DEV Community: Hamdi Bk

WooCommerce Conversion Tracking: Find the Step That Loses Sales

Hamdi Bk — Sat, 24 Oct 2026 15:11:30 +0000

Most WooCommerce stores know what sold. Few know where the buyers who did not buy stopped. Below is the guide we published on optiuser.com: the five steps to track, how to set them up with GA4 or inside WordPress, and the four leaks they usually reveal. Disclosure: we build Opti-Behavior, the plugin mentioned in some sections.

WooCommerce conversion tracking means counting how many visitors reach each step of a purchase, from the product page to the paid order, so you can see where sales are lost. WooCommerce reports tell you what sold. They do not tell you who almost bought. This guide shows how to set up WooCommerce conversion tracking with the tools you already have, then the four problems it usually reveals and how to fix each one.

Short answer: track five steps (product page, add to cart, cart, checkout, order received), compare each step with the one before, and work on the biggest drop first. Google Analytics 4 can do it once your store sends ecommerce events; a WordPress funnel can do it from page visits. Then check the four usual leaks: products viewed but not added, checkouts started but not paid, payments that fail, and the product pages that lose the most sales.

What WooCommerce reports show, and what they miss

The WooCommerce Analytics menu lists revenue, orders, products, categories, coupons and stock. It answers “what did we sell?”. It does not count the visits that did not become an order, so it cannot give you a conversion rate per step.

A store owner usually feels the problem as “traffic is fine, orders are not”. Conversion tracking turns that feeling into four precise questions:

Which product pages are seen but rarely added to cart?
At which step between cart and order do buyers leave?
Do payments fail, with which payment method and which error?
Which of these problems costs the most?

How to set up WooCommerce conversion tracking

1. Write down the steps

Use the same five steps whatever the tool: product page, add to cart, cart page, checkout page, order received page. For the last step, use a rule like “URL contains order-received”, because the real confirmation address contains the order number.

2. With Google Analytics 4

GA4 needs the ecommerce events view_item, add_to_cart, begin_checkout and purchase. Google’s official WooCommerce integration sends them. Then build a Funnel exploration in the Explore section with those events as steps. If you also run ads, Google Ads and Meta each need their own purchase conversion, usually sent by their official WooCommerce extensions. Check how each one fits your consent setup before you turn it on.

3. Inside WordPress, from page visits

A funnel built from page visits needs no event setup: it counts the visitors who reach each page in order. In our guide to WordPress conversion funnels we show how it works. Opti-Behavior, our plugin, detects WooCommerce and suggests a Purchase Funnel (Shop, Product page, Cart, Checkout, Order received) with your real cart and checkout addresses filled in. This is in the free plugin.

4. Test the tracking

Place a test order on a phone and on a computer, and check that each step counts it once.
Exclude your own visits and your team’s, or they will hide the real drop.
Compare the order count of the tracking with WooCommerce > Orders for the same days. A large gap means a step is not measured.

Problem 1: products viewed but not added to cart

The sign: a product gets visits from search or ads, but sells little.

Check by hand: for each product, divide adds to cart by product page views over the same period, then sort from the lowest. Open the worst pages on a phone: the price, the delivery cost, the stock and the add to cart button should be visible without scrolling.

What Opti-Behavior shows (Free): the Shop screen of our WooCommerce analytics lists, for each product, product views, adds to cart, paid orders and lost visits (product page views that did not lead to an add to cart), worst product first. A product with adds to cart but no measured product view shows “Not measured” instead of 0. The click heatmap of the product page, also free, shows whether visitors click the gallery, the tabs or the button.

Problem 2: checkouts started but not paid

The sign: carts are filled, the checkout page gets visits, few orders arrive.

Check by hand: over the same days, compare visits to the checkout page with visits to the order received page. Then filter WooCommerce > Orders on Pending payment and Failed. A sudden drop after a plugin or theme update points to a broken checkout, not to buyers changing their mind. Our WooCommerce abandoned cart guide lists the settings to check first.

What Opti-Behavior shows: the funnel shows where visitors drop off between steps, with a device filter (Free). Smart Insights turns that funnel into a card that names the step where visitors leave, ranked by visitors lost (Free). Opti-Behavior Pro adds dedicated WooCommerce cards (product page to cart, cart to checkout, checkout to purchase), and session recordings show the shop events (add to cart, checkout, paid order, payment failure) in the list and the player, with a “Shop action” filter. Session-linked shop events are recorded only in Full tracking mode, after the visitor’s consent.

Smart Insights (Free) flags the funnel step where visitors drop off and says what to open next.

Problem 3: payments that fail

The sign: orders in Failed status, buyers who write “your payment does not work”, a payment method that suddenly sells nothing.

Check by hand: open WooCommerce > Status > Logs and read the log of each payment gateway for the days of the problem. Place a test order with each payment method, on a phone too.

