Counting visits without cookies
In the previous part, I explained how I set up security headers and a content security policy (CSP) to protect the site against common web exploits. With the house locked and the doors secured, a practical question came up: how do I know if anyone is reading my posts without turning the site into a spy on their personal lives?
What I wanted to solve
On October 3, 2026, my personal site went live at rodrigoesporto.com. When you publish articles on the web, you naturally want to know if your writing reaches readers. You want to see which pages draw attention, where visitors come from, and how many views happen each day.
The trouble lies in the standard way people measure traffic online. Most analytics platforms work by placing small tracking files inside the visitor’s browser. Those files follow readers from page to page, build behavioral profiles, and feed advertising networks. Worse, that tracking method forces site owners to put up massive banners on the screen, the annoying popups that block the text and force visitors to click through confusing consent buttons.
I wanted none of that on my site. My personal site does not sell products, displays no ads, and exists solely to share what I am learning for free. I needed a setup that counts visits accurately while completely respecting reader privacy.
I work during the day, and at night and on Sundays I build with AI agents. Looking through the Cloudflare dashboard, I reviewed the available tools and decided to turn on Cloudflare Web Analytics.
I use Cloudflare and pay for my domain there, so I am not writing as an impartial bystander. I am sharing the practical choices I made for my own setup.
Quick summary
- The site started using Cloudflare Web Analytics to measure traffic without saving any files in the reader’s browser.
- Jurídico confirmed that the tool uses no cookies and stores no personal data, which completely eliminates the need for consent banners.
- The strict security policy I configured in the previous step initially blocked the counter script, requiring a specific exception in the CSP rule.
- Analista receives reports from Cloudflare and sends a daily summary of site visits and X metrics at 07:46.
- In the first complete test of the setup, the dashboard recorded 28 page loads during the day, nearly all from my own verification checks.
First: what is a cookie
Before looking at the counter itself, it helps to understand what a cookie actually is. The term has become standard everywhere, but the technical idea is simple.
A cookie is a small text file that a website asks your browser to save on your computer or phone. When you visit that same website again later, your browser sends that file back to the server.
Think of it like a coat check ticket. You hand over your coat at the entrance, receive a numbered plastic token, and walk inside. When you want your coat back, you show the token and the attendant hands you the right coat. The original cookie was designed for helpful tasks like that: keeping you logged into an account or remembering what you put inside a shopping cart.
The coat check analogy works well for logins, but it has a clear limit. The coat check attendant does not follow you down the street to see which other stores you visit.
On the commercial web, cookies began doing exactly that. Companies started placing third-party cookies that stay active while you browse dozens of unrelated websites. They collect clues about what you search for, what you buy, and where you click, piecing together a detailed dossier on your habits. That kind of invasive tracking is why privacy laws started requiring those annoying consent banners on your screen.
What is cookieless web analytics
Cookieless web analytics takes a different approach to counting readers. Instead of attaching a label to a person to follow their steps, the tool only measures the technical request that arrives at the server.
When someone opens a link on my site, their browser asks the server for the page text. The counter records basic facts about that specific moment: which page was requested, what country the request came from, and which basic browser was used.
No file is saved to the visitor’s device. No personal details are gathered, no network addresses are stored, and nothing is kept to identify that same person tomorrow. Once the page loads, the connection ends and the reader moves on without leaving a digital trail behind.
To make sure this setup complied with privacy expectations, I consulted Jurídico. Jurídico answers legal questions in simple language. The agent reviewed the technical documentation for the Cloudflare tool and confirmed the outcome: because there are no cookies and no individual tracking, the site does not need any cookie consent banner. The pages remain clean, fast, and focused on reading.
What I used
- Cloudflare Web Analytics, a free native feature available on the platform where the site runs.
- The domain rodrigoesporto.com, already protected with certificates and security headers.
- Darth: the main bot, which receives any request and routes it to the right agent.
- Jurídico: the agent that reviewed the terms and confirmed the site needs no banners.
- Analista: tracks the X profile and site visits, sending a short daily summary.
