WordPress Analytics in 2026: GA4, Matomo and Privacy-Friendly Options

Most WordPress analytics setups I audit fall into one of two ditches: the site tracks nothing useful (a pageview counter nobody opens), or it tracks everything illegally (GA4 firing before consent, a heat-mapping tool recording keystrokes, and a cookie banner that quietly does not do what it claims). Both ditches cost real money – the first because you make decisions blind, the second because a single complaint to a data protection authority turns your marketing stack into a legal project. After setting up tracking on hundreds of WordPress sites for clients in Germany, the UK, the US and Australia, I can tell you the sane middle exists and it is not complicated.

This guide is that middle. We will define the five questions analytics should actually answer for a business, set up GA4 properly if you choose it (consent mode, key events, the gtag-vs-Tag-Manager decision), face the uncomfortable truth about how much traffic a consent banner hides from you, and compare the privacy-first alternatives – Matomo, Plausible and Fathom – honestly, with costs and trade-offs. Then we will define conversions step by step, build a one-page dashboard that gets looked at monthly, and clear up the GA4 misreadings that send site owners chasing ghosts.

Table of contents

• The two failure modes: nothing useful, or everything illegally
• The five questions analytics should answer
• Setting up GA4 on WordPress properly
• The consent banner traffic-loss reality
• Privacy-first alternatives compared honestly
• Server-side and cookieless tracking in plain language
• Defining conversions step by step
• A dashboard that actually gets looked at
• Common GA4 misreadings that cause bad decisions
• Choosing analytics by site type
• Frequently asked questions

The two failure modes: nothing useful, or everything illegally

The first failure mode looks responsible from the outside. There is a Google Analytics property, it was set up years ago by whoever built the site, and nobody has logged in since. When I ask an owner “which channel brings the customers that actually buy?”, the answer is a guess. The data exists somewhere, but it answers no question anyone is asking, so it might as well not exist. A surprising number of five-figure marketing budgets are spent on top of exactly this.

The second failure mode looks impressive from the outside. GA4, Google Ads remarketing, Meta pixel, Hotjar, LinkedIn insight tag – all loading on the first byte, before any consent banner appears, on a site selling to EU customers. Under the GDPR and the ePrivacy rules, most of that stack needs prior consent, and “the plugin came with it” is not a legal basis. I cover the wider legal picture in my GDPR compliance guide for WordPress; the short version for analytics is that anything storing or reading identifiers on the visitor’s device needs consent first, and fines aside, a consent banner bolted on later breaks half the tracking anyway.

The sane middle has three properties: it answers a short list of business questions, it is legal in the countries your visitors live in, and it is simple enough that someone actually reads the numbers every month. Everything in this guide serves those three properties.

The five questions analytics should answer

Before choosing any tool, write down the questions. For nearly every small business site I have worked on, there are five, and each one maps to a specific metric:

• Where do visitors come from? Sessions by channel and source: organic search, direct, referral, paid, email, social. This tells you which marketing effort produces anything at all. If the answer is “nowhere”, the problem is upstream – see why your website is not getting traffic.
• Which pages bring people in? Entry (landing) pages, ideally with their conversion rate next to them. A blog post that lands 800 visitors a month and converts none of them is a different problem from a service page that lands 40 and converts eight.
• Do visitors do what I need them to do? Key events: form submissions, phone clicks, quote requests, orders. Not pageviews, not time on page – the actions that create revenue.
• What is a visitor from each channel worth? Conversions (or revenue, for a store) divided by sessions, per channel. This is the number that tells you whether to spend more on ads or more on content.
• Is it getting better or worse? The same small set of numbers, compared month on month. A single snapshot is trivia; a trend is information.

Notice what is not on the list: bounce rate, scroll depth, session recordings, real-time visitor maps. Those have uses in specific investigations – I pull them out when diagnosing a conversion problem, as described in why your website is not converting visitors – but they do not belong in the monthly view. If a report does not help answer one of the five questions, it is decoration.

Setting up GA4 on WordPress properly

GA4 is free, powerful and, for stores and ad-driven sites, still the pragmatic default – the integration with Google Ads and Search Console is something no privacy-first tool matches. But GA4 done properly on WordPress means three deliberate decisions, not pasting a snippet and hoping.

gtag or Google Tag Manager?

You have two ways to install GA4: the direct gtag.js snippet (what plugins like Site Kit output) or Google Tag Manager (GTM) with a GA4 tag inside it. My rule from client work:

• Use plain gtag if GA4 is the only tag you will ever load and your events are simple. One script, less to break, slightly faster.
• Use GTM if you run ads, need conversion tags for several platforms, or want to define events (phone clicks, form submissions) without editing theme code. GTM adds a layer of complexity, but it centralises consent handling and it means marketing changes do not require a developer deployment.

