Features
Three things you get the day you paste the script.
Pageviews after Reject
The script does not set a cookie or wait for a banner. If it is on the page, the pageview is counted — even after a visitor clicks Reject.
Source and campaign
The landing keeps utm_source, utm_medium, utm_campaign, utm_content, and utm_term. Every other query key is dropped in the browser.
Watch
On Starter and Growth we check that a hostname you already added still answers. More than a ping: HTTP, TLS, and DNS from Europe. Not a real browser.
Also free: Site Check for Chrome — cookies and trackers a page sets before and after you reject its banner. Sharing findings is opt-in.
Sample data, last 30 days
View sample dashboard
Unique visitors
845
Total visits
1,280
Total pageviews
2,574
Views per visit
2.01
Bounce rate
31%
Visit duration
5m 8s
Sample data — the same six tiles after you paste the script.
Start here. Growth funnels are a straight path on the same calendar day — midnight starts a new person. That is the privacy trade, not a hidden cap.
utm_source, medium, campaign, content, term. Everything else is dropped in the browser.
Only those five tags leave the tab. Tokens and emails in other query keys never reach us. Inner pages in a single-page app do not inherit the landing UTMs. The dashboard groups campaigns, channels, ads, and keywords. Messy URLs stay messy on your site.
Unique visitors, visits, pageviews, views per visit, bounce, duration. Line, bars, or auto.
The numbers sit on the chart. Click a tile to overlay. Compare draws the previous window as a dashed line. Unique visitors reset at midnight UTC. A visit is the same person within 30 minutes. Visit duration is last minus first pageview in that visit. One-page visits are 0 seconds. No heartbeat, no extra script.
Who is on which path right now, without a heartbeat.
People on the site in the last five minutes. The path is their last pageview. A tab left open does not ping. No extra script. The pill at the top of the dashboard jumps to the list.
Around the clock we check that your site still answers. More than a ping — you should know before the client does.
They clicked Reject. The hostname still has to answer. HTTP, TLS, and DNS on a site you already added. Frankfurt every window; Dublin confirms a fail or a slow response; London is a third sample only after a fail. Down means both failed. Slow means both cities were slow, two windows in a row — one city does not. A public status page and a monthly report. Visitor 404s via cfa('404'), 500s via cfa('500'). Heartbeat for cron jobs on Starter and Growth. Not a real browser: no JavaScript, no scripted checkout. Down windows shade the analytics chart. No Watch SKU — it follows the invoice. Recipe: /docs/watch.
Watch is more than a ping. Each check is an HTTP GET from Europe — not a real browser. It is included on Starter and Growth, on a hostname you already added.
Three European cities
Frankfurt checks every window. Dublin runs when Frankfurt failed, or when Frankfurt answered but first byte was slow. London is a third sample only after a fail — not for slowness.
DNS
Each check resolves the hostname (IPv4, then IPv6 when needed) before it requests the URL. If the address set moves, we mail you.
HTTP status
The response must match the status you expect. The default is 200–399. You can require a single code.
Redirects
A redirect that leaves your hostname fails the check.
Page content
You can require a short phrase in the body, or forbid one. A keyword check is its own row — the page can be up while the phrase is missing.
Speed
We record first byte (TTFB) and total load time. Slow is based on first byte. The default threshold is 3 seconds; 0 turns Slow off.
Daily sitemap
Once a day we fetch /sitemap.xml (or the path you set) and visit the first 40 URLs on the same hostname. Off-host URLs are skipped. A bad result is checked again after 30 minutes before we alert. Not an HTML crawl.
Certificate
On a successful HTTPS check we read the leaf certificate visitors see. Mail at 14 days left, an incident at 3. We do not walk the full chain or grade ciphers.
Domain expiry
Once a day we look up the registry (RDAP). Mail at 30 days left, an incident at 7.
Visitor 404s and 500s
Watch counts cfa('404') and cfa('500') events from real visitors in the last hour. Over the threshold (default 10; 0 is off) we mail you. The hostname can still be Up.
Heartbeat
On Starter and Growth you can POST a heartbeat for a cron or a job. If no beat arrives within the grace you set (minimum 60 seconds, maximum 24 hours), Watch opens a heartbeat incident. Empty grace is off.
TCP port
You can add a TCP check for one port on a hostname you already added. That is a connect, not a port scan.
What Watch is not
Watch is not a real browser and not a transaction test. It does not run JavaScript or click through a checkout.
A single slow sample never sends mail. Slow mail goes out only after Dublin confirms slowness in two consecutive windows. A real outage — two windows where Frankfurt and Dublin both failed — alerts promptly. One city down and one up stays Up.
Starter checks every 3 minutes (10 pages). Growth checks every minute (25 pages). Hobby shows the Watch tab; checks start on Starter.
What it sends
Where from
What counts as up
Speed
Certificate and domain
Sitemap and visitor errors
Cron jobs
When it alerts
Browser checkout test
A signup is a signup. It is not another pageview on the invoice.