I did not need to subscribe to external tracking platforms or pay any extra monthly software fees.
How it went
If you want to apply this approach to your own website, the process follows these steps:
- Open the Cloudflare dashboard and head to the Web Analytics section.
- Select the domain rodrigoesporto.com to enable traffic measurement.
- Copy the lightweight script provided by the platform into your site template, or turn on automatic injection for your pages.
- Save the template and publish the updated site to your server.
- Open the website in a private browsing window to simulate an outside visit.
- Verify that the page loads cleanly, and open the browser developer tools to check that the counter script ran without errors.
- Open the Web Analytics screen in Cloudflare. When everything works, the chart displays your first pageviews within a few minutes.
What went wrong or what I learned
On paper, turning on a visit counter sounds like a two-minute job. In practice, this was where I ran into the most valuable lesson of this phase.
Right after deploying the site with the new counter, I opened the dashboard to watch the first numbers come in. I waited a few minutes, refreshed the screen, and nothing appeared. The counter stayed at zero, as if the site were completely empty.
I opened the site in my browser and brought up the technical inspection console to see what was happening behind the scenes. The console was full of red error messages. The strict CSP (Content Security Policy) rule I had configured in the previous step was doing its job so thoroughly that it blocked Cloudflare’s own analytics script.
Because my security policy told the browser to reject any external script not explicitly whitelisted, the browser followed those orders to the letter. It saw the analytics script trying to send pageview data to Cloudflare’s reporting endpoint and dropped the connection immediately.
The lesson for beginners here is simple: excessive protection can block your own tools as well.
When something on your site suddenly stops working, do not rush to assume the third-party service went down or your code broke. Check your own security rules first.
The fix was quick. I went back to the site’s header configuration and edited the content security policy, adding the official Cloudflare analytics reporting domain to the list of approved sources. Once that specific permission was in place, the browser allowed the connection and statistics started appearing right away.
None of these tools replaces judgment. They shorten the path between “I know what I want” and “it is live.”
Costs and limits
In money, this step cost exactly zero. Cloudflare Web Analytics is free and charges nothing for pageview volume on its standard tier.
In time, the entire setup and fixing the CSP block took less than an hour of work.
There are important boundaries to keep in mind:
- The tool does not tell you who the visitor is or how many times the same individual returned during the week. That is an intentional privacy feature, but anyone building sales funnels or ad retargeting will find it limited.
- The system measures page loads and aggregate visits, providing broad reading trends rather than individual details.
- If a visitor uses a browser configured to block all telemetry scripts or runs aggressive content filters, their page load will not be recorded in the dashboard.
During the first complete test day, the dashboard logged 28 page loads. Almost all of those requests came from my own checks while opening articles, reloading pages, and testing the design.
What I would do differently
If I were starting over, I would map out the need for a traffic counter on the same day I wrote the security headers in the previous part.
By configuring the CSP first without including the analytics endpoint, I created a block that I had to troubleshoot and fix right after. Making a complete list of required services before locking down security saves debugging time.
Who it is for and who it is not for
This setup is ideal for anyone running a blog, personal site, or informational page who wants to understand reader interest cleanly, quickly, and without invading anyone’s personal space.
It is not suited for businesses that rely on deep marketing attribution, ad retargeting, or granular behavioral funnels across the web.
It also does not mean you can walk away from managing the project: Analista receives the metrics and delivers a daily summary every morning at 07:46, letting me see performance without having to log into heavy reporting dashboards.
Closing
Measuring site traffic does not require spying on people. With cookieless analytics, I can follow how articles perform while keeping rodrigoesporto.com fast and completely free of annoying consent banners.
If you run a website and want to track traffic while respecting privacy, this service is worth looking into. To discuss these choices or follow along with upcoming steps, I am on X: @RodrigoesPorto.
In the next part, I will explain how I configured API keys with minimum permissions so Analista can fetch these statistics safely.
Sources and links
- Cloudflare Web Analytics: https://developers.cloudflare.com/web-analytics/
- Legal review on cookies and privacy by Jurídico, October 3, 2026.