HKC Trafic

Who comes to your site, who is a robot, and what they read. Five screens in the WordPress admin, no JavaScript, no tracker, and a retention sized to the traffic you actually receive.

The one exception to our first principle. Every other HKC extension loads nothing at all on your public site. This one cannot: an access journal has to see the accesses. What it does on a public request is append one line of text to a file, after the answer has been sent — no SQL query, no network call, nothing added to the page. A scheduled task writes those lines to the database in batches of two hundred, where each line costs ten times less than a lone INSERT.

Overview

Pages seen, visits and pages per visit, over today, 7, 30, 90 days or 12 months. Filters stack — device, system, browser, language, and country and city if you turn on locating — and each dropdown shows the values actually present with their count and their share, computed with the other filters applied: choosing “phone” refreshes the list of browsers, but not the list of devices, which would otherwise be stuck on a single choice.

The chart stacks visits and further pages seen: the full height is the number of pages, the darker part the number of visits. A visitor is counted once a day, by a salted fingerprint of their address and browser — no cookie.

Statistics

Ten rankings over the same period: most read pages, referring sites, previous pages of an internal journey, devices, browsers, systems, language read, countries, cities, and addresses your visitors failed to reach.

The period you pick follows you from screen to screen: look at ninety days of robots, move to the journal, and you are still looking at ninety days. A screen that cannot show twelve months — robots and probes are not kept that long — falls back to the longest period it does accept, rather than to its own default.

Robots

The fifteen most active robots of the period, with the addresses they ask for, the errors they are given, and when they last came. Robots are named from their user-agent, without any preset list — a list would be out of date in six months. The only list kept by hand answers one precise question:

• Which generative-AI crawlers actually come. GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot and their kind, grouped by the house behind them, with what they read and what they are answered. An SEO plugin tells you whether they are allowed; this tells you whether they came.
• Disguised robots. A page asked for from a data centre with an ordinary browser user-agent is a robot, not a visitor. Those are counted apart and kept out of the visit figures — this one needs locating to be on.

Access journal

One line per request: date, type, response code, time taken, address asked for, language, origin, visitor, client, robot, flag — and, once locating is on, country, city, operator and AS number. Each of those sixteen to twenty filterable columns carries a funnel showing its fifty most frequent values with their count, the other filters already applied. That is what replaces searching: you do not have to know what you are looking for, you look at what is there.

A filter you rebuild every week deserves a name: save it, and it sits above the table as a saved view — “probes that got an answer”, “AI robots on articles”, “404s seen by humans”.

Suspicious URLs

A WordPress site receives dozens of probes a day, looking for a forgotten wp-config, a phpMyAdmin, a backup file. Gathering them here does two things: they stop skewing the visit figures, and you do not discover them the day one of them succeeded.

The screen shows what they look for, the addresses tried with the response codes they were given, and where they come from. A 404 or a 403 is good news — there was nothing to find. A probe answered with a 200 is flagged at the top of the screen: it is the only line here that calls for a check the same day.

What it costs your database

This is the subject, and it is handled by three levers rather than a single setting:

• Addresses are stored once, in their own table; each request only carries their number. A line drops from about 400 bytes to about 110, indexes included.
• The user-agent is never stored: device, browser, system and robot name are derived from it as the line is written, and the string itself is thrown away.
• Retentions are separate — robots, everything else, pages seen by humans — because those lines do not age at the same speed.

The settings screen then measures what the journal really costs on your site: the real size of a line (size of the tables divided by the number of lines), the real rate of the last seven days, and the free space of the disk when the hosting tells it. It announces how many days the budget you set can hold, and offers the matching retentions in one click. Past the budget, the oldest lines go — and if the budget is too small for the journal to learn anything at all, writing stops and says so, rather than handing you figures that would be wrong.

To give an order of magnitude: a thousand pages seen and three thousand robot requests a day take about 440 kB a day, that is 13 MB a month of full detail.

Alerts

Safety nets that act in silence are not safety nets. Six situations raise a notice across the whole admin — not only on the extension's own screen — and send one email, then stay quiet for two days as long as the situation lasts:

• Less than 512 MB free on the disk, or under 5 % of it. This one is about the whole hosting, not the journal: a full disk takes the site down.
• The journal has used four fifths of its budget, or will fill it within the week at the rate observed.
• Requests over the last two days are three times the usual daily figure — a crawler gone wild, or a probe campaign.
• Lines are piling up unwritten: the scheduled import is no longer running, often because WP-Cron is disabled.
• Writing has stopped on its own.

What leaves your site

Nothing, unless you decide otherwise. There is no cookie, no script in your pages, no third-party service, and no data sent anywhere — with one exception you switch on yourself:

Country and city are not in the request: they have to be looked up from the visitor's address, which means sending that address to a third party. As long as no ipinfo token is saved in the settings, nothing is sent and the Country and City filters simply do not appear. With a token, only the addresses of human visitors are looked up, once each, and the answer is kept in a table of your site: the same address is never sent twice. The plugin counts its own lookups, stops at the monthly ceiling you set, and goes quiet until tomorrow if the service refuses.

Privacy

No cookie is set. A visitor is counted by a salted fingerprint valid for the day, computed from their address and browser: it allows neither recovering the address, nor following someone from one day to the next, nor recognising them on another site. The IP address lives less long than the line — past the delay you set (thirty days by default) it loses its last part and only the network is left; set to zero, it is truncated before being written and the full address exists nowhere. Pages seen by humans are kept for at most thirteen months.

That is the scope the French data protection authority (CNIL) exempts from consent: a measurement limited to your own site, no cross-referencing, no cross-site tracking, retention capped at thirteen months. Turning on locating sends addresses to a third party, which is why it is off until you decide.

What it cannot do

If your site is served by a page cache — LiteSpeed, WP Rocket, a CDN — PHP does not start for a page already cached, and those visits do not appear in the journal. The exhaustive record is then the one kept by your web server. Measuring visits behind a cache, time spent on a page and exit events requires a tag inside the page: that is the next step, and it is not in this version.

Requirements and installation

• WordPress 6.2 or later, PHP 7.4 or later.
• The screens require the manage_options capability.
• English admin interface.

1. Upload hkc-trafic.zip from Plugins › Add New › Upload Plugin.
2. Activate it: the tables, the waiting folder and the two scheduled tasks are created at activation.
3. Open the Trafic menu — the journal fills from the first visit. Come back the next day: the retention advice is then based on your own figures.

Uninstalling removes the tables, the settings and the waiting folder — which holds IP addresses and has no reason to outlive the extension that created it.