What I recommend against: three different plugins each injecting their own copy of the tag. I regularly find sites firing GA4 twice – once from an SEO plugin, once from a hand-pasted snippet – which doubles every number and makes the data worthless. One tag, one place, documented.

Consent mode, done honestly

For EU and UK visitors, GA4 must not set its cookies until the visitor consents. The clean pattern in WordPress is a certified consent management plugin (Complianz, Borlabs Cookie and Cookiebot are the ones I deploy most) integrated with Google Consent Mode v2. Consent mode has two levels and the difference matters:

• Basic consent mode: no Google tags load at all until consent. Simple, defensible, and the version I fit for most small businesses.
• Advanced consent mode: tags load before consent but send cookieless “pings”, and Google models the missing conversions statistically. More data, but a harder conversation with a data protection officer, because requests still leave the visitor’s browser before they agreed to anything.

Whichever you choose, test it like a sceptic: open a private window, decline everything, and watch the network tab. If you see requests to google-analytics.com after declining, your setup is not compliant regardless of what the banner says.

Key events, not pageviews

GA4’s own value only appears once you define key events (the feature formerly called conversions). Out of the box GA4 records pageviews, scrolls and outbound clicks; none of those is a business outcome. Mark as key events only the actions from question three: generate_lead for form submissions, a phone_click event on tel: links, purchase for orders (WooCommerce plugins such as the official Google for WooCommerce integration send this with values attached). Five key events is plenty; I have seen properties with thirty, and every report in them was noise.

The consent banner traffic-loss reality

Here is the part most guides skip: once your banner is honest, a large slice of your traffic disappears from GA4 – not from your site, only from your data. Across the EU-facing client sites I maintain, somewhere between 30% and 60% of visitors decline or ignore analytics consent, with content sites at the high end and logged-in B2B tools at the low end. Your true visitor number might be double what GA4 shows.

Practical consequences that catch owners out:

• Traffic “drops” the day the compliant banner goes live. Nothing broke. Annotate the date and never compare across it without a mental correction factor.
• Conversion rates look better than they are when the denominator (consented sessions) shrinks more than the numerator (buyers, who consent more often than bouncers).
• Small sites lose statistical usefulness. If you get 500 visits a month and see 250 of them, channel-level percentages jump around randomly. Trends over quarters remain useful; day-to-day comparisons do not.

You have three honest responses to this loss: accept it and read trends rather than absolutes; add advanced consent mode and accept modelled data with the caveats above; or move to a cookieless, privacy-first tool that does not need a consent banner for basic statistics at all – which is exactly why the tools in the next section have grown so fast.

Privacy-first alternatives compared honestly

Privacy-first analytics tools count visitors without cookies and without building profiles of identifiable people. Configured correctly, the mainstream ones can run without a consent banner in most EU jurisdictions (your lawyer has the final word – regulators differ on details, and your privacy policy must still disclose them). Three matter in practice.

Matomo (self-hosted)

Matomo is the closest thing to “GA4 you own”. Self-hosted on your own server, the data never leaves your infrastructure, which makes data protection officers relax visibly. It has real depth: e-commerce reports, funnels, campaign tracking, even optional heatmaps. Configured in cookieless mode with IP anonymisation, it can run banner-free. The costs are operational rather than financial: it is a PHP/MySQL application you must update, back up and give database room to (busy sites generate gigabytes of raw tracking data per year). There is a WordPress plugin version that runs inside your WordPress database – fine for small sites, but I move anything above roughly 50,000 pageviews a month onto a separate Matomo install so the tracking tables do not bloat the site database. Matomo also offers a paid cloud version (from around EUR 26 a month) if you want the ownership posture without the server work.

Plausible

Plausible is the opposite philosophy: one page of statistics, a script under 1 KB (GA4’s tag weighs some 50 times more), no cookies, EU-hosted, open source. Pricing starts around EUR 9 a month for 10,000 pageviews. You get visitors, sources, entry pages, countries, devices, and custom events with goals – which covers, deliberately, almost exactly the five questions from earlier and nothing else. You can also self-host the community edition for free if you are comfortable running a Docker container. For content sites, portfolios and service businesses, Plausible is what I install most often now: the dashboard is so simple that owners actually open it, which beats any amount of unopened sophistication.

