I built a server-side analytics tool. Here's what 19 WordPress sites actually receive.

16 days ago I deployed to live for first time SysWP Radar — server-side analytics for WordPress.

Today's numbers:

• +590K events captured across 19 sites
• +12K AI crawlers identified (GPTBot, ClaudeBot, etc.)
• +82K suspected attack attempts (wp-login probes, exploit signatures)
• 8 accounts (2 paying, both Pro tier)

Why server-side: most analytics (Plausible, GA, GoatCounter) need JS to fire.

If a visitor doesn't execute JS — bot, attacker, crawler — they vanish from reports. Radar combines a pixel for HTML pages with a WordPress plugin that beacons server-side, covering wp-json/, xmlrpc.php, wp-login.php.

Stack: vanilla PHP, no Composer, MariaDB. The plugin is on wp.org.
What worked in 16 days:

• WP.org plugin listing → organic acquisition (1 customer)
• LinkedIn announcement → friends/network (8 sites onboarded)
• Privacy-first positioning (IP anonymization on by default, LGPD/GDPR compliant)

What didn't:

• HN Show HN today got auto-flagged (account too new, lesson learned)
• Cold outreach paused (no time)

Next 14 days: pause on features, push on distribution.
Link: https://radar.syswp.com.br

Genuine feedback welcome.