Runlight Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Runlight is open source web analytics that keeps every number in your own database. It counts visitors, pages, sources, places, devices, campaigns, and conversions without cookies and without keeping anything that could say who a visitor was. It sets no cookies and stores nothing on the visitor’s device.
Activate the plugin and choose to run Runlight inside WordPress, with nothing else to set up:
- It adds Runlight’s script (under 2 KB gzipped) to every page, and marks 404 pages so broken links show up.
- It leaves out administrators’ own visits, if you want.
- It records AI agents such as ChatGPT, Claude, and Perplexity when they fetch your pages to answer someone’s question. They run no JavaScript, so no script can see them; the plugin records them on the server, after the page has been sent.
- The Runlight item in the admin menu shows this site’s numbers in wp-admin, and the full dashboard opens at /runlight on your site, for anyone who can manage options.
- Goals, funnels, short links, email reports, and imports from Umami, Bitly, and other services are all in the dashboard.
The numbers stay in this site’s database: in Runlight’s own tables, named after WordPress’s table prefix (such as wp_runlight_events), when the database is MySQL 8.0.20 or MariaDB 11.4 or later, or else in a SQLite file in the uploads folder. Each site in a network keeps a SQLite file of its own.
If you already run Runlight elsewhere, as the standalone server or inside an app, the plugin can send to that one instead. Press Connect in its settings and that Runlight fills them in, so one dashboard covers all your sites.
Privacy
The script sets no cookies and stores nothing in the visitor’s browser. Runlight counts a visitor with a hash of a daily salt, your site, their IP address, and their user agent; the address and the user agent are never stored, and the salt is deleted within four days.
Source code
The plugin bundles Runlight’s own PHP package, runlight/runlight (MIT), at vendor/runlight/runlight, as Composer lays it out, with its built scripts in vendor/runlight/runlight/assets. Their source, and the tools that build them, are at github.com/runlightsh/runlight:
- vendor/runlight/runlight/src is the PHP package itself, from packages/php.
- vendor/runlight/runlight/assets/dashboard.js and dashboard.css are the dashboard, built from packages/dashboard.
- vendor/runlight/runlight/assets/tracker.js, picker.js, and pick-return.js are the tracking script, the goal picker, and the picker’s relay page, built from packages/tracker.
- vendor/runlight/runlight/assets/world.json is the dashboard’s world map: Natural Earth’s 1:110m countries (public domain), by way of the world-atlas package, projected by packages/dashboard/scripts/world.mjs.
- composer.json names the package, as Composer would install it into vendor.
- The plugin’s own assets/settings.js, assets/frame.js, and assets/dashboard.js are its source, not built.
Running npm install and then npm run build at the top of the repository builds every one of them and copies them into packages/php/assets.
External services
Running inside WordPress, Runlight fetches one thing on its own: your site’s icon. When you open the dashboard, it shows the icon your site’s home page links to, which Runlight fetches from your site, or from wherever that link points, sending nothing with the request.
Beyond that, it sends nothing anywhere until you set something up that needs another service. Each of these is off until you turn it on, and each is described where you turn it on.
- Locations: with “Show which countries visitors come from” on, the plugin downloads DB-IP’s free country database from download.db-ip.com once a month and keeps it in its folder in uploads. Nothing is sent with the download, and visitors’ addresses are looked up on your server and never sent. DB-IP’s data is under CC BY 4.0 (https://db-ip.com/db/lite.php). Terms: https://db-ip.com/tos.php. Privacy: https://db-ip.com/privacy.php.
Email reports: when an SMTP or mail plugin such as WP Mail SMTP is active in WordPress, Runlight sends the reports you ask for, and test emails, with wp_mail, so they go wherever that plugin sends your site’s other email. Otherwise, or when you choose one in the dashboard instead, it sends them through the mail service you set up there, with the key you enter. A report holds the site’s totals for the week or month, and it is sent to the addresses you list, from the address you set, only when a report is due or you send a test. To send through an SMTP server, set it up in an SMTP plugin, which Runlight then uses. The services:
- Amazon SES (email..amazonaws.com). Terms: https://aws.amazon.com/service-terms/. Privacy: https://aws.amazon.com/privacy/.
- Brevo (api.brevo.com). Terms: https://www.brevo.com/legal/termsofuse/. Privacy: https://www.brevo.com/legal/privacypolicy/.
- MailerSend (api.mailersend.com). Terms: https://www.mailersend.com/legal/terms-of-service. Privacy: https://www.mailersend.com/legal/privacy-policy.
- Mailgun (api.mailgun.net or api.eu.mailgun.net). Terms: https://www.mailgun.com/legal/terms/. Privacy: https://www.mailgun.com/legal/privacy-policy/.
- Mailjet (api.mailjet.com). Terms: https://www.mailjet.com/legal/terms/. Privacy: https://www.mailjet.com/legal/privacy-policy/.
- Postmark (api.postmarkapp.com). Terms: https://postmarkapp.com/terms-of-service. Privacy: https://postmarkapp.com/privacy-policy.
