Matomo
Open-source self-hosted analytics, formerly Piwik
- HQ🇳🇿 New Zealand
- Founded2007
- LicenseGPL-3.0-or-later
- ReferenceRead full review
Two privacy-first web analytics tools, compared side-by-side on the same axes. Data is descriptive — no rankings, no editorial winners.
Open-source self-hosted analytics, formerly Piwik
Privacy-first GA alternative, EU-hosted, simple dashboard
Three concrete frames to decide. Not a winner — a fit check.
You need a real GA4 replacement — not just a pageview counter. Goals, funnels, ecommerce, custom dimensions, server-side container, A/B testing, heatmaps. Everything Google calls a feature, Matomo has a checkbox for.
You can self-host on PHP + MariaDB and your ops team won't blink at a nightly archive cron job. Free for unlimited sites, unlimited events, forever.
Procurement asked for ISO 27001, SOC 2 Type II, HIPAA BAA, or a DPA with a real EU GmbH on the other end. Matomo Cloud (and Piwik PRO, the closed-source fork) deliver all of those — Plausible cannot.
You want a single-screen dashboard that loads in under a second and tells you the three numbers your boss asks about. Anything more is overkill.
Cookie banners are the actual problem you're solving. Plausible drops zero cookies, fingerprints nothing identifiable, and has a public Schrems-II page that survived a German DPA review.
You'd rather pay $9/mo and never think about analytics infrastructure again. SaaS only — no self-host headaches, no archive jobs, no plugin compatibility matrix.
You need product analytics (cohorts, retention, feature flags). That's PostHog or Mixpanel territory — not a privacy-first web tracker.
You're tracking a mobile or desktop app. See our App Analytics directory — Aptabase, TelemetryDeck, or Countly.
You need session replay, heatmaps, AND funnels in one tool under $50/mo. Look at Rybbit or OpenPanel — they bundle the lot, both Matomo and Plausible add-ons cost more piecemeal.
The list price on the vendor's pricing page is not what you'll actually pay. Marketing teams need heatmaps, the agency needs the API tier, the legal team adds a DPA upgrade. Here's what the invoice looks like at 100k pv/mo for a typical B2B SaaS — based on actual published add-on prices, retrieved May 2026.
| Line item | Matomo | Plausible |
|---|---|---|
| Base plan (100k pv) | +$39/mo Cloud Business | +$19/mo Growth |
| Heatmaps & session recordings | +$25/mo Premium plugin add-on | — Not available — use third-party (Hotjar, Microsoft Clarity) |
| Funnels & multi-step goals | Included Included in base | Included Included since v2.0 |
| Stats API access | Included REST API + Reporting API both included | Included Stats API v2 included on Growth+ |
| GA4 importer | Included Included plugin (one-time import) | Included Included since 2024 |
| Roles & multi-user | Included Unlimited users included | +$9/mo +$9/mo for team plan |
| DPA + sub-processor disclosure | Included Included on Cloud Business+ | Included Included on all paid plans |
| All-in monthly | $64/mo Matomo Cloud Business + heatmaps add-on | $28/mo Plausible Growth + team upgrade |
Self-hosting Matomo runs around €10/mo for VPS + DB + backup, but figure 4-6 hours/month of ops time. Self-hosting Plausible (ClickHouse-based) runs higher — €25/mo VPS minimum because ClickHouse needs RAM.
Same fictional B2B SaaS — 80k visitors/mo, 60% from organic Google, 25% from paid LinkedIn, 15% direct + email. CMO wants weekly numbers in Slack by 9 a.m. Monday.
The dashboard is a stack of 12 widgets — visits over time, top pages, channel types, real-time visit log, country map, browsers, OS, device, ecommerce overview, custom variables, and two empty slots you can drag-and-drop new widgets into. It's powerful and busy at the same time.
For the Monday report, you click the 'Goals' tab to see how many demo bookings came from the LinkedIn campaign vs. organic search vs. direct. Goals are configured per-event and Matomo gives you the full attribution chain. You can export the report as CSV, PDF, or schedule it as an email — all built in, no add-on.
