Self-hosting Plausible or Umami for analytics

Self-hosting Plausible or Umami for analytics

You can run your own website analytics on a Hostworld VPS using Plausible or Umami. Both give you pageviews, sources and goals without handing data to a third party. The trade is that you give up Google Analytics features tied to Google Ads and BigQuery, but you gain control and can avoid cookies if you configure them that way.

This picks up from a server you can already reach over SSH.

Before you start

• Platform: this guide covers a Hostworld VPS running AlmaLinux 9 or Ubuntu 24.04 LTS. You manage the VPS itself in Virtualizor from your Hostworld client area. You will install and run the apps over SSH.
• Container runtime: both Plausible and Umami publish Docker Compose examples. On Ubuntu 24.04, install Docker Engine and the Docker Compose plugin from Docker's official apt repository, following Docker's Ubuntu install instructions. On AlmaLinux 9, Docker is not in the base OS: follow Docker's RHEL install instructions, which AlmaLinux 9 is compatible with. Podman with podman-compose is an alternative on AlmaLinux, knowing Compose files may need adjustments.
• Memory: Plausible Community Edition stores events in ClickHouse. The community guidance is that 2 GB RAM is comfortable for small to moderate sites. That is community guidance rather than a published minimum specification, so treat it as a starting point and plan your VPS size accordingly.
• Domain and TLS: you will want an HTTPS endpoint such as analytics.example.com. Put the app behind Nginx or Caddy and enable TLS. Umami's default is plain HTTP on port 3000; do not expose that directly to the internet.
• Backups: Plausible stores metadata in PostgreSQL and events in ClickHouse. Use pg_dump for PostgreSQL and ClickHouse's native BACKUP and RESTORE for events. Do not rely only on container snapshots. Umami stores data in PostgreSQL in modern versions; plan proper database backups.
• Data loss safety: running docker compose down -v removes volumes created by the project. If your databases live in those volumes, that deletes your analytics permanently. Take verified backups first.
• Defaults and configuration traps: Umami starts with default credentials of admin/umami if you follow its quick start. Change them on first login. With Plausible, set BASE_URL to your public HTTPS URL. If you serve Umami under a sub-path, set BASE_PATH and adjust your reverse proxy to match.
• Legal: both projects document cookie-less operation and state that no consent banner is required. That is vendor guidance. Under UK PECR and UK GDPR you still owe transparency in your privacy notice. If any other tags on your site set cookies or use local storage before consent, a banner is still required for those.
• Licences: Plausible Community Edition is AGPL-3.0-or-later. Umami is MIT. If you plan to redistribute or modify, check those licences.

Step 1: Decide whether self-hosting is right for you

Be clear on what you gain and what you give up.

• Control and privacy: both Plausible and Umami can collect basic analytics without cookies or personal data. You host the data on your VPS and choose retention.
• Limits compared to GA4: Google Analytics 4 integrates with Google Ads and Display & Video 360 for remarketing audiences. It offers demographics and interests reporting, BigQuery export and modelled events. Plausible and Umami do not provide those. If you rely on remarketing audiences or ad network integrations, GA4 is built for that and a privacy-first self-hosted tool is not.

Step 2: Choose Plausible or Umami

• Plausible: runs as three services in Docker Compose: the Plausible app, PostgreSQL for metadata and ClickHouse for events. You will configure environment variables including BASE_URL. There is an optional GeoIP updater. Community images are published and you can pin a specific version for reproducible deploys.
• Umami: offers a Docker Compose install that starts on http://localhost:3000. The quick start uses default admin credentials of admin/umami which you must change. Recent releases standardise on PostgreSQL and provide a MySQL to PostgreSQL migration path.
• Ad blockers: both projects document first-party or proxy options so the tracking file is served from your own domain to reduce blocking.
• Single-page apps: Plausible auto-tracks history API routing and provides a hash-routing mode you must enable if your app uses URL fragments. Umami's tracker is configurable via data attributes.

Step 3: Prepare a Hostworld VPS

Make sure you have a VPS of the right size in our London or New York locations and that you can SSH in. If you are choosing a plan and you want Plausible Community Edition, the 2 GB RAM figure above is a sensible starting point, remembering it comes from community guidance rather than an official minimum.

• If you need a server, see our Linux VPS range.
• For reboots and a VNC console, use Virtualizor from your Hostworld client area.
• Point a subdomain such as analytics.example.com at your VPS with an A record holding the VPS IP address. If your domain's DNS is hosted with Hostworld on cPanel, create the A record in the zone there. If your DNS is hosted elsewhere, create the same record wherever your zone lives. This is a single record for one subdomain, so there is no need to change anything else about how the domain is hosted.

Step 4: Install Docker and the Docker Compose plugin

Install the container runtime you will use to run Plausible or Umami, using packages from Docker's own repository rather than the convenience script. Docker's install documentation describes the get.docker.com script as intended for testing and development, and says it is not recommended for production. A VPS running your live analytics is production, so take the repository route.

Ubuntu 24.04

Follow Docker's Ubuntu install instructions to add Docker's apt repository and install Docker Engine, the CLI and the Docker Compose plugin as packages. Afterwards, check the Docker and Compose versions, and add your user to the docker group if you would rather not prefix every command with sudo. Group membership only takes effect on a new login session.