Ask whoever ships the site to call cfa('signup') when the thing happens. There is no tag-manager UI yet. Events are not billed. Marketers without a developer still get pageviews, sources, and landing campaigns from the paste. Hobby and Starter keep a single named goal.
The briefing you already see, mailed once a week. No extra tracking.
Monday, once. Visitors, pageviews, top page and source from the last 7 days. Unsubscribe is a link. Switch it off in account settings. Not a daily drip.
The pattern, the mix, what to open next. Dashboard numbers only — no hashes.
Owner click. Grok writes from the tiles you already see. Copy it into a Monday email. Hobby 6 a day, Starter 12, Growth 20. Cached reads are free. The weekly mail is the same numbers, not a second tracker.
You write a launch. The first day a UTM campaign arrives, we stamp it. Volume stays on the chart.
Vertical line, tooltip, list. Type a note, or we add “Campaign: …” the first time that campaign (or source / medium) is seen. Day-over-day traffic % is not a note — the tiles already show that. The Monday briefing is separate.
Sign in with the Google account that owns Search Console. Empty until then — we only show clicks Google reported.
Connect Google on the dashboard. You grant Search Console read on a site you own. We show totals plus top queries and Google landing pages for the same range as the board: clicks, impressions, CTR, and average position. Empty until you connect — we only show clicks Google reported.
Connect the Stripe account that takes payment. Empty until then — we only show charges Stripe reported.
OAuth, read-only. Gross, refunds, net, and charge count for the board range. If Checkout already stored utm_source / medium / campaign in metadata, we list those tags. Clicking one filters your pageviews. It does not prove that visit paid. Stripe account, not this hostname. Not mixed into visitor rows.
Click a country to zoom. Tabs for regions and cities. No map tiles, no postcode.
A country outline on the dashboard. Click to filter. Regions and cities are labels on the request, not a café database. No IP on the row, no coordinates, no postal code.
Drop-off between pages and events. Midnight starts a new person.
Growth only. Linear path, same UTC day. Midnight resets the person. That is the privacy trade, not a hidden cap. Two to eight steps: a path or a named event. Hobby and Starter keep a single named goal. No extra script. No session replay.
A Frankfurt GET we run. Google lab scores 0–100. The 1 KB script does not guess dwell or LCP.
First byte is four signals from a GET we make in Frankfurt, then what to do. Lighthouse (Performance, Accessibility, Best Practices, SEO) comes from PageSpeed Insights. Lab, not field. Refresh always runs a new audit. Scores are not cached. Not a Core Web Vitals product.
Opt-in. The 1 KB file stays 1 KB. A second helper counts the click.
Tick “also count clicks” in site settings. That adds a second file, cf-clicks.js: outbound hosts, file extensions (pdf, zip, …), buttons, and anything with data-cfa="…". Same beacon, named events, not billed. Not a heatmap. The default script does not listen.
A checkout path and goals from events that already fire. You confirm. We only use pages and events already on the site.
The dashboard can read your homepage menu and the paths that already have pageviews. On Growth it can save same-day funnels if those URLs exist — not a second copy of one you already added. Goals still need a named event that already fired. Owner click, not a silent rewrite.
Paste the snippet in your theme header, or use any header-scripts plugin. Pageviews without a MonsterInsights cookie.
No plugin download yet; the WordPress.org listing comes later. WordPress.com sites on any paid plan can add the snippet too. Serving the file from your own hostname so blockers miss us is optional — recipe on /docs. Topic: /wordpress-analytics.
Claude, Cursor, and other MCP clients read the same numbers as the dashboard. No visitor hashes. Read API and MCP on /docs/api.
Optional. List-based blockers never see our hostname if the file comes from yours. On Hobby.
A path rewrite of /cf.js, or a CNAME on a subdomain such as c.yourdomain.com. CNAME keeps visitor IP, city, and same-day uniques. Path rewrites recover blockers but collect through the host. Shopify and other closed builders: paste the snippet, then CNAME. Recipe: /docs/proxy.
A hashed bearer. The same visitors, pages, sources, and live you already see.
Starter and Growth. Mint a token on Account. We store a hash, show the secret once. Sites, overview, pages, sources, live. Growth adds funnels. No visitor hashes. No raw pageview dump. The bearer stays off Hobby. Hobby (free) gets 5 MCP tools through OAuth; paid plans get all 13. Recipe: /docs/api.
Ask after a deploy. OAuth 2.1 at https://www.cookiefreeanalytics.com/mcp, or the hashed bearer.
Hobby (free) gets 5 MCP tools through OAuth: traffic pulse, top pages, Watch status, add a website, and the tracking code, capped at 20, 10, 10, 10, and 30 calls a day. Paid plans get all 13. Claude, Cursor, ChatGPT, and Grok sign in on this host. curl on a paid plan still uses the token from Account. The model sees aggregates, not hashes. Recipe: /blog/cookieless-analytics-mcp.
Pages, referrers, campaigns, and the rest of the board as a workbook. We do not keep the file.
The Excel button on the dashboard downloads what you are looking at. Account can export and delete. No sales call. No weekly dump we host for you.
The moat is how we collect and how we forget. Full recipe on /methodology.