What Opti-Behavior shows (Pro): on the Shop screen, payment errors grouped by error type and payment method, with the failed attempts, the orders concerned and their estimated cost (orders not paid later). In Full tracking mode, a recording of a failed payment can be watched.

Problem 4: which product loses the most sales

A product with many lost visits is not always the most costly one: a cheap product with high traffic can cost less than an expensive one with fewer visits. Rank by money, not by visits.

Check by hand: lost visits × your conversion rate × your average order value. Example with round numbers: 400 lost visits × 2 % × 50 = about 400 in sales at stake for the period. It is an estimate, not a promise: use it to choose what to fix first.

What Opti-Behavior shows (Pro): the Shop screen gives the estimated lost sales, as an indicative range, per product and for the period, from the lost visits, your conversion rate and your average order. The Shop screen shows lost sales as a range, or "Not enough data" when there are too few orders.

WooCommerce reports by e-mail

Conversion tracking only helps if someone reads it. Instead of opening the admin every day, get the figures sent to you. In Opti-Behavior, the scheduled e-mail report (daily, weekly or monthly) is free and includes a Shop block with the store’s figures. In Pro, the same block adds “Money at stake”, the estimated lost sales of the period, marked as an estimate.

Free or Pro: summary

Problem	What you get	Version
Products viewed but not added	Shop screen: views, adds to cart, paid orders, lost visits per product	Free
Where buyers leave	Suggested purchase funnel, drop-off per step, click heatmaps	Free
A purchase step with a large drop	Smart Insights card naming the step (Free); dedicated WooCommerce cards per purchase step (Pro)	Free / Pro
Why buyers leave	Recordings with shop events (Full mode, after consent) and the “Shop action” filter	Pro
Payments that fail	Payment errors by type and payment method, with estimated cost	Pro
What each product costs	Estimated lost sales per product (indicative range)	Pro
Reports by e-mail	Shop block with figures / “Money at stake”	Free / Pro

The full list of each version is on the pricing page.

What to check after a fix

Change one thing at a time: the product page, the cart, the checkout or a payment method.
Compare the same number of days before and after, on the same step of the funnel.
Split by device: a fix on desktop can leave the problem on phones.
Check WooCommerce > Orders too: more checkouts without more paid orders means the leak moved to the payment step.

FAQ

Does WooCommerce track conversions on its own?

It records orders, revenue and products sold. It does not count the visitors who saw a product or started a checkout without buying, so it cannot show a conversion rate per step without another tool.

Do I need Google Analytics for WooCommerce conversion tracking?

No. GA4 works once your store sends ecommerce events. A funnel built from page visits inside WordPress gives the step-by-step drop without that setup.

What is the difference between conversion tracking and WooCommerce reports?

WooCommerce reports count what was sold. Conversion tracking counts what happened before: visits, adds to cart, checkouts and payments, step by step.

Which WooCommerce analytics are free in Opti-Behavior?

The Shop screen, the purchase funnel, click heatmaps, the Smart Insights card that names the funnel step where visitors leave, and the Shop block of the e-mail report. Dedicated WooCommerce Smart Insights cards, estimated lost sales, payment errors and recordings with shop events are in Pro.

Find the step where your store loses sales

Install the free plugin, open Shop to see the products viewed but not added, then confirm the suggested purchase funnel.

Try it on your store: https://optiuser.com/blog/woocommerce-conversion-tracking/?utm_source=devto&utm_medium=referral&utm_campaign=oct26-problem-keyword&utm_content=woocommerce-conversion-tracking

Drafted with AI assistance, reviewed by the Opti-Behavior Team.

Heatmap Not Working After Installing a Cache Plugin? Here's Exactly What Breaks It

Hamdi Bk — Tue, 13 Oct 2026 10:52:28 +0000

Last verified: August 2026. Filter names and behaviours below were checked against each optimizer’s own documentation or source. Re-check before relying on them — optimizers change these between releases.

Heatmap not working after installing a cache plugin? Your heatmap page is empty. The session counter says zero. There is nothing in the browser console, no failed request in the Network tab, no warning in your dashboard. As far as every screen you can look at is concerned, nothing is wrong.

It isn’t your analytics tool. It’s your optimizer.

Cache and performance plugins rewrite, merge, defer and delay JavaScript. Tracking scripts are JavaScript. When an optimizer decides your tracker is just another file to bundle, the tracker stops executing — and because nothing errors, nothing tells you. You keep browsing your own site, the pages load faster than ever, and you lose weeks of behavioural data before you happen to open the heatmap and find it blank.

This applies to every tool in the category. Hotjar, Microsoft Clarity, Matomo, Opti-Behavior, your own custom beacon — same mechanism, same silence.

Click around a real dashboard before you install anything

A live WordPress site with real traffic, real heatmaps and real recordings. No signup, no credit card, no email.

