffic countsLimited marketing attribution

Choose based on legal needs, budget, and how deep your reports must go. Revisit consent and cookie notices with your own counsel; this is not legal advice.

WordPress install hygiene

  • Prefer one analytics method (plugin, tag manager, or host integration)
  • Delete unused tracking plugins
  • Review what the plugin loads on every page
  • Same security bar as any extension: how to tell if a WordPress plugin is secure

Analytics scripts that load from third parties expand your supply chain. Keep the rest of the site on the WordPress security checklist. Numbers do not help if the site is redirected to malware.

Found this useful? Share it.

Larger screenshot