Know who visits
Visitors, sessions, page views, bounce rate and visit duration. Only humans count: blocked requests, bots and attacks never create a visitor.
Analytics
Visitors, sources, pages, audience, performance and security traffic of your sites, measured at the proxy: no third party, no cookie, computed on your own control plane. The details are here, with what the free edition includes.
What it is for
Your requests already go through ToutWAF: the statistics come out of it with nothing to install on your pages, and without sending your visitors to a third-party service.
See where they come from
Channels (direct, search, social, email, referral, paid, AI assistants), UTM campaigns, countries and networks.
Spot slow and broken pages
Your server's response time in percentiles, pages with errors, cache hit rate; Core Web Vitals with the script.
Measure what matters
Goals (page viewed, event, scroll depth, engaged time), custom events, outbound clicks, downloads, forms.
See the security side
The share of human, bot, attack and blocked traffic, the most targeted paths, bots by name.
Respect your visitors
No cookie, no local storage, no identifier in the browser. Do Not Track is respected.
Two ways of measuring
The server-side measurement is always on; a small optional script adds what only a browser knows.
Server-side measurement (always on)
Every request already goes through ToutWAF: path, status, size, your server's response time, country, network, browser, referrer. No script, nothing an ad blocker can hide.
First-party script (optional)
A small script served by ToutWAF from your own domain adds screen size, engaged time, scroll depth, outbound clicks, downloads, form submissions (the count, never the values), JavaScript errors, Core Web Vitals and your events. Automatic mode (ToutWAF adds it to HTML pages, the default), manual (you add one line) or off.
Computed at home
The figures are computed on your own control plane, with no third party. Without the script, or when a blocker prevents it, the server-side measurement stays complete and the console says so.
Only humans count as visitors
ToutWAF classifies every request before counting: a bot or a scanner no longer inflates your audience.
Human
Everything else. Only human page views create visitors and sessions.
Bot
A known crawler, AI agent or HTTP tool, or a bot score above the threshold you set.
Attack
An attack that was let through (detect mode), or a high-severity rule match that was let through.
Blocked
ToutWAF refused or challenged the request. Never a visitor.
A page view is a successful document request (GET, HTML): assets, API calls, health checks, bots and blocked requests are not page views.
One report per question
The console has one page per topic, plus the settings.
Overview
Key figures with the change against the previous period, visitors over time, the top pages, sources, countries and browsers.
Acquisition
Channels, referrer sites and UTM campaigns (source, medium, campaign, term, content).
Audience
Countries, regions and cities (when your geolocation database has them), networks and operators, languages, time zones.
Behaviour
Pages per session, visit duration, flows from entry page to exit page, one visit or several on the same day.
Pages
Views, unique views, time on page, bounce, entries and exits; the slowest pages and the ones that answer with errors.
Events and goals
Goals with conversion rate and revenue, custom events, outbound clicks, downloads, form submissions, JavaScript errors.
Performance
Your server's response time (median, p75, p95), status codes, cache hit rate; Core Web Vitals (LCP, INP, CLS, FCP, TTFB) with the script; by device and by country.
Realtime
Visitors online now, page views per minute over the last 30 minutes, a live feed, and the pages, sources and countries of the moment.
Security traffic
Human, bot, attack, blocked and challenged traffic over time; attacks by type, country, network and path; bots by name.
Technology
Browsers and versions, operating systems, device types, screen sizes and resolutions, light or dark scheme, mouse or touch.
Settings
Per site: switch on, anonymous mode, retention, excluded addresses and paths, session length, bot threshold, script mode, goals; defaults inherited by the sites.
In the console
An example of the Overview page: key figures, the evolution over time and the main channels.
Filter, compare, export
- Periods: today, yesterday, 7, 30 or 90 days, or dates of your own.
- Comparison with the previous period or with the same period last year.
- Filters: channel, referrer, UTM campaign, country, region, city, network, browser, operating system, device, language, page, entry page.
- One site or several at once, according to your read permissions.
- CSV export from the console; CSV or JSON through the API.
Filters cover the detail retention window (7 days by default) and are not available in anonymous mode.
https://waf.example.com:9443
Analytics
7 daysPrevious period
Visitors
Page views
Bounce rate
Visit duration
Visitors over time7 days
Channels
Illustration: layout of the console, without real figures.
Goals and events
A goal is reached when a page is viewed, an event is sent, a scroll depth (25, 50, 75 or 100 %) is reached, or the visitor stays engaged for a number of seconds. It is counted once per session and per goal, with a fixed revenue or one sent with the event.