Open the live demo →

Heatmap Not Working? The 60-Second Diagnostic

A heatmap not working right after a cache plugin install is almost always a script problem, so start here. Open your site in a private window, as a logged-out visitor, and run these three checks in order. Each one narrows the failure to a different cause.

1. Is the script in the HTML at all?

View source (Ctrl+U — not the DevTools Elements tab, which shows the DOM after JavaScript has run). Search for your tracker’s filename.

Not there → the script was never enqueued. This is not an optimizer problem. Check that the plugin is active, that you aren’t excluded from tracking as a logged-in admin, and that consent (if required) has been granted.
There, but the src points at something like /wp-content/cache/min/1/xxxx.js → your tracker was merged into a combined bundle. Go to the Minify/Combine section below.
There, but the type attribute is not text/javascript — you see type="rocketlazyloadscript", type="lazyload", data-src instead of src, or similar → the script is being delayed. Go to the Delay section.
There, with defer or async added → go to the Defer section.

2. Does the request actually leave the browser?

DevTools → Network → filter by XHR/Fetch, then click around and scroll for ten seconds. You are looking for the POST that ships events back to your site (admin-ajax.php, a REST route, or your vendor’s endpoint).

No request at all → the tracker never initialised. Confirmed script-level problem, continue below.
Request fires but returns 4xx → different problem: expired nonce or blocked REST route, usually caused by a page cache serving stale HTML rather than a JS optimizer. See “The page-cache trap”.
Request fires and returns 200 → your tracking works. Your problem is elsewhere: filtering, bot exclusion, or admin-user exclusion.

3. Is the config object defined?

In the console, type the name of the global config variable your tracker uses. Most tools localize their settings into a global (window.hj, window.clarity, window.optiBehaviorHeatmapConfig, etc.).

undefined while the script file itself is present → this is the failure almost everyone misses. The external .js file was correctly excluded from optimization, but the small inline <script> block containing its settings was not. The tracker loads, finds no configuration, and exits silently.

That third case is worth stating plainly, because it wastes more hours than the other two combined: excluding your tracker’s file is only half the job. The inline config block has to be excluded too, and it is matched by a different rule.

The four ways an optimizer kills a tracker

Delay JavaScript until user interaction

The most destructive one, and the most popular — it’s the single biggest PageSpeed win an optimizer can sell you. All non-essential JS is held back until the visitor moves the mouse, scrolls, or touches the screen.

For a tracker, that is fatal by design: everything that happens before the first interaction is exactly what you were trying to measure. Landing, above-the-fold reading time, immediate bounces, and any click that lands before the delay releases — all lost. A visitor who arrives and leaves in four seconds without touching anything is invisible.

Defer

defer moves execution to after HTML parsing. Less brutal than delay, but it inverts load order. If your tracker depends on another script (an ID broker, a consent layer, a queue stub) and only one of the two is deferred, the dependent one runs first and finds nothing.

The characteristic symptom is not empty data — it’s wrong data. A tracker whose session-ID source isn’t ready when it runs will usually fall back to minting a fresh random ID. You get one brand-new “session” per page view: inflated visitor counts, average session duration collapsing toward zero, funnels that never link two steps together. Everything looks alive, and everything is wrong.

Empty heatmaps get noticed. This doesn’t. Check for it specifically.

Minify and combine

Several JS files are concatenated into one bundle and rewritten. Trackers break here for two reasons: the rewrite can mangle the code, and the file the browser now loads has a different URL — so any exclusion rule you wrote based on the original filename no longer matches anything.

Concatenate / lazy-load / render-blocking removal

Feature names differ, mechanism is the same as the two above. Jetpack Boost concatenates. Cloudflare Rocket Loader defers everything through its own scheduler. NitroPack does the work on an external service, so no local rule can reach it.

The page-cache trap (bonus, and it’s a real one)

Full-page caches — WP Super Cache, Cache Enabler, and the page-cache half of WP Rocket or LiteSpeed — don’t touch your JavaScript at all. They cause a different failure: stale HTML with an expired security nonce.

Your tracker’s POST includes a nonce that WordPress generated when the page was rendered. If that page has been sitting in the cache for two days, the nonce is dead and the server rejects every event with a 403. Same silence, completely different cause. If diagnostic step 2 showed a 4xx, this is your problem — not JS optimization.

The same trap ruins A/B tests. A page cached while showing variant B gets served to every subsequent visitor, including the ones assigned variant A. Your test results become noise. The fix is a cache-vary cookie (below), not an exclusion rule.

Fixes, plugin by plugin

Add these to your child theme’s functions.php or a small mu-plugin. Replace your-tracker.js and yourTrackerConfig with your actual filename and inline config variable name.

If you’d rather not write code: every one of these plugins exposes the same lists in its settings UI (usually under File Optimization → Excluded files or similar). The code path is more reliable because a plugin update or a settings reset can’t quietly wipe it.