- Resend (api.resend.com). Terms: https://resend.com/legal/terms-of-service. Privacy: https://resend.com/legal/privacy-policy.
- SendGrid (api.sendgrid.com), part of Twilio. Terms: https://www.twilio.com/en-us/legal/tos. Privacy: https://www.twilio.com/en-us/legal/privacy.
- SparkPost (api.sparkpost.com or api.eu.sparkpost.com). Terms: https://www.sparkpost.com/policies/tou/. Privacy: https://www.sparkpost.com/policies/privacy/.
- A webhook: the email goes to the address you enter, which is yours, so its terms are your own.
The assistant: when you set up an AI provider in the dashboard, each question you ask the assistant goes to that provider, with the site’s totals and lists it needs to answer it, such as pages, sources, or countries with their counts, and only when you ask. Runlight keeps no IP address or user agent, so none is ever sent. The providers:
- Anthropic (api.anthropic.com). Terms: https://www.anthropic.com/legal/commercial-terms. Privacy: https://www.anthropic.com/legal/privacy.
- OpenAI (api.openai.com). Terms: https://openai.com/policies/services-agreement/. Privacy: https://openai.com/policies/privacy-policy/.
- Google Gemini (generativelanguage.googleapis.com). Terms: https://ai.google.dev/gemini-api/terms. Privacy: https://policies.google.com/privacy.
- OpenRouter (openrouter.ai), which passes the question to the model you pick. Terms: https://openrouter.ai/terms. Privacy: https://openrouter.ai/privacy.
- Ollama and LM Studio run a model on a computer you choose, this server by default (localhost), so the question goes only to the address you enter. Ollama’s terms: https://ollama.com/terms, and privacy: https://ollama.com/privacy. LM Studio’s terms: https://lmstudio.ai/app-terms, and privacy: https://lmstudio.ai/app-privacy.
- Another OpenAI-compatible service: the question goes to the address you enter, under that service’s own terms and privacy policy.
Imports: when you import from one of these in the dashboard, Runlight reads your links, or your visits for Umami, from that service with the key or sign-in you enter, once, and sends nothing else:
- Umami: the address you enter, your own Umami or Umami Cloud. Umami Cloud’s terms: https://umami.is/terms, and privacy: https://umami.is/privacy.
- Bitly (api-ssl.bitly.com). Terms: https://bitly.com/pages/terms-of-service. Privacy: https://bitly.com/pages/privacy.
- Dub (api.dub.co). Terms: https://dub.co/legal/terms. Privacy: https://dub.co/legal/privacy.
- Rebrandly (api.rebrandly.com). Terms: https://www.rebrandly.com/terms-conditions. Privacy: https://www.rebrandly.com/privacy-policy.
- Short.io (api.short.io and statistics.short.io). Terms: https://short.io/terms. Privacy: https://short.io/privacy.
Other Runlight installs and link domains, only when you set them up in the dashboard:
- Other installs: when you add another Runlight install to the dashboard, to see its sites beside this one’s, Runlight sends the API token you enter, or one you allow on that install’s own consent page, to the address you enter, and from then on reads that install’s site list and numbers from it with that token while you look at them. Removing the install asks it to delete the token. That install is yours, so its terms are your own.
- Short link domains: when you add a custom domain for short links, Runlight checks it by fetching https:///.well-known/runlight-link-domain, a file on that domain, and sends nothing with the request. The domain is yours, so its terms are your own.
Sending to a Runlight you run elsewhere, the plugin talks to that Runlight alone, at the address you enter. You run it yourself, so its terms are your own; Runlight is open source software under the MIT licence, and runlight.sh’s terms and privacy policy are at https://runlight.sh/terms/ and https://runlight.sh/privacy/.
- Every page loads Runlight’s script from that address. In the visitor’s browser, the script sends the page’s address, the referring page, the screen size, the browser’s language, the page’s title, how long it was read, and how far down it was scrolled, with any events you set up. Runlight uses the visitor’s IP address and user agent to work out a daily visitor count and never stores them.
- When an AI agent such as ChatGPT or Claude fetches a page and you have entered an agents key, the plugin sends that page’s address and the agent’s user agent to the same Runlight, from your server.
- When an administrator opens the settings page, or saves it, the plugin asks that address whether it answers as Runlight, to tell you whether it is connected.
- When an administrator presses Connect, the plugin asks that address for its OAuth details and registers this site with it, sending the site’s host and the wp-admin address to come back to. The administrator then allows the connection on that Runlight’s own page, and on the way back the plugin sends the one-time code it was given and gets this site’s id, agents key, and dashboard key, which it saves in its setting.
- When an administrator opens the Runlight page in wp-admin and you have entered a dashboard key, the plugin sends that key and the address wp-admin is served from (its scheme, host, and port) to the same Runlight, from your server, and gets back a ticket that opens the dashboard once. The page then loads the dashboard from that Runlight in a frame, in the administrator’s browser.
Screenshots
No screenshots provided