Outbound clicks, downloads (extensions you can set), form submissions (count only) and JavaScript errors (grouped by a hash of the message) are recorded by the script, with nothing to code.
JavaScript
twa("event", "signup",
{ plan: "pro", revenue: 19.9 })HTML
<button data-tw-event="newsletter">…</button>Privacy by design
What the measurement keeps, and what it does not.
No cookie, no identifier
Nothing is kept in the visitor's browser: no cookie, no local storage, no identifier, with or without the script.
A visitor is a hash of the day
The IP address and the browser are hashed with a random salt that changes every day and is deleted after two days: a visitor cannot be followed across days or turned back into an address.
Do Not Track respected
Do Not Track and Global Privacy Control are respected by default: the script switches itself off and such requests are not counted.
Anonymous mode
Keeps aggregates only: no city, region or time zone, no per-page-view detail, no live feed.
Retention and exclusions
You choose how long data is kept (by default 90 days for hourly and daily figures, 7 days for the detail), and which IP addresses and paths are excluded.
Never the content
Form submissions are counted without their values; JavaScript errors are grouped by a hash, with no message or stack.
Good to know
- “Visitors” over several days is the sum of the daily visitors: a returning visitor on another day counts as new, and a visit that crosses midnight counts as two.
- The response time is your server's, measured by ToutWAF up to the first byte; it is not what the browser experiences (Core Web Vitals come from the script).
- A visit without a referrer (typed address, bookmark, privacy settings) is counted as direct.
- Region and city need a geolocation database that has them on the data plane.
- Visitors who block scripts are not measured by the script; the server-side measurement goes on.
- A session ends after 30 minutes without a page view (adjustable).
Whether consent is required depends on your jurisdiction and on how you configure analytics (script, retention, anonymous mode): decide it with your legal adviser. This page is not legal advice.
When the page is empty, the console tells you why
The “Measurement” card puts the server-side measurement and the script side by side and stops at the first broken link: no node or an offline node, a DNS that points elsewhere, only bots, pages the script cannot be added to, script not loaded (ad blocker, content security policy), beacons refused. The “Test the measurement” button makes each node visit the site, the way a browser would.
Use cases
Marketing
Which channels and UTM campaigns bring visitors, and which ones convert.
Product
Which pages are read to the end, where sessions end, which goals are reached.
Operations
The slowest pages, the ones that answer with errors, the cache hit rate.
Security
How much of the traffic is bots or attacks, which paths are targeted, where attacks come from.
A clean audience
Bots, scanners and attacks no longer inflate your visitors: the figures reflect people.
Several sites
One view for a site or for all the ones you may read, with the comparison to the previous period.
What is included, by edition
Basic analytics is in every offer; advanced analytics (funnels, cohorts, map down to the city, alerts, scheduled reports) needs Pro or above.
EdiçãoGratuito Incluído em todas as ofertas, incluindo as duas gratuitas (Free e Free +)Pro e superiores Ofertas pagas: visível na consola, bloqueada sem licença. A partir do Pro, salvo indicação Agency ou Enterprise
- Visitantes, sessões, páginas vistas, taxa de rejeição e duração, medidos no proxy: sem script, sem cookiesGratuito
- Cada pedido classificado como bloqueado, ataque, bot ou humano: só os humanos criam visitantesGratuito
- Canais, referentes e campanhas (UTM), audiência por país, rede (ASN) e idiomaGratuito
- Objetivos e eventos personalizados, cliques de saída, transferências, formulários; um script opcional alojado no seu site acrescenta o restoGratuito
- Desempenho: percentis de latência da origem, códigos de estado, cache; Core Web Vitals com o scriptGratuito
- Tráfego de segurança: repartição entre humano, bot, ataque, bloqueado e desafiado; principais regras, países e caminhosGratuito
- Tempo real: visitantes em linha agora, visualizações por minuto, fluxo em diretoGratuito
- Comparação com o período anterior, filtros, exportação CSV e JSONGratuito
- Privacidade: sal aleatório diário, Do Not Track respeitado, modo anónimo, retenção definida por siteGratuito
O plano de dados nunca consulta a licença. As duas ofertas gratuitas (Free e Free +) podem ser usadas a título profissional, dentro dos seus limites.
Coloque hoje um escudo à frente das suas aplicações
Instale-o no seu próprio servidor, ou contacte-nos para falar de licenças.