WP Rocket

// Minify/Combine JS and Defer JS — regex fragments matched against the URL.
add_filter( 'rocket_exclude_js', 'my_tracker_excludes' );
add_filter( 'rocket_exclude_defer_js', 'my_tracker_excludes' );
function my_tracker_excludes( $excluded ) {
    $excluded[] = '(.*)your-tracker\.js';
    return $excluded;
}

// Delay JavaScript execution — plain strings, matched against BOTH
// external script URLs and inline script content.
add_filter( 'rocket_delay_js_exclusions', function ( $excluded ) {
    $excluded[] = 'your-tracker.js';
    $excluded[] = 'yourTrackerConfig';  // the inline config block
    return $excluded;
} );

// Inline config blocks, for Defer and Combine separately.
add_filter( 'rocket_defer_inline_exclusions', function ( $e ) {
    $e[] = 'yourTrackerConfig';
    return $e;
} );
add_filter( 'rocket_excluded_inline_js_content', function ( $e ) {
    $e[] = 'yourTrackerConfig';
    return $e;
} );

The trap that costs people weeks: rocket_exclude_js and rocket_exclude_defer_js entries are not self-delimited regex patterns. WP Rocket joins your entries with | and wraps the whole set in its own #(...)# delimiters before matching. Write /my-tracker\.js/ with slashes, as you would for preg_match(), and those slashes become literal characters the URL must contain. A real enqueued URL ends in .js?ver=1.2.3, never in a literal /, so the pattern silently matches nothing — and you will swear you excluded the file, because you did.

Emit bare fragments. No delimiters.

LiteSpeed Cache

add_filter( 'litespeed_optimize_js_excludes', function ( $e ) {
    $e[] = 'your-tracker.js';
    return $e;
} );

// Defer exclusion — matched against inline content too, so feed both.
add_filter( 'litespeed_optm_js_defer_exc', function ( $e ) {
    $e[] = 'your-tracker.js';
    $e[] = 'yourTrackerConfig';
    return $e;
} );

SiteGround Optimizer

add_filter( 'sgo_javascript_combine_exclude', 'my_tracker_handles' );
add_filter( 'sgo_js_minify_exclude',          'my_tracker_handles' );
add_filter( 'sgo_js_async_exclude',           'my_tracker_handles' );
function my_tracker_handles( $exclude_list ) {
    $exclude_list[] = 'your-tracker-handle';  // enqueue HANDLE, not filename
    return $exclude_list;
}

add_filter( 'sgo_javascript_combine_excluded_inline_content', function ( $e ) {
    $e[] = 'yourTrackerConfig';
    return $e;
} );

The trap: all three SG Optimizer filters compare against the wp_enqueue_script handle, not the filename. Their own documentation shows $exclude_list[] = 'script-handle'. Pass your-tracker.js and the filter runs, returns cleanly, and excludes precisely nothing. This one is invisible in testing because the code looks correct.

If you don’t know your handle: search the plugin’s source for wp_enqueue_script( — it’s the first argument.

Autoptimize

add_filter( 'autoptimize_filter_js_exclude', function ( $exclude ) {
    return $exclude . ', your-tracker.js';
} );

Note the format: a comma-separated string, not an array. Returning an array here breaks the filter.

Perfmatters

foreach ( array( 'delay', 'defer', 'minify' ) as $stage ) {
    add_filter( "perfmatters_{$stage}_js_exclusions", function ( $e ) {
        $e[] = 'your-tracker.js';
        return $e;
    } );
}

WP-Optimize

add_filter( 'wp-optimize-minify-default-exclusions', function ( $e ) {
    $e[] = 'your-tracker.js';
    return $e;
} );

The trap: matched case-insensitively as a substring against the full script URL. Enqueue handles never appear in a URL, so passing a handle here silently does nothing. The mirror image of the SiteGround mistake — which is exactly why people who fix one site break the next.

W3 Total Cache

add_filter( 'w3tc_minify_js_do_tag_minification', function ( $do, $tag = '', $file = '' ) {
    if ( false !== strpos( $tag . ' ' . $file, 'your-tracker.js' ) ) {
        return false;
    }
    return $do;
}, 10, 3 );

Breeze

add_filter( 'breeze_js_dontmove', function ( $e ) {
    $e[] = 'your-tracker.js';
    return $e;
} );

Jetpack Boost

add_filter( 'js_do_concat', function ( $do_concat, $handle = '' ) {
    return ( 'your-tracker-handle' === $handle ) ? false : $do_concat;
}, 10, 2 );

Concatenation is filterable. Render-blocking/defer is not — Boost’s only documented exclusion mechanism there is the data-jetpack-boost="ignore" tag attribute. See below.

NitroPack, WP Fastest Cache, FlyingPress, Hummingbird, Swift Performance

No reliable PHP exclusion filter is publicly documented for these. NitroPack in particular optimizes on its own external service, so no local hook can intercept it. Use the settings UI, and rely on tag attributes.