AlmaLinux 9

AlmaLinux 9 is RHEL-compatible, so follow Docker's RHEL install instructions to add Docker's repository and install Docker Engine, the CLI and the Compose plugin. Enable and start the Docker service, then check the versions in the same way. Red Hat's own container documentation covers Podman if you would prefer to stay with what ships in the distribution, in which case you will use podman-compose and adapt the projects' Compose files. That route is not covered here.

For the exact commands, in order, on both operating systems, see our how-to on installing Plausible or Umami on a Hostworld VPS.

Step 5: Deploy Plausible Community Edition

The shape of the job is short. Create a working directory for the stack, take the Compose example from Plausible's self-hosting documentation, and pin each image to a specific tag from the Community Edition images page instead of using latest, so a later pull cannot change your version underneath you. Set your environment before you start anything.

• BASE_URL to your public HTTPS URL, for example https://analytics.example.com. This avoids cross-origin issues and fixes links in emails.
• Database credentials for PostgreSQL and ClickHouse as documented.
• Any optional features such as the GeoIP updater.

Then pull the images and start the stack in the background, and watch the logs of the app service on first boot. The service names come from the Compose file you pasted, so read them from that file rather than assuming; docker compose ps lists what is actually running in the project. Finish by putting Plausible behind your reverse proxy with TLS. The click-by-click version, including the Compose file and the log commands, is in our how-to on installing Plausible or Umami on a Hostworld VPS.

Note for existing Plausible users: the tracking script was updated in October 2025 and the data-api attribute was removed. If you previously relied on that for custom events, follow the update guide before deploying.

Step 6: Deploy Umami

If you prefer Umami, the process is similar. Create a working directory, take the Compose example from Umami's install documentation, and use PostgreSQL as the database as recommended. If you are serving Umami under a sub-path, set BASE_PATH and make your reverse proxy match. Start the project in the background and check the logs of the running services, again taking service names from the file in front of you.

Umami's quick start runs on http://localhost:3000 and uses default admin credentials of admin/umami. Log in via your reverse proxy on HTTPS and change those credentials immediately.

Before upgrades, check the releases page. Recent notes include minimum Node.js version bumps and security fixes. If you are migrating from an older MySQL install, follow the MySQL to PostgreSQL migration guide provided by Umami.

Step 7: Add the tracking snippet to your site

Once your app is up and reachable on your analytics domain, add the tracker to your website.

Plausible

This loads Plausible's script from your own analytics domain and declares which site to track. Put it in the head of your pages.

<script defer data-domain="example.com" src="https://analytics.example.com/js/script.js"></script>

• Single-page apps: Plausible auto-tracks history API routing. If your SPA uses hash routing, enable the hash-based tracker as documented.
• First-party or proxy options: Plausible documents how to serve the script and event endpoint from your own domain to reduce blocking.
• Site-specific scripts: Plausible can serve per-site tracker files under /js/{id}.js using the Sites API if you need that.

Umami

This loads Umami's script from your analytics domain and includes the required website ID. Put it in the head of your pages.

<script defer src="https://analytics.example.com/script.js" data-website-id="YOUR-WEBSITE-ID"></script>

• Configuration: you can add attributes such as data-host-url, data-auto-track, data-auto-pageview and data-domains for stricter tracking scopes.
• Google Tag Manager: GTM strips data-attributes from script tags. If you install via GTM, add the attributes programmatically as Umami's docs show.
• Bypass ad blockers: serve the script from a first-party path as documented to reduce blocking.

Step 8: Verify that data is flowing

Two checks tell you most of what you need. First, request the tracker file on your analytics domain over HTTPS and confirm it answers with a 200 rather than a certificate error or a proxy error. Second, load a page on your site and watch the application logs for the incoming event, using the service name from your own Compose file. The dashboard should then show the visit.

If you do not see events, recheck your domain in the snippet, your reverse proxy, Plausible's BASE_URL, and Umami's BASE_PATH if used. The commands for both checks are in our how-to on installing Plausible or Umami on a Hostworld VPS.

Step 9: Plan backups and safe operations

• Plausible backups: use pg_dump for the PostgreSQL metadata database and ClickHouse's native BACKUP and RESTORE for events. Back up any persistent volumes that store your databases. Test restoring to a separate instance.
• Umami backups: back up the PostgreSQL database with pg_dump and store the dumps off-server.
• Compose warnings: avoid docker compose down -v on a live stack. That removes volumes and deletes data. Use docker compose down instead and keep backups.
• Deletions: deleting a site in Plausible or wiping data in Umami is permanent. Export or back up first because there is no built-in undelete.

Step 10: Meet UK GDPR and PECR requirements

• Consent for cookies: the ICO's guidance on storage and access technologies explains when consent is needed for cookies and similar technologies. If your analytics tool does not set cookies or use local storage and you avoid personal data, consent for the analytics tracker itself may not be needed. You still owe transparency in your privacy notice.
• Transparency: update your privacy notice to describe what you collect, who operates the analytics (you, on your VPS), retention, and how to opt out where applicable. This is required under the UK GDPR right to be informed.
• Scope and purpose: EDPB statements emphasise that any audience measurement derogation is narrow. It is meant for low-level analytics for the site operator. If you expand scope into profiling or marketing, consent is required.
• France