Fathom

Fathom is Plausible’s closest commercial cousin: cookieless, banner-free in the same sense, a single clean dashboard, from around USD 15 a month. Differences are at the margins – Fathom is Canadian-run with EU isolation options, keeps data forever on all plans, and leans on simplicity even harder (no self-hosted option any more). Choosing between Plausible and Fathom is a matter of taste and invoicing currency more than capability; I have both running across client sites and neither has given me a reason to switch the other way.

The honest comparison, in one view:

• Cost: GA4 free; Matomo free self-hosted (plus server and your time) or from ~EUR 26 cloud; Plausible from ~EUR 9; Fathom from ~USD 15.
• Consent banner needed for basic stats: GA4 yes; Matomo avoidable in cookieless mode; Plausible and Fathom generally no.
• Depth: GA4 deepest (and hardest); Matomo close behind; Plausible and Fathom deliberately shallow.
• Ads integration: GA4 only. If Google Ads spend is a big line in your budget, that alone usually decides it.
• Who sees your data: with GA4, Google; with Matomo self-hosted, only you; with Plausible/Fathom, a small company contractually processing it for you.

Server-side and cookieless tracking in plain language

Two phrases come up in every analytics conversation now, usually wrapped in more mystery than they deserve.

Cookieless tracking means the tool counts a visit without storing an identifier on the visitor’s device. Instead of a cookie saying “this is visitor 8317”, the server derives a short-lived anonymous fingerprint – typically a hash of IP address, user agent and a daily-rotating salt – good enough to say “these six pageviews were one visit” but useless for recognising the same person tomorrow, let alone across websites. That is why regulators treat it differently: no identifier stored, no profile built, no consent required for the counting itself. The trade-off is precision: returning-visitor rates and multi-day journeys blur, because the whole point is that yesterday’s visitor is unrecognisable today.

Server-side tracking means events are sent from your server (or a tagging server you run) to the analytics platform, instead of from the visitor’s browser. In the GA4 world this is “server-side GTM”: the browser talks to your subdomain, your server decides what to forward to Google. Benefits: ad blockers interfere less, page weight drops, and you control exactly what data leaves. Costs: a server component to host (roughly EUR 10-20 a month on a small cloud instance) and real setup complexity. My honest advice for small businesses: you almost certainly do not need it. It earns its keep for stores spending serious money on ads, where recovering blocked conversion data directly improves bidding. For everyone else it is an impressive answer to a question nobody asked.

One caution: server-side tracking changes where the data flows, not whether you need consent. Moving GA4 server-side does not remove the consent requirement, whatever a sales page implies.

Defining conversions step by step

A conversion is any action that creates business value. Defining them is the highest-value hour in your whole analytics setup, and it works the same in every tool.

1. List the valuable actions. For a typical service business: contact form submitted, phone number clicked, email link clicked, quote request sent. For a store: order completed, plus perhaps add-to-cart as a soft signal. Keep the list under six.
2. Instrument forms properly. Fire the event on successful submission, not on the thank-you pageview if your form does not redirect, and definitely not on the button click (which counts failed validations). Most WordPress form plugins (Gravity Forms, WPForms, Fluent Forms) expose a JavaScript event or a redirect you can hook. Test with a real submission.
3. Track phone and email clicks. A tel: or mailto: click is the strongest intent signal a local service site gets. In GTM this is a click trigger on the link scheme; in Plausible or Fathom it is a one-line custom event; Matomo can auto-track them.
4. Track orders with values. For WooCommerce, use the official integration for GA4 or the Matomo/Plausible e-commerce hooks so each purchase event carries its revenue. Conversion counts without values cannot answer question four.
5. Mark them as goals/key events in the tool, so every traffic report can show conversions per channel, not just visits.
6. Send yourself a test of each one and check it lands, from a phone as well as a desktop. Half the broken tracking I find broke on mobile only.

Offline conversions deserve one honest sentence: if most of your business arrives by phone call, ask new callers where they found you and tally it in a spreadsheet. It is unfashionable and it works.

A dashboard that actually gets looked at

The best analytics setup is the one somebody reads. After years of building elaborate reports nobody opened, my standard for clients is one page, reviewed once a month, fifteen minutes, coffee in hand. It contains exactly:

• Sessions by channel – this month, last month, same month last year.
• Top ten entry pages with their conversions.
• Each key event’s count – forms, calls, orders – with the same three comparison columns.
• Conversion rate per channel (question four).
• One sentence, written by a human: “What changed and what will we try next month?”

In GA4 you build this once in Looker Studio and schedule the PDF by email; in Plausible or Fathom the default dashboard already is this page, which is half their appeal; Matomo can email a scheduled report natively. For clients who want the review itself automated, I have started wiring monthly summaries through AI tooling – pulling the numbers via the analytics API and drafting that human sentence for a human to edit – as part of the WordPress AI solutions work I do. The tooling is optional; the monthly ritual is not.