Friction points: the UI is dense (Matomo 5 helped, but it's still a step learning curve) and the real-time updates lag 1-2 minutes during traffic spikes if you're on the small Cloud plan.
The dashboard is six numbers and a line chart. That's it. Underneath, you scroll to four panels: Sources, Top Pages, Locations, Browsers. Each can expand to fullscreen.
For the Monday report, you change the date range to '7 days', click on the Sources panel, and see Direct/Google/LinkedIn/Bing already broken out by clicks. UTM-tagged campaigns appear under 'Campaigns' with one click. Goals are set up per-URL or per-event from a settings screen that fits in two scrolls.
Friction points: if your CMO asks 'what was the LTV of users who came from this LinkedIn campaign?', Plausible will not answer that. There's no user profile, no event chain across sessions. You'd export to BigQuery (paid add-on) and join it yourself.
Most comparisons skip this section because it's uncomfortable. iOS 17, Safari ITP, and Chrome's UTM-stripping break a lot of analytics in ways the vendor pages won't admit.
Matomo defaults to cookies but ships a 'cookieless mode' you can flip in the config. Without cookies, Matomo falls back to a config_id heuristic (IP + UA + day-bucket) — same as Plausible. With cookies, Matomo gets cross-day visitor stitching, but Safari users still expire after 7 days under ITP 2.x.
Plausible has been cookieless since launch. Visitor uniqueness is a daily salted hash of (IP + UA + domain). Cross-day stitching is impossible by design — every Safari user counts again tomorrow. This is honest about its limitations; vendor docs explain it on page 1.
iOS 17's Link Tracking Protection strips known tracking params (utm_*, fbclid, gclid, mc_eid) from links opened in Mail and Messages. Matomo reads UTMs server-side, so any param Apple strips before the click never reaches Matomo at all. Self-hosted Matomo with a server-side container can recover some of this; cloud cannot.
Same problem, same severity. Plausible's Campaigns module reads UTMs from the URL Apple already cleaned. The honest answer for both: iOS 17 visitors will increasingly show as Direct/None unless you tag every link with a hashed campaign ID and decode it server-side.
Chrome's third-party cookie phase-out was paused in 2024 but Privacy Sandbox (Topics, Attribution Reporting API) is shipping. Matomo doesn't use third-party cookies — it's all first-party — so the deprecation doesn't break it. Privacy Sandbox integration is on the 2026 roadmap but not shipped.
Plausible doesn't use any cookies, so cookie deprecation is a non-event. Privacy Sandbox is irrelevant to Plausible's model — they don't do cross-site tracking, by design.
Default Matomo is blocked by uBlock Origin (~25-30% of tech audiences) under the EasyPrivacy list. Self-hosted with a custom path (`/m.js` instead of `/matomo.js`) drops blocking to ~5%. Cloud requires a Cloudflare Worker reverse-proxy or accepting the loss.
Default Plausible is blocked by ~15% of tech audiences. The official guide ships an nginx snippet for first-party path (`/js/script.js` + `/api/event`). Once deployed, blocking drops to ~3%. This is a paid customer's responsibility — the guide is good, but it's setup work.
Both Matomo and Plausible ship official GA4 importers. Both have caveats the marketing pages don't list.
What carries: sessions, pageviews, events, UTM source/medium/campaign, conversions tied to defined goals, ecommerce orders (if you used GA4 Enhanced Ecommerce). The importer connects to GA4 Data API and runs in batches; for a mid-size site (500k events/mo) you're looking at 6-12 hours.
What doesn't carry: custom audiences, audience segments built in GA4, predictive metrics (purchase probability, churn), engaged sessions definition (Matomo doesn't share GA4's engagement model). Anything routed via Google Signals stays in GA4 — that's a Google product, not yours.
The honest gotcha: GA4's event model is event-first, sessions are derived. Matomo's model is sessions-first, events attached to a session. The importer flattens GA4 events into Matomo's hierarchy, which works fine for pageview-style events but breaks down for high-cardinality custom events.
