Top Analytics WordPress Plugins
139 indexed plugins
Plugins
139
Active Installs
11m+
Average Score
55
Audited
138
Top Scores
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #51 | Fathom Analytics for WP | 63 | 25 | 15 | 10k+ | Output is not escaped | ||
| #52 | Integrate GA4 Google Analytics | 63 | 33 | 3 | 500 | Text Domain Mismatch | ||
| #53 | Mailster Google Analytics | 63 | 26 | 9 | 900 | Output is not escaped | ||
| #54 | Include Matomo Tracking, by Jonas Hellmann | 62 | 14 | 4 | 500 | Setting is missing a sanitization callback | ||
| #55 | Nimbata Call Tracking | 62 | 13 | 11 | 400 | Non-prefixed function | ||
| #56 | etracker analytics | 59 | 16 | 9 | 1k+ | Exception output is not escaped | ||
| #57 | Fathom Analytics Conversions | 59 | 14 | 47 | 400 | Non-prefixed function | ||
| #58 | Known Agents – Track AI Bots and Crawlers, Block Scrapers, Analyze LLM Referral Traffic | 57 | 37 | 12 | 1k+ | Setting is missing a sanitization callback | ||
| #59 | Universal Google Analytics (GA3 and GA4) | 57 | 28 | 2 | 400 | Output is not escaped | ||
| #60 | Head, Footer and Post Injections | 55 | 9 | 52 | 200k+ | Non-prefixed global variable | ||
| #61 | Analytics Head | 54 | 34 | 7 | 600 | Output is not escaped | ||
| #62 | Simple Blog Stats | 53 | 25 | 76 | 4k+ | Non-prefixed function | ||
| #63 | Skroutz Analytics for WooCommerce | 53 | 57 | 15 | 1k+ | Text Domain Mismatch | ||
| #64 | StoryChief | 51 | 12 | 55 | 1k+ | Input is not sanitized | ||
| #65 | Tiny gtag.js Analytics | 51 | 39 | 0 | 400 | Output is not escaped | ||
| #66 | User Activity Tracking and Log | 50 | 30 | 263 | 2k+ | Non-prefixed global variable | ||
| #67 | Analytics by BestWebSoft – Google Analytics Dashboard and Statistic Plugin for WordPress | 49 | 478 | 176 | 1k+ | Text Domain Mismatch | ||
| #68 | Easy Share Solution For WordPress | 48 | 15 | 33 | 900 | Output is not escaped | ||
| #69 | Mailster Live | 48 | 22 | 37 | 600 | Missing Translators Comment | ||
| #70 | Super Simple Google Analytics | 48 | 55 | 3 | 2k+ | Output is not escaped | ||
| #71 | Simple Matomo Tracking Code | 44 | 23 | 6 | 1k+ | Unsafe printing function | ||
| #72 | ShinyStat Analytics | 43 | 65 | 8 | 1k+ | Output is not escaped | ||
| #73 | utm.codes | 43 | 34 | 33 | 400 | Missing nonce verification | ||
| #74 | Chartbeat | 42 | 33 | 18 | 1k+ | Output is not escaped | ||
| #75 | GA Google Analytics – Connect Google Analytics to WordPress | 42 | 46 | 30 | 400k+ | Output is not escaped | ||
| #76 | Goolytics – Simple Google Analytics | 42 | 37 | 5 | 4k+ | Unsafe printing function | ||
| #77 | Usermaven | 42 | 36 | 77 | 1k+ | Request data is not unslashed | ||
| #78 | Yandex.Metrika | 42 | 15 | 20 | 900 | Unsafe printing function | ||
| #79 | Analytics Germanized for Google Analytics (GDPR / DSGVO) | 40 | 49 | 14 | 7k+ | Output is not escaped | ||
| #80 | heatmap for WordPress – Realtime analytics | 40 | 94 | 15 | 1k+ | Non Singular String Literal Domain | ||
| #81 | Serviceform Pixel | 40 | 18 | 22 | 400 | Output is not escaped | ||
| #82 | Statify Widget | 40 | 52 | 13 | 4k+ | Output is not escaped | ||
| #83 | Traffic Monitor | 39 | 6 | 143 | 1k+ | Direct Query | ||
| #84 | UserHeat Plugin | 39 | 121 | 20 | 6k+ | Non Singular String Literal Domain | ||
| #85 | Yandex Metrica | 39 | 92 | 46 | 20k+ | Output is not escaped | ||
| #86 | Goal Tracker – Custom Event Tracking for GA4 | 38 | 541 | 25 | 2k+ | Output is not escaped | ||
| #87 | CAOS | Host Google Analytics Locally | 38 | 124 | 44 | 10k+ | Output is not escaped | ||
| #88 | SRS Simple Hits Counter | 38 | 43 | 98 | 8k+ | Output is not escaped | ||
| #89 | TopList.cz | 38 | 138 | 7 | 400 | Output is not escaped | ||
| #90 | TWIPLA (Visitor Analytics IO) – Privacy-First Website Stats, Session Recordings, Heatmaps, Polls and Surveys | 38 | 71 | 49 | 900 | Output is not escaped | ||
| #91 | Analytics Spam Blocker | 37 | 76 | 22 | 800 | Unsafe printing function | ||
| #92 | Website Pop-up Builder by BDOW! (formerly Sumo): Pop-ups + forms for email opt-ins and lead generation | 37 | 42 | 33 | 10k+ | Output is not escaped | ||
| #93 | Tracking Script Manager | 37 | 82 | 57 | 2k+ | Non Singular String Literal Domain | ||
| #94 | Lara's Google Analytics (GA4) | 36 | 303 | 57 | 9k+ | Unsafe printing function | ||
| #95 | Analytics Tracker | 35 | 4 | 5 | 1k+ | Hidden files included | ||
| #96 | Aurora Heatmap | 35 | 14 | 18 | 20k+ | Non-prefixed global variable | ||
| #97 | Integrate Umami | 35 | 10 | 0 | 2k+ | Hidden files included | ||
| #98 | OPcache Manager | 35 | 155 | 75 | 1k+ | Output is not escaped | ||
| #99 | Piwik PRO | 35 | 22 | 3 | 3k+ | Output is not escaped | ||
| #100 | Plausible Analytics | 35 | 244 | 61 | 10k+ | Exception output is not escaped |