The universal fallback: tag attributes

When no filter exists, mark the script tag itself. Six attributes cover most of the ecosystem:

add_filter( 'script_loader_tag', function ( $tag, $handle ) {
    if ( 'your-tracker-handle' !== $handle ) {
        return $tag;
    }
    return str_replace(
        '<script ',
        '<script nowprocket data-cfasync="false" data-noptimize="1" '
        . 'data-no-optimize="1" data-no-defer="1" data-jetpack-boost="ignore" ',
        $tag
    );
}, 10, 2 );

nowprocket — WP Rocket
data-cfasync="false" — Cloudflare Rocket Loader
data-noptimize="1" — Autoptimize, Breeze (no hyphen)
data-no-optimize="1" — LiteSpeed and others (with hyphen — yes, you need both)
data-no-defer="1" — generic
data-jetpack-boost="ignore" — Jetpack Boost

Important limitation: attributes only protect optimizations that inspect the rendered tag. Optimizations that match against the URL — WP Rocket’s minify and defer among them — never see these attributes. Attributes are a safety net, not a substitute for the filters above.

Fixing the page-cache trap

// WP Rocket: vary the page cache by a cookie your tracker sets.
add_filter( 'rocket_cache_dynamic_cookies', function ( $cookies ) {
    $cookies[] = 'my_ab_variant';
    return $cookies;
} );

// LiteSpeed equivalent.
add_filter( 'litespeed_vary_cookies', function ( $cookies ) {
    $cookies[] = 'my_ab_variant';
    return $cookies;
} );

For expired nonces on long-cached pages, the durable fix belongs in your tracker: retry once on a 403 after re-reading a fresh nonce. If you’re using a hosted tool, you can only shorten the cache lifetime.

Verify the fix properly

Before you trust any fix for a heatmap not working, verify it properly. Applying an exclusion and seeing data appear proves nothing on its own — you may simply have generated traffic while logged in, or the page you tested may not have been cached yet. Do this instead:

Purge every cache. Plugin cache, host cache (SiteGround, Kinsta, WP Engine all have their own), and Cloudflare if it’s in front.
Reload as a logged-out visitor in a private window.
View source and confirm three things: your tracker’s src points at the original file, not a /cache/min/ bundle; the type is text/javascript; the inline config block is present and unmangled.
In the console, check the config global is defined. Not undefined.
In the Network tab, confirm the event POST fires and returns 200.
Then check the dashboard — with the same date filter as your test, and with any “exclude admins” setting in mind.
Re-test on the pages that matter, not just the homepage. Checkout, product, and landing pages often have different scripts and different cache rules.
Re-test after your next optimizer update. Exclusion lists get reset by major version upgrades more often than you’d expect.

Choosing a tool? See our WordPress heatmap plugin comparison of 8 options.

You should never have had to read this

A heatmap not working for weeks with no warning is the real failure here. Every step above is diagnosis you performed because your tool stayed quiet. That’s the real defect. Not the optimizer — optimizers are doing exactly what you installed them to do. The defect is that a tracking tool can lose 100% of its data for six weeks and report nothing but an empty chart.

There’s no technical reason for that silence. The tool knows the site had traffic. It knows which of its modules are enabled. If traffic is arriving and a module’s event table stays at zero, it has everything it needs to raise its hand.

That’s the check we built into Opti-Behavior in 1.7.1. Every six hours it compares “the site received page views in the last 24 hours” against “this module recorded at least one event”, per module. If traffic is flowing and events aren’t, it shows an admin notice, names which modules went dark, and identifies the active cache or optimization plugin most likely responsible — from a list of nineteen. Sites with no traffic never alert, so a quiet site can’t trigger a false alarm. It reads nothing but COUNT(*) aggregates, adds no frontend code, and runs at most once every six hours.

Click around a real dashboard before you install anything

A live WordPress site with real traffic, real heatmaps and real recordings. No signup, no credit card, no email.

Open the live demo →

Alongside it, the exclusion rules on this page ship pre-registered for all the optimizers listed above — including the handle-versus-filename distinction that makes the SiteGround and WP-Optimize filters no-ops when you get them backwards. We had both of those backwards ourselves until July 2026. That’s how we know how invisible it is.

Opti-Behavior is a self-hosted WordPress plugin: heatmaps, funnels, session recordings, A/B testing and form analytics, with the data staying in your own database. See the plugin on WordPress.org →

Whatever you use, apply the exclusions, and then go check the last thirty days of data you assumed was being collected. Using Opti-Behavior? Run First 10 minutes: verify tracking is working, then see Cache plugin compatibility for what is handled automatically.

This article was drafted with the help of AI tools and reviewed by The Opti-Behavior Team.