What carries: pageviews aggregated by date, source, location, browser, OS. Up to 14 months of historical data (the GA4 retention default).
What doesn't carry: events. At all. Plausible's GA4 importer is pageview-only — if you tracked custom events in GA4 (button clicks, form submits, video plays), they don't make the trip. You re-instrument with Plausible's Custom Events API after migration.
The honest gotcha: the import is one-way and one-shot. There's no dual-running mode. The standard pattern is: install Plausible alongside GA4, run both for 30 days to validate numbers match (they won't — 5-15% gap is normal due to bot filtering and adblock differences), then turn off GA4.
Limits the marketing pages won't list. Each tool has them — knowing which kills the deal saves a migration.
Real-time at scale. The default 'Visits in real-time' widget pulls from the same archive table the daily reports use. On Cloud's small plan (~500k visits/mo), the lag is fine. Above 5M visits/mo on a self-host, you need a separate Redis-backed queue + dedicated worker, or the dashboard times out.
Survive a bus factor for self-host. Matomo's PHP codebase is 17 years old. The community support forum exists, but production self-host with ecommerce + funnels effectively needs an in-house PHP/MySQL ops person who can read a slow query log. If that person leaves, you're hiring or migrating to Cloud.
A truly minimal frontend. The default dashboard shows ~30 metrics on first load. You can hide widgets, but the JS bundle is ~250KB and the SPA has to bootstrap regardless. If you want a 'four numbers and a chart' experience, Matomo isn't it — even with the simplified dashboard.
Cross-session user stitching. Plausible has no concept of a user — only daily-unique visitor hashes. You cannot answer 'what's the LTV of customers who came from LinkedIn last quarter' without exporting to a warehouse and doing the join yourself. By design, but a hard limit.
Server-side / Measurement Protocol parity. Plausible has a server-side events endpoint, but it's POST-and-pray — no idempotency keys, no batch dedup, no auth on the endpoint beyond a domain whitelist. For backend events from a payment webhook, you can fire and forget; for high-volume server-side fanout, you'll lose events.
Compliance shopping. Plausible has GDPR (legitimate interest) and Schrems II posture. Plausible does NOT have SOC 2 Type II, ISO 27001, or HIPAA. If your buyer is a mid-market US company with a legal team, you'll either lose the deal or pick Matomo Cloud Business / Piwik PRO.
Five facts that most often qualify or disqualify a tool early.
| Matomo | Plausible | |
|---|---|---|
| Price floor | $29/mo | $9/mo |
| Free tier | Yes | No |
| Hosting model | SaaS + self-host | SaaS + self-host |
| Data residency | EU | EU |
| Cookieless | No | Yes |
Frameworks claimed and sub-processors disclosed under DPA.
| Framework | Matomo | Plausible |
|---|---|---|
| GDPR | Held | Held |
| CCPA | Held | Held |
| UK PECR | Held | Held |
| SOC 2 Type II | Not held | Not held |
| ISO 27001 | Held | Not held |
| HIPAA | Not held | Not held |
Cheapest published plan from each vendor that covers the listed pageview volume. Retrieved May 1, 2026.
| Traffic | Matomo | Plausible |
|---|---|---|
| 10k pv/mo | $29/moEntry | $9/moStarter |
| 100k pv/mo | $39/mo100k | $19/moStarter |
| 500k pv/mo | Custom — contact sales | $39/moStarter |
| 1M pv/mo | Custom — contact sales | $59/moStarter |
Volumes between tiers follow each vendor's published pricing model. "Custom" indicates the vendor does not publish a price for that volume on their pricing page.
