Why I Dumped GA4 to Build a 2KB Privacy-First Stats System (and Caught a Fake "Big Tech" Company)

When I launched my side project—a curated directory for webmaster and SEO tools—I did what everyone does: I slapped Google Analytics (GA4) on it.

But within a week, I was frustrated. GA4 felt bloated, it added heavy JS files to my tiny server (2-core, 2GB RAM), and the "bot filtering" was practically non-existent. I was getting hundreds of "visits" a day, but my PayPal account remained empty.

I realized I needed a brutal, no-nonsense way to see exactly who was hitting my site.

So, I deleted GA4 and built my own analytics system from scratch. Here is how it went, and the hilarious trap it helped me uncover.

---

The Architecture: Keep It Dead Simple

I didn't want to spin up a heavy MySQL database just for logging. I wanted something I could read with my own eyes.

I decided to use JSONL (JSON Lines) and a tiny PHP endpoint.

Here is how the data flows:

1. A lightweight JS fetch() on the main site sends a POST request to my stats subdomain.
2. The PHP API receives the data (URL, Referer, User-Agent, IP).
3. The Core Logic: The PHP script regex-matches the User-Agent against a list of known bot strings (googlebot, ahrefs, python, crawl).
4. If it's a bot, it's flagged as is_spider: 1.
5. The data is appended to a daily text file: log_2026-10-30.jsonl.

Here is what a raw log entry looks like:

json
{"time":"15:41:56","ip":"43.128.87.232","country":"France","url":"/pay.php","ref":"","ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X...)","is_spider":0}

The Moment It Paid Off: Catching the "Fake Big Tech"
Because I now have the raw IP and User-Agent, my dashboard separates the noise from the real people.

Yesterday, my stats showed a "Real Human" hitting my /pay.php page. I got excited—someone was actually looking to pay for my premium listing!

But then, I noticed something strange in the logs. A company called "Logipax" submitted their site. Their landing page was incredible. It claimed to be a top-tier passenger transport SaaS operating "Since 1995", complete with a London map background and enterprise pricing.

It looked like a massive, established European company. Why would they submit to a new, tiny directory?

Curiosity got the better of me. I pulled their IP from my JSONL log and ran a quick WHOIS lookup.

The result was hilarious.

The domain logipax.io was registered just 4 days ago.

They had built a highly polished UI, written fake enterprise copy, and spammed every directory on the web to build SEO backlinks. If I had been using GA4, I would have just seen a "session from the UK" and approved them without thinking.

(Insert your screenshot of the WHOIS lookup here)

The Takeaway for Indie Hackers
Building this tiny 2KB system changed how I view web traffic. It's no longer just a number on a chart; it's a real story.

GA4 is overkill for side projects. If you just want to know if real humans are visiting, build your own logger. It's a fun weekend project.

Bots are loud, humans are quiet. 70% of my daily traffic is just Ahrefs and Googlebot. Seeing this visually stopped me from stressing out over "zero traffic."

Data ownership is freedom. I can run custom SQL queries, filter by country, and spot fake traffic instantly, all without paying a monthly SaaS fee.

If you're building something small, don't be afraid to strip things down. The best stack is the one you actually understand.

(If you want to see the final result or find some cool dev tools, you can check out my project here: Site Tools Box.)

Comments

[오피셜메일]

가벼운 수집 구조를 직접 이해하고 운영하려는 접근이 흥미롭습니다. 다만 IP와 User-Agent를 저장한다면 쿠키가 없더라도 보관 기간과 접근 권한을 따로 설명할 필요가 있어 보입니다. 도메인 등록이 최근이라는 사실만으로 사업 이력의 진위를 단정하기보다는, 트래픽 판별과 업체 검증을 별도 항목으로 두면 대시보드를 더 신중하게 해석할 수 있겠네요.