PHP server and first-party tracker, both yours to host
Open Web Analytics (OWA) is an open source web analytics package, written in PHP, that you run on your own server. Its README pitches it as an alternative to commercial tools such as Google Analytics, for people who want to keep control of the data they collect. The repository holds the server, which stores data in MySQL and renders the reports, and a first-party JavaScript tracker for your pages. WordPress sites get an official plugin; PHP applications get an SDK.
Like Matomo, OWA is a PHP application backed by MySQL, but its click heatmaps and session recordings ship in the GPL core, while Matomo sells them as a paid plugin. PostHog records sessions too, but its self-hosted edition runs on Docker Compose, on a host PostHog sizes at 4 vCPUs and 16 GB of RAM.
The comparison of self-hosted web analytics tools sets OWA's release history against Plausible's and PostHog's.
Heatmaps and session replay built into the core
- Click heatmaps and Domstream: the click heatmap and replayable session recordings (Domstream) come with the server, with no add-on to install.
- Custom reports: since 1.13.0, users can assemble their own reports from the same pieces as the built-in ones, and 1.14.0 lets them share those reports with other accounts.
- First-touch acquisition: 1.14.0 stores the source, medium, campaign, ad and search terms of each new visitor's first visit, and later campaigns never overwrite them.
- One instance, many sites: a single server tracks an unlimited number of sites, with several user accounts.
- Date-partitioned tables: since 1.11.0, purging old data means dropping a partition rather than running a
DELETEover millions of rows.
Year-long cookie, releases in bursts, stale plugins
OWA needs PHP, MySQL and a cron job. The requirements are PHP 8.2 or later (tested up to 8.4) with a MySQL driver and mbstring, and MySQL 5.7 or later, MariaDB and Aurora included. Apache 2.x is the documented web server; on nginx, you translate the .htaccess rules yourself. Since 1.11.0, a cron entry runs the job scheduler every minute, so the host must let you run PHP from a shell. The packaged archive attached to each release installs as is; a Git checkout needs Composer and an npm build.
The tracker sets a year-long visitor cookie by default. The owa_v visitor ID lasts 364 days and is rewritten on every pageview. Since 1.14.0, the snippet can shorten that lifetime or turn every cookie into a session cookie. The README ties this to consent exemptions for analytics, the Dutch one among them, which depend on tracking having a small privacy impact.
Releases come in bursts. Nothing shipped between 1.7.8 (January 2023) and 1.7.9 (June 2025). That release and 1.8.0 fixed critical flaws that, in some circumstances, allowed a user's password to be reset without authorization. After 1.8.1 (September 2025), ten releases followed between July 22 and September 21, 2026, from 1.8.2 to 1.14.0.
Upgrades change the database and can break links. Each of the last four releases changes the database schema, migrated with php cli.php cmd=update. Version 1.13.0 moved report URLs without redirects, so old bookmarks return 404. It also prepares a 2.0 branch that will drop the deprecated interfaces listed in UPGRADING.md, which third-party modules, template overrides and custom themes rely on.
The integrations have not kept pace with the server. The official WordPress plugin is at 2.1.5, tested up to WordPress 6.0, and was last updated on December 6, 2022. The MediaWiki extension repository has had no commits since April 2020.