All 38 verified checks across 4 categories.
| Feature | Matomo | Plausible |
|---|---|---|
| Pageviews & visitors | Yes Pageviews + visits + visitors |
Yes Pageviews + unique visitors |
| Live visitor count | Yes Visitors in real-time widget |
Yes Live, ~5s refresh |
| Top pages report | Yes Pages report (drillable) |
Yes By pageviews/visitors |
| Top referrers | Yes Channels report (drillable) |
Yes Source domain breakdown |
| UTM campaign tracking | Yes Full attribution model |
Yes Source/medium/campaign breakdown |
| Country & city breakdown | Yes Country, region, city |
Yes Country, region, city |
| Device, browser, OS | Yes Full device/OS/browser breakdown |
Yes Device, browser, OS |
| Bounce / engagement | Yes Bounce rate |
Yes Bounce rate |
| Time on site | Yes Full session timeline |
Yes Engagement time approximation |
| Custom events | Yes Multi-dimensional events |
Yes All paid plans (Starter $9+) |
| Goals / conversions | Yes Multi-step + revenue tracking |
Yes All paid plans |
| Funnels | Partial Cloud Business+ included; Self-host: $229/yr premium plugin |
Yes $39 Business plan |
| Outbound link tracking | Yes Auto + manual |
Yes Auto-tagged |
| File download tracking | Yes Auto + file-type categorization |
Yes Auto-tagged |
| 404 / error tracking | Yes Plugin |
No Manual events / 404 page hit |
| Feature | Matomo | Plausible |
|---|---|---|
| Cookieless by default | Partial Opt-in mode (one-line JS or admin toggle); cookies on by default |
Yes Daily salt rotates every 24h, then deleted |
| No personal data collected | Partial Configurable; off by default, CNIL mode masks last 2 octets |
Yes IP processed in-memory only, never stored |
| GDPR-compliant out of the box | Partial CNIL exemption (FR); DSK (DE) + Garante (IT) require case-by-case DPA review |
Yes Vendor legal opinion (CNIL-aligned); DE TTDSG/IT Garante stricter |
| Data hosted in EU | Yes AWS Frankfurt EU; InnoCraft (NZ) operates under EU adequacy decision |
Yes Hetzner Falkenstein (DE) + Bunny CDN Slovenia |
| Data hosted in US | Yes US data center option |
No EU-only |
| Self-hostable | Yes Free |
Yes MIT, Docker |
| Open source | Yes GPL |
Yes AGPL Community Edition |
| Data retention period | Configurable Default 180 days raw (CNIL); max 25 mo; aggregated unlimited |
Forever Until account deletion (no auto-purge) |
| Bot & spam filtering | Yes IAB list + custom |
Yes IAB bot list + heuristics |
| Feature | Matomo | Plausible |
|---|---|---|
| Script weight (KB) | 23 ~23 KB gzipped (~218 KB uncompressed); same comparison basis as peers |
Yes gzipped |
| Single-snippet install | Yes Also GTM |
Yes data-domain attribute |
| WordPress plugin | Yes Bundled plugin (full Matomo runs in WP); 100,000+ installs |
Yes Official plugin, 10,000+ active installs |
| Proxy / first-party domain | Yes Configurable proxy/CDN; no native SaaS proxy |
Yes Plausible Proxy via CNAME — bypasses adblockers |
| Public API | Yes Reporting + Tracking + Custom Reports APIs (REST/JSON/XML/CSV) |
Yes Stats + Events |
| Data export (CSV/JSON) | Yes CSV/JSON/XML/RSS |
Yes CSV + Stats API |
| Google Search Console connector | No No native GSC connector; pull via API |
Yes Looker Studio export — Business plan |
| Email digests | Yes Scheduled email reports |
Yes Weekly + monthly |
| Slack / webhook alerts | No No native; via plugin |
Yes Direct integration |
| Public shareable dashboard | Yes Anonymous viewer permission |
Yes Public link, no auth |
| Feature | Matomo | Plausible |
|---|---|---|
| Free tier exists | No 21-day trial only on Cloud; Self-host is free forever |
No 30-day trial |
| Entry price ($/mo) | 29 Cloud Starter (50k hits/mo, 30 sites) |
9 Starter plan, 10k pv/mo, 1 site |
| Price at 100k pageviews | — Business tier — custom pricing |
39 Plausible Business tier (was $19 in 2024) |
| Unlimited sites on entry plan | Yes Cloud: 30 sites on Starter; Self-host: unlimited |
No Starter ($9) = 1 site; Growth ($14) = 3 sites; Business ($39) = unlimited |
Factual answers to the questions readers most often ask about this pair.
