HitKeep WordPress Analytics Integration Guide

The HitKeep WordPress plugin adds privacy-first analytics to WordPress without editing your theme, using a tag manager, or adding a second analytics backend. Choose EU Cloud, US Cloud, or a self-hosted HitKeep URL, then the plugin loads the normal cookie-free hk.js tracker for that site.

What the plugin does

The plugin is a thin WordPress adapter around HitKeep’s existing tracker:

WordPress page -> hk.js -> HitKeep /ingest and /ingest/event -> DuckDB

It does not create WordPress analytics tables, set analytics cookies, or send traffic to a third-party CDN. The configured HitKeep instance receives the same pageview and automatic event payloads as the manual snippet: outbound_click, file_download, and form_submit. Optional redirect tracking can also send server-side outbound_click events after WordPress resolves supported short-link or affiliate redirects.

For AI visibility on a WordPress site, treat the plugin as the browser side only. It can record AI-referred human visits, but AI crawler fetches still need server-side forwarding from CloudFront, nginx, Caddy, an app server, or another log source.

HitKeep WordPress setup settings with a self-hosted instance URL, OAuth connection controls, and browser tracking options — Settings → HitKeep before connecting. Choose your hosting option and instance, then use OAuth to authorize a site. The screenshot uses demonstration data.

Install the plugin

Install HitKeep Analytics from WordPress.org in WordPress:

Open Plugins -> Add New Plugin.
Search for HitKeep Analytics.
Install and activate HitKeep Analytics.
Open Settings -> HitKeep.

WordPress plugins screen showing the HitKeep Analytics plugin installed and active — The plugin appears in the normal WordPress plugin list and can be activated, deactivated, or opened from the standard admin workflow.

Configure HitKeep

Choose where your analytics should be sent:

EU Cloud: loads https://cloud.hitkeep.eu/hk.js
US Cloud: loads https://cloud.hitkeep.com/hk.js
Self-hosted or custom domain: loads hk.js from the URL you enter

Use HitKeep Cloud when you want WordPress analytics without managing TLS, upgrades, backups, SMTP, or the HitKeep data directory. Use self-hosted HitKeep when the deployment requirement is to run the single Go binary and keep the embedded DuckDB data under your own infrastructure boundary.

For self-hosted installs, enter the public HitKeep URL:

https://analytics.example.com

If HitKeep is mounted below an existing site, include the path prefix:

https://www.example.net/hitkeep

Do not include /hk.js. The plugin appends that path automatically. If you paste a URL ending in /hk.js, the plugin normalizes it back to the base URL while preserving any path prefix, so https://www.example.net/hitkeep/hk.js becomes https://www.example.net/hitkeep.

For subdirectory installs, the HitKeep instance and reverse proxy must serve hk.js, hk-vitals.js, /ingest, and /ingest/web-vitals under the same prefix. See Public URL path prefixes for the matching HitKeep server configuration.

Use Open configured HitKeep instance from the current tracker card when you want to jump from WordPress to the selected EU Cloud, US Cloud, or self-hosted HitKeep instance.

Add your WordPress domain to your HitKeep instance without a leading www.. HitKeep matches public tracker requests by the browser Origin hostname.

Connect through OAuth

The OAuth-capable plugin needs a HitKeep instance exposing authorization and integration discovery. An older server remains compatible with an existing saved browser/server-ingest connection; upgrading or reactivating the plugin does not delete that connection. A failed or cancelled authorization keeps the previous settings and credential.

Save the selected canonical HitKeep instance, including any self-hosted path prefix.
Choose Connect with HitKeep and complete the normal account login or signup.
Approve the requested sites:read, tracking_domains:read, and ingest:write scopes for one team and explicitly selected sites.
Back in WordPress, select the authorized site and an eligible tracking endpoint, then save.

Real HitKeep OAuth consent screen for the WordPress plugin showing the requested permissions, selected team, and explicitly selected demo site — Review the application and permissions, choose one team, select each allowed site, then authorize.

Both WordPress and HitKeep need public HTTPS URLs for this flow. WordPress publishes a per-installation Client ID Metadata Document, so no bundled client secret or copied API token is needed. Tokens stay server-side and refresh automatically. Explicit disconnect revokes the connection and clears local credentials.

The canonical instance handles authorization, token refresh, discovery, and server-side events. Custom tracking domains are used only for returned tracker assets and browser ingest. OAuth server-side redirect events include the selected site ID; the server also validates the event URL, grant, scope, and current permissions.

Do Not Track and the other tracking switches preserve your saved choices, including switches you turn off. If authorization fails or you cancel it, your existing connection stays in place. If access is later revoked or a refresh cannot complete, connect again and approve the required site permissions.

Defaults

The plugin starts with conservative defaults:

Setting	Default
Logged-in WordPress users	Not tracked
Do Not Track	Respected
Pageviews	Tracked
SPA route changes	Tracked
Outbound link events	Tracked
File download events	Tracked
Form submit events	Tracked
Web Vitals	Not tracked
Redirect link events	Not tracked

Enable Track logged-in WordPress users only if you want editors, admins, or members to appear in analytics.

Tracker options

The WordPress settings map directly to hk.js data attributes:

WordPress setting	Tracker attribute
Collect when the browser sends Do Not Track	`data-collect-dnt="true"`
Disable sendBeacon delivery	`data-disable-beacon="true"`
Disable SPA route tracking	`data-disable-spa-tracking="true"`
Disable outbound link events	`data-disable-outbound-tracking="true"`
Disable file download events	`data-disable-download-tracking="true"`
Disable form submit events	`data-disable-form-tracking="true"`
Enable Web Vitals	`data-enable-web-vitals="true"`

Use these options when a WordPress site needs a narrower tracking surface than the default HitKeep browser tracker.

Automatic event payloads use the same privacy-safe properties as the manual snippet. HitKeep strips query strings and hashes and does not capture link text, form field values, or request bodies.

Web Vitals are opt-in. When enabled, the tracker loads same-origin hk-vitals.js and reports LCP, INP, CLS, FCP, and TTFB without attribution/debug fields.

Redirect and affiliate links

Browser tracking can only see the link the visitor clicked. It cannot know the final affiliate or short-link destination after WordPress resolves a redirect. Enable Track redirect links when you want HitKeep to record supported redirect clicks as outbound links after the target is known.

The current WordPress plugin detects BetterLinks, PrettyLinks, ThirstyAffiliates, and other redirects that call wp_redirect. Same-site redirects are ignored. HitKeep stores the short path and resolved target host/path, with source, referrer, and target query strings stripped before delivery.

Redirect tracking uses HitKeep’s trusted server-side event ingest endpoint. With OAuth, it uses the same selected-site grant automatically and requires current site.manage_data authority. Older plugin/server setups may use a saved site-scoped API client token; that legacy connection remains active until successful OAuth cutover or an explicit disconnect. The token stays server-side and is not printed into public page source.

HitKeep WordPress settings showing an existing legacy connection and server-side redirect tracking controls — Existing legacy connections keep tracking until OAuth setup succeeds or you disconnect. Current versions use OAuth for new connections and do not expose a manual token field.