Cookieless Analytics for WordPress: How Session-Based Tracking Works, and How to Prove a Plugin Sets Zero Cookie

Hamdi Bk — Sat, 05 Sep 2026 10:38:02 +0000

Every WordPress analytics plugin says "GDPR compliant" on its page. Most of them still leave a cookie. Some leave nothing in the cookie jar and hide a note in localStorage instead. A few build a fingerprint of your device.

This post explains the one design that really needs no consent banner, and shows you how to test any plugin yourself in one minute.

The cookie is the problem, not the counting

Europe's privacy rule (ePrivacy, Art. 5(3)) is simple: if you write or read something on the visitor's device, you must ask first. Counting pageviews is not the problem. Leaving a note in the browser is.

Three ways to leave a note:

a cookie (document.cookie)
other browser storage: localStorage, sessionStorage, IndexedDB
a fingerprint: nothing is written, but the script reads your screen size, fonts and browser details and mixes them into a secret ID. Privacy authorities treat this as worse than a cookie, because you can't see it or delete it.

A plugin that does none of the three can count visitors without a banner. France's privacy authority (CNIL) already allows this kind of audience measurement without consent, under conditions.

How session-based tracking works

The idea: the visitor's ID lives only in the page's memory, while the tab is open. It is never saved anywhere.

// Simplified. Runs once per page load.
const sessionId = crypto.randomUUID();     // exists only in this variable

function track(event, data = {}) {
  navigator.sendBeacon('/wp-json/analytics/v1/event', JSON.stringify({
    sid: sessionId,
    event,
    url: location.pathname,
    ref: document.referrer,
    ...data,
  }));
}

track('pageview');
addEventListener('click', e => track('click', { x: e.pageX, y: e.pageY }));

Close the tab, the ID disappears. There is nothing left to ask permission for.

On the server, WordPress writes the data into its own database. Before saving, it cuts the visitor's internet address (IP) short, so nobody can be identified:

// Simplified. IPv4: zero the last number. IPv6: keep the first 48 bits.
function ob_anonymize_ip( string $ip ): string {
    if ( filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) ) {
        return preg_replace( '/\.\d+$/', '.0', $ip );
    }
    $bin = inet_pton( $ip );
    return inet_ntop( substr( $bin, 0, 6 ) . str_repeat( "\0", 10 ) );
}

You still know which country the visitor is from. You can't find the person.

What you lose: the plugin can't be sure that today's visitor is the same person as yesterday. It makes a good guess. For traffic, funnels and heatmaps, that's enough. For following one person over months, it isn't, and you shouldn't do that without asking anyway.

What you gain: the 35–45% of European visitors who click "Reject" are now counted. And they're not just anyone: Firefox and Brave users, people with ad blockers, developers. If your visitors are technical, cookie-based analytics is measuring the wrong crowd.

Test any plugin in 60 seconds

Open your site in a private window, press F12, and paste this in the console:

// Run before and after the analytics script loads
console.table({
  cookies: document.cookie.split(';').filter(Boolean),
  localStorage: Object.keys(localStorage),
  sessionStorage: Object.keys(sessionStorage),
});
indexedDB.databases().then(dbs => console.log('IndexedDB:', dbs.map(d => d.name)));

Then open the Network tab and look at what the plugin's script sends out. If you see scrambled navigator or canvas data leaving, that's a fingerprint.

Try it on Google Analytics, Hotjar or Clarity: you'll see _ga, _hjSession*, _clck. Try it on a real cookieless plugin: every list is empty.

Where I land

I built Opti-Behavior) on exactly this model: ID in memory only, no localStorage, no fingerprint, IP cut short before saving, everything stored in your WordPress database with no outside server, a ~15 KB script that never slows the page, robot filtering. Heatmaps and funnels are free. Session recordings (replaying one visitor) are Pro and run on a separate track, because replaying a person does need a "yes", cookies or not.

Full write-up, including what the CNIL says and why fingerprinting is a trap: How to Track WordPress Visitors Without Cookies (GDPR Compliant).

Run the 60-second test on your current setup and post what comes back. I'm collecting examples of "cookieless" plugins that aren't.

Your A/B test has three goals and they disagree. Now what?

Hamdi Bk — Sat, 01 Aug 2026 18:37:51 +0000

Every A/B testing tutorial ends the same way: run the test, wait for significance, ship the winner.

Then you run a real test and variant B converts 12% better on newsletter signups, brings in 4% less revenue per visitor, and bounce is flat. Nothing is significant except the signups. Ship it?

I spent an embarrassing amount of time on this question while building an A/B engine, and most of what I read online didn't help, because most of it assumes one metric. This post is what I ended up with. It's not novel — the statistics are decades old — but I couldn't find it written down in one place with working code, so here it is.

Why the p-value doesn't answer the question you're asking

Two problems, and the second one is the bad one.