Yes, if you self-host. Matomo On-Premise is GPL-licensed and the core analytics platform — pageviews, goals, multi-site, segments, GA4 import — runs without any vendor fee. The actual cost shows up in three places: the server itself (a small VPS at $5-15/month is fine for under 500k pageviews), the time to install PHP, MariaDB, the geoip database, and the archive cron, and any premium plugins you want to add. Heatmaps, session recording, A/B testing, and form analytics are paid plugins that cost roughly $99-$199 per year each, even on self-host. If you stick to the free plugins, expect $10-20/month all-in for a small site. Matomo Cloud, by contrast, starts at $19/month and includes the premium plugins on most tiers.
No, and the team has been explicit that heatmaps will not ship as a Plausible feature. The reasoning is structural: heatmap and session replay tools record user interactions and DOM state, which conflicts with Plausible's no-cookies, no-personal-data architecture and would force a cookie banner back into the product. The recommended setup if you need heatmaps is to bolt on a separate tool — Hotjar, Microsoft Clarity (free), or PostHog — and accept that heatmap tool runs its own consent flow while Plausible handles the privacy-clean traffic numbers. Matomo's built-in heatmap plugin is the alternative if you want both inside one product, but you trade the cookieless default for that consolidation.
Matomo's GA4 importer is the more thorough of the two. It pulls historical pageviews, sessions, events, custom dimensions, goals, and ecommerce data through the GA4 Data API and reconstructs them inside Matomo's schema, so reports stretch backwards through your GA4 history. Plausible's GA4 import is intentionally lighter — it brings in pageviews, top pages, top sources, and country breakdowns, but does not attempt to recreate GA4's full event model because Plausible's schema is simpler. If you need to keep historical funnel and conversion data continuous across the migration, Matomo handles it. If you are content to start a clean baseline on Plausible and reference GA4 read-only for old data, Plausible's lighter import is enough.
Plausible is cookieless out of the box: install the script tag, you are done, no cookie banner needed under GDPR or PECR (verify with your DPO, but the architecture supports the claim). Matomo requires three configuration steps to reach the same posture. First, in Settings → Privacy, enable 'Anonymize visitors' IP addresses' and mask at least 2 octets. Second, switch the visitor heuristic from 'cookies' to 'ConfigID without cookies' in the same panel. Third, in your tracking snippet add `_paq.push(['disableCookies']);` before the trackPageView call. After those three changes, Matomo passes the same compliance tests Plausible passes by default. The flexibility is the cost: if anyone on your team reverts a setting, the cookie banner requirement comes back and you may not notice for months.
Plausible has the smaller surface area but the heavier stack. The runtime is one Elixir release behind a load balancer, plus PostgreSQL for app data and Clickhouse for events. Once it is running, there are few moving parts and upgrades are usually a Docker image bump. The catch is Clickhouse: if you have never operated it, the first time you need to debug a slow query or restore a snapshot is going to cost a day. Matomo's stack is more familiar — PHP, MariaDB, nginx — and almost any hosting provider can run it, but the maintenance work is steadier: PHP version bumps every 18 months, the archive cron needs monitoring, and the plugin ecosystem occasionally ships an update that breaks a report. Net: Plausible is easier in steady state, Matomo is easier to recover when something goes wrong.
Matomo, decisively. Matomo was built around the multi-site case: one installation hosts unlimited sites, each with its own tracking ID, its own goals, its own permissions, and a roll-up dashboard at the account level for agency or portfolio owners. Role-based access control is granular — you can give a freelancer access to one site's reports without exposing the rest. Plausible's multi-site model is simpler: each site is a separate entry, the dashboard switches between them, and team-member permissions are coarser. For an agency managing 30+ client sites, Matomo's account model saves real time. For a small business with two or three properties, Plausible's switcher is fine.
More comparisons and reference pages on this site.