What kills dashboards: more than one page, more than one owner, and metrics without questions. When a client asks to add a widget, I ask which of the five questions it answers. Usually the widget stays out.

Common GA4 misreadings that cause bad decisions

GA4’s interface invites misreading, and I spend real client hours undoing conclusions drawn from it. The frequent offenders:

• “Unassigned” traffic panic. A chunk of sessions labelled Unassigned usually means missing or stripped campaign parameters, consent-related data gaps, or untagged email links – not a mysterious new audience. Fix your UTM discipline before theorising.
• Engaged sessions read as happy visitors. A session is “engaged” if it lasts 10+ seconds, has a conversion, or has two pageviews. That is a low bar; a confused visitor clicking twice is “engaged”. It is a filter against instant bounces, not a satisfaction score.
• Comparing GA4 to old Universal Analytics numbers. Different session definitions, different bounce logic, different everything. The old property is a museum; stop visiting it.
• Direct traffic read as “people typing my URL”. Direct is mostly “source unknown”: app links, some mail clients, stripped referrers, bookmarks. Growth in Direct often just means growth in untrackable sharing.
• Thresholding and sampled data. On low-traffic sites GA4 hides rows to prevent identifying individuals, so report totals do not add up. The data is not broken; it is being deliberately vague.
• Real-time reports as a health check. Real-time misses consent-declined visitors entirely. Ten people can be on your site while real-time shows three.

The pattern behind all of these: GA4 numbers are estimates with rules attached. Read trends, distrust absolutes, and never make a spending decision on a metric you cannot explain to someone else in one sentence.

Choosing analytics by site type

Pulling it together, here is the decision table I actually use with clients. It assumes EU or UK visitors are in scope; if you sell purely outside consent-law jurisdictions, GA4’s case strengthens across the board.

Two combinations worth naming. Running GA4 and a privacy-first tool side by side for a quarter is a cheap education: the gap between their visitor counts is your consent loss, measured on your own audience. And every setup, whatever the tool, should have Google Search Console connected – it is consent-free, it shows the search queries analytics tools cannot see, and it is the first place I look when traffic questions come up.

Whatever you pick, migrate deliberately: export or archive the old data, run old and new in parallel for a month, annotate the switch date, and update your privacy policy to name the tool you actually use. An analytics stack you can describe accurately in your privacy policy is, conveniently, also one you understand.

Want analytics on your WordPress site that is useful and legal?

I set up clean, consent-correct analytics as part of my custom WordPress development work – GA4 with proper consent mode, or Matomo, Plausible or Fathom wired to the conversions that matter, plus a one-page dashboard you will actually read, and AI-assisted reporting if you want the monthly summary drafted for you. Have a look at my portfolio, then tell me about your site – I reply within 24 hours with a plain recommendation and a fixed price.

Frequently asked questions

What is the best WordPress analytics setup?

For most small business sites: a cookieless privacy-first tool (Plausible, Fathom, or self-hosted Matomo) tracking five or six defined conversions, plus Google Search Console. GA4 earns its complexity mainly when Google Ads spend is significant.

Do I need a cookie banner for analytics?

For GA4 and any cookie-based tool with EU or UK visitors, yes – and it must block tracking until consent. Cookieless tools like Plausible, Fathom and Matomo in cookieless mode generally do not need one for basic statistics, though your privacy policy must still disclose them.

Is GA4 GDPR compliant?

It can be operated compliantly with consent mode, IP handling and a proper banner, but compliance is your configuration’s property, not the product’s. Out of the box, firing before consent, it is not.

How much do privacy-friendly analytics tools cost?

Plausible starts around EUR 9 a month, Fathom around USD 15, Matomo cloud around EUR 26; self-hosting Matomo or Plausible costs only server resources and your maintenance time.

Will I lose my old Universal Analytics or GA4 data if I switch?

Switching tools does not delete anything by itself, but old data will not import meaningfully. Export the reports you care about, run both tools in parallel for a month, and annotate the switch date.

Why does GA4 show less traffic than my server logs or my hosting panel?

Consent declines, ad blockers and bots each remove a slice. On EU-facing sites GA4 commonly sees only 40-70% of real human visits; server logs see everything including bots. Neither number is wrong – they measure different things.

What conversions should a small business track?

Form submissions, phone clicks, email clicks and (for stores) completed orders with revenue values. Five or six key events is enough; more usually means noise.