pushery / matomo-analytics-for-laravel
Privacy-first Matomo analytics for Laravel with cookieless tracking, reports, Web Vitals, batching and bot filtering.
Maintainers
Package info
github.com/pushery/matomo-analytics-for-laravel
pkg:composer/pushery/matomo-analytics-for-laravel
Requires
- php: ^8.4
- ext-json: *
- illuminate/auth: ^12.0 || ^13.0
- illuminate/bus: ^12.0 || ^13.0
- illuminate/cache: ^12.0 || ^13.0
- illuminate/config: ^12.0 || ^13.0
- illuminate/console: ^12.0 || ^13.0
- illuminate/contracts: ^12.0 || ^13.0
- illuminate/cookie: ^12.0 || ^13.0
- illuminate/database: ^12.0 || ^13.0
- illuminate/events: ^12.0 || ^13.0
- illuminate/http: ^12.0 || ^13.0
- illuminate/log: ^12.0 || ^13.0
- illuminate/queue: ^12.0 || ^13.0
- illuminate/redis: ^12.0 || ^13.0
- illuminate/routing: ^12.0 || ^13.0
- illuminate/support: ^12.0 || ^13.0
- illuminate/view: ^12.0 || ^13.0
Requires (Dev)
- larastan/larastan: ^3.0
- laravel/pao: ^1.1
- laravel/pint: ^1.0
- matomo/device-detector: ^6.4
- orchestra/testbench: ^10.0 || ^11.0
- pestphp/pest: ^5.0
- pestphp/pest-plugin-agent: ^5.0
- pestphp/pest-plugin-browser: ^5.0
- pestphp/pest-plugin-laravel: ^5.0
- pestphp/pest-plugin-phpstan: ^5.0
- pestphp/pest-plugin-rector: ^5.0
- pestphp/pest-plugin-type-coverage: ^5.0
- rector/rector: ^2.0
- spaze/phpstan-disallowed-calls: ^4.12
Suggests
- matomo/device-detector: Exhaustive, upstream-maintained bot detection across every category — wire DeviceDetectorBotDetector through the bots.detector config hook.
- matomo/matomo-php-tracker: Use the official server-side Matomo tracker instead of the bundled thin HTTP client
README
Matomo Analytics for Laravel
Privacy-first Matomo tracking for Laravel — client and server, single or batched, with AI-bot detection, env-driven tracking gates, and fail-safe delivery that never blocks your app. Works the same for self-hosted Matomo and Matomo Cloud.
composer require pushery/matomo-analytics-for-laravel php artisan matomo:install
MATOMO_ENABLED=true MATOMO_HOST=https://your-instance.matomo.cloud # or https://analytics.example.com MATOMO_SITE_ID=1
Nothing is tracked until you set MATOMO_ENABLED=true — installing the package
starts no tracking at all. It also stays a no-op while either variable above is
missing, so it is inert in local and CI environments. Verify with
php artisan matomo:test.
Requires PHP 8.4+ and Laravel 12 or 13.
Documentation
Full documentation at docs.pushery.com/matomo-analytics-for-laravel.
- Installation — setup, the connectivity check, and whether you need a token
- Configuration reference — every key, its environment variable and its default
- Server-side tracking — the facade, automatic page views, visitor identity
- Client-side tracking — the Blade snippet, Tag Manager, SPA navigation
- Reporting — read statistics back out of Matomo
What it does
Tracking, server-side. Page views, events, goals, downloads, outlinks, site
search, ecommerce (views, cart updates, orders) and content
impressions/interactions, all through one Matomo facade. Or attach a middleware
and track page views with no per-route code. Custom dimensions, plus a raw
Tracking-API escape hatch for anything the typed hits do not model.
Tracking, client-side. One Blade directive renders the cookieless _paq
snippet — link tracking, heartbeat timer, no-script pixel, CSP nonce support — or
a Matomo Tag Manager container instead. Virtual page views on soft navigation for
Livewire, Inertia and any History-based router. Matomo's native page-performance
report, plus Core Web Vitals (LCP/CLS/INP) as Matomo events.
Delivery that never blocks a response. queue sends a request's hits as one
Bulk request after the response; batch buffers across requests and flushes in
large batches through a database, redis or file buffer; sync sends inline.
A poison batch is dead-lettered rather than blocking the queue, and
matomo:replay puts it back. A load simulator measures your own throughput.
Privacy by default. Cookieless, rotating visitor identifiers. Do-Not-Track
and Sec-GPC honored server-side. URL redaction on out of the box, so secrets and
PII never reach your analytics. Consent postures for a cookie-based setup, a
server-side opt-out cookie, a publishable privacy-policy partial, and GDPR
erase/export through Matomo's PrivacyManager API.
Bots and AI traffic. Bots and AI crawlers are excluded by default, from a curated list that updates itself, with an optional exhaustive backstop. AI assistant referrals need no configuration; on-demand assistant page fetches can be recorded as server-side bot telemetry — no edge worker required.
Reading data back. A cached Reporting API client with curated helpers, a fluent query builder, a segment builder, a named-segment registry, one-round-trip bulk requests, and optional adapters for Matomo's premium plugins.
Built for production. Artisan commands for install, connectivity, flushing, draining, load simulation, replay, reporting, GDPR and annotations. Laravel events for every stage of a hit. Deploy markers on your reports timeline. Octane-safe scoped bindings, and a fake for every facade so tracking is trivial to assert in tests.
Security
Please review the security policy and report vulnerabilities privately rather than opening a public issue.
Built by Pushery
This package is built and maintained by Pushery — a Berlin-based studio building Laravel applications, SaaS products, and open-source tools.
Building a Laravel UI? WireKit, Pushery's open-source Livewire component kit, gives you a polished component library out of the box. Browse the rest of our work at pushery.com.
License
The MIT License (MIT). See LICENSE for details.