Understand your visitors and where they go

What is sent outside your site

Your WordPress database holds settings, service addresses, site and account identifiers, the site secret token, account email and connection timestamp. First-Party Delivery also stores generated path and file names and, on sites set up by DevDome, a relay credential. Temporary caches hold connection, bot-count, plan and rate-limit information; rate-limit counters use a hash of the visitor's IP address. There are no custom analytics tables or locally stored analytics events. First-Party Delivery copies the bundled tracking script and bot detector into your uploads folder.

analytics.devdome.com provides the tracking script and receives analytics events once the site is connected and tracking is enabled. Browser events carry the Site ID, Account ID, page URL and path, page title, referring URL, browser, operating system, device type, user agent, browser language, screen size, time zone, country, click target URL, browser automation flag and bot-detector verdict. Click targets on your own site omit the query string. Events include the AI-referrer flag while Track AI Referrals is on, visitor and session IDs when the browser stores them, and site-search terms of up to 200 characters while tracking and click tracking are enabled. Direct browser requests expose the visitor's IP address to the service.

Outbound clicks relayed through /dd-e add the visitor's country code and IP address. With First-Party Delivery enabled, the scripts are served from your domain and tracking events pass through a randomized local path to analytics.devdome.com, authenticated with the site secret token; the relay also adds the visitor's country code and IP address. Known-crawler events sent by your server while Track Bot Visits is on contain the crawler user agent, bot name and type, requested URL and path, Site ID and timestamp.

analytics.devdome.com also handles connection, report and data-management requests. The connection handshake sends the Site ID, secret token, Account ID, site URL and name, administrator email, WordPress, PHP and plugin versions, active theme name, timezone, site language and multisite status. Opening the plugin screen can send a shorter status check with only the Site ID and secret token, at most once every 15 minutes, including before connection. Pressing Connect Via DevDome Account sends the domain, secret token and return admin address to obtain a short-lived link; returning from approval exchanges that link for the Account ID. Stats requests send the Site ID, token and selected day range. First-Party Delivery eligibility checks send the Site ID and token on connected sites. Reset Analytics, or disconnecting with "Also delete my data on DevDome" selected, sends the Site ID and token to the purge endpoint.

api.devdome.com provides account checks and disconnection. Account checks send the domain and secret token and return the Account ID and account email; they begin only after you start or complete a connection or save an Account ID. Connecting through the DevDome Tools dashboard card that discloses plugin sharing also enables transmission of active DevDome plugin slugs and versions, the bundled library version, and WordPress and PHP versions. Existing connections and connections through buttons without that disclosure do not send the plugin list. Disconnecting sends the domain and secret token and stops plugin-list sharing. The bundled bot-protection signature feeds and self-hosted update endpoints are not contacted by this build.

devdome.com serves the DevDome Dashboard plugin catalog, requested at most once every 12 hours with only the bundled core version. Pressing "Report this error" sends the error text, plugin, WordPress and PHP versions, current screen, connection flags and timestamps with secrets masked, site address and administrator email to devdome.com. The browser also visits devdome.com/connect/ when you follow the connection link to sign in and approve access.

With Track Returning Visitors off, outbound-link identifiers remain in memory for the current page. With it on, identifiers use browser storage and up to 50 events interrupted by network failures can be queued in localStorage for the next page load. DevDome uses visitor IP addresses for geolocation and visitor counts; readable visitor IP addresses are not stored on your site. Passwords, WordPress content, registered-user lists, customer, order and payment data are not sent. Visitor form values are not collected except for the site-search terms described above.

How updates work

Updates come from WordPress.org like any other directory plugin; the bundled library's self-hosted update endpoint is disabled in this build.

Uninstalling and your data

Uninstalling removes the scheduled refresh event and generated First-Party Delivery JavaScript files. The relay credential is removed when Delete data on uninstall is enabled. A hidden old plugin folder left by a folder-ownership repair and its fingerprint option can remain; your server administrator can remove the folder. Deleting the plugin does not itself purge hosted analytics: use Reset Analytics or select "Also delete my data on DevDome" when disconnecting. Otherwise, hosted data is deleted after 90 days of inactivity.

If something looks wrong

Your own visits may be excluded: Do Not Track Admins is on by default, new installations exclude administrators and editors, and Respect Do Not Track honours the browser signal. Check these settings and the excluded roles when reviewing missing visits.

Bots can still appear in visitor reports if they are unknown, new or deliberately disguised. The plugin separates detected bots and AI crawlers from human traffic, but it reports crawlers without blocking them.

A returning visitor can count as new the next day while Track Returning Visitors is off because the service uses an identifier that changes daily. Enabling the setting recognises visitors across days using browser storage and may require consent.

On multisite, connect each site from its own Analytics screen. Subdomain and mapped-domain sites have separate Site IDs and reports. Subdirectory sites share the main domain, Site ID, secret token and report; connecting or disconnecting there requires a network administrator.