Multiple comparisons. Three metrics at α = 0.05 means roughly a 14% chance of at least one false positive if nothing is actually different. Bonferroni fixes this, but now you need α = 0.017 per metric and your test needs to run three times as long. On a site doing 300 conversions a month that's not a fix, it's a refusal.

The p-value is answering a different question. It tells you the probability of your data assuming no difference exists. What you actually want to know is: if I ship B, how much do I expect to lose if I'm wrong? Those are not the same question and no amount of Bonferroni turns one into the other.

There's also the peeking problem — everyone checks the dashboard daily and stops when it goes green, which quietly inflates the false positive rate well past whatever α you wrote down. I'll come back to that, because Bayesian methods do not magically solve it, whatever you may have read.

Posterior first, decision second

For a conversion rate, the Beta-Binomial conjugate pair gives you the posterior in one line. With a uniform prior, after c conversions out of n visitors:

p | data ~ Beta(1 + c, 1 + n - c)

That's it. No closed-form comparison between two Betas that's worth implementing, so sample.

PHP has no Beta sampler in core, and no Gamma sampler either, so you build one. Marsaglia–Tsang, which needs a normal sampler underneath:

function normal_sample(): float {
    // Box–Muller
    $u1 = max(mt_rand() / mt_getrandmax(), 1e-12);
    $u2 = mt_rand() / mt_getrandmax();
    return sqrt(-2.0 * log($u1)) * cos(2.0 * M_PI * $u2);
}

function gamma_sample(float $shape): float {
    if ($shape < 1.0) {
        $u = max(mt_rand() / mt_getrandmax(), 1e-12);
        return gamma_sample($shape + 1.0) * pow($u, 1.0 / $shape);
    }
    $d = $shape - 1.0 / 3.0;
    $c = 1.0 / sqrt(9.0 * $d);

    while (true) {
        do {
            $x = normal_sample();
            $v = 1.0 + $c * $x;
        } while ($v <= 0.0);

        $v = $v * $v * $v;
        $u = max(mt_rand() / mt_getrandmax(), 1e-12);

        if ($u < 1.0 - 0.0331 * $x * $x * $x * $x) {
            return $d * $v;
        }
        if (log($u) < 0.5 * $x * $x + $d * (1.0 - $v + log($v))) {
            return $d * $v;
        }
    }
}

function beta_sample(float $a, float $b): float {
    $x = gamma_sample($a);
    $y = gamma_sample($b);
    return $x / ($x + $y);
}

Now the single-metric comparison:

$draws = 20000;
$wins = 0;
$loss_if_ship_b = 0.0;

for ($i = 0; $i < $draws; $i++) {
    $pA = beta_sample(1 + $cA, 1 + $nA - $cA);
    $pB = beta_sample(1 + $cB, 1 + $nB - $cB);

    if ($pB > $pA) {
        $wins++;
    }
    $loss_if_ship_b += max($pA - $pB, 0.0);
}

$prob_b_better  = $wins / $draws;
$expected_loss  = $loss_if_ship_b / $draws;

Two numbers instead of one. $prob_b_better is the intuitive one everybody quotes. $expected_loss is the one that should drive the decision: it's the average amount of conversion rate you give up, across the whole posterior, in the worlds where B is actually worse. If that number is 0.0004 and you genuinely don't care about four hundredths of a percentage point, ship B and stop thinking about it, even at 88% probability.

Pick that threshold before the test. Write it in the test config. It's the smallest effect you'd bother shipping for, and it forces a conversation about what the test is actually for.

Revenue per visitor is not a Beta

This is where I initially got it wrong. I treated revenue per visitor as a conversion-like quantity and got posteriors that were far too confident.

Revenue per visitor is zero-inflated (most visitors buy nothing) and heavy-tailed (one enterprise order distorts everything). A Beta is wrong, a Normal is wrong, a log-normal is closer but still assumes away the zeros.

I use a bootstrap instead. Resample the observed per-visitor revenue values with replacement, $draws times, take the mean of each resample. That's your posterior-ish distribution, and it inherits whatever ugly shape your real data has without you having to name it:

function bootstrap_means(array $values, int $draws): array {
    $n = count($values);
    $out = [];
    for ($d = 0; $d < $draws; $d++) {
        $sum = 0.0;
        for ($i = 0; $i < $n; $i++) {
            $sum += $values[mt_rand(0, $n - 1)];
        }
        $out[] = $sum / $n;
    }
    return $out;
}

It's O(draws × n) and it will hurt on large samples. Precompute a cumulative array and sample indices in blocks, or bootstrap on a fixed random subsample of 5,000 visitors per arm — the extra Monte Carlo noise is small compared to the sampling noise you're already living with.

Combining metrics without lying to yourself

Now the actual question. Three metrics, three posteriors, one decision.

The standard answer is an OEC — Overall Evaluation Criterion, from Kohavi's work at Microsoft. One weighted composite, agreed in advance, that the test is scored against. The two things people get wrong:

1. Weight relative uplift, not raw values. A conversion rate lives in [0,1], revenue per visitor might be €3.40, bounce rate is a percentage. Summing those with weights is meaningless. Convert each to relative uplift first, so everything is dimensionless.

2. Compute the composite inside the loop. This one matters and it's easy to miss. If you compute P(conv_B > conv_A), P(rev_B > rev_A) separately and then combine the summary numbers, you've thrown away the correlation between metrics. The draws are paired: draw i represents one coherent hypothetical world. Score the composite in that world, then aggregate.

$draws  = 20000;
$w      = ['conv' => 0.5, 'rev' => 0.4, 'bounce' => 0.1]; // must sum to 1
$rev_A  = bootstrap_means($revenue_A, $draws);
$rev_B  = bootstrap_means($revenue_B, $draws);

$oec_positive = 0;
$oec_loss     = 0.0;

for ($i = 0; $i < $draws; $i++) {
    $pA = beta_sample(1 + $cA, 1 + $nA - $cA);
    $pB = beta_sample(1 + $cB, 1 + $nB - $cB);
    $bA = beta_sample(1 + $bounceA, 1 + $nA - $bounceA);
    $bB = beta_sample(1 + $bounceB, 1 + $nB - $bounceB);

    $u_conv   =  ($pB - $pA) / $pA;
    $u_rev    =  ($rev_B[$i] - $rev_A[$i]) / $rev_A[$i];
    $u_bounce = -(($bB - $bA) / $bA);   // lower bounce is better, so flip

    $oec = $w['conv'] * $u_conv
         + $w['rev']  * $u_rev
         + $w['bounce'] * $u_bounce;

    if ($oec > 0) {
        $oec_positive++;
    }
    $oec_loss += max(-$oec, 0.0);
}

$prob_b_better  = $oec_positive / $draws;
$expected_loss  = $oec_loss / $draws;  // in relative-uplift units

Ship B when $expected_loss is below your threshold of caring. Not when $prob_b_better crosses 95%.

Fix the weights before you look at any data. Otherwise you will — I promise you will — nudge them until your preferred variant wins. If you can't decide the weights before the test, you don't have a hypothesis, you have a hope.

Guardrails are not goals

Some metrics don't belong in the composite at all. Page load time, JS error rate, checkout failures — these are guardrails, and no amount of signup uplift should be allowed to buy a regression in them.

They get a veto, not a weight:

if ($p95_load_B > $p95_load_A * 1.10) {
    return Decision::BLOCKED;   // no composite, no discussion
}

Mixing a guardrail into the OEC is how you ship a variant that converts 8% better and breaks checkout for Safari.

The peeking problem is still there

You will read that Bayesian methods let you monitor continuously without penalty. That's half true and the half that's false will burn you.

Expected loss is a decision-theoretic quantity, so stopping when it falls under your threshold isn't the same statistical sin as stopping when a p-value dips below 0.05. But with tiny samples the posterior is wide and jumpy, and "expected loss happens to be low right now" is a thing that occurs by chance early in a test.

The pragmatic fix I settled on: a hard minimum before any decision is offered at all. Both arms need a floor of visitors and a floor of conversions — conversions are what actually carry the information, and 50,000 visitors with 11 conversions tells you almost nothing. Below the floor the UI shows the posterior and refuses to say anything else.

Not elegant. Works.

Performance, since this runs on shared hosting

20,000 draws × 4 Beta samples × 2 arms is a lot of mt_rand() calls in PHP, and it is nowhere near free on a €4/month host.

What made it survivable:

Run it on a scheduled job, not on dashboard load. Cache the decision payload.
Aggregate counts ($nA, $cA, …) in a summary table updated incrementally. Never scan the raw events table to compute a posterior.
Drop to 10,000 draws. The Monte Carlo error on $prob_b_better at 10k draws is about ±0.5 percentage points, which is invisible next to the uncertainty in your data.
Bail out early when the result isn't close. If the two 99% intervals don't overlap, you don't need the simulation.

On my setup, the full three-metric run at 20k draws takes [X] ms for [N] visitors per arm, down from [Y] ms before the summary table. Replace these with your real numbers or delete the paragraph — made-up benchmarks are worse than no benchmarks.

What I'd tell past me

The statistics were the easy part. The hard part was accepting that "which variant won?" is a badly formed question, and that the honest output of an A/B test is a distribution plus a decision rule you committed to in advance — not a green checkmark.

The engine got simpler once I stopped trying to produce certainty and started producing an expected cost of being wrong.

I'm the author of Opti-Behavior, a self-hosted analytics plugin, and the decision engine described here is what's running inside its A/B testing module — so take my enthusiasm for this approach with the appropriate grain of salt. The maths is standard and framework-agnostic; port it wherever you like. Happy to argue about the weighting scheme in the comments, it's the part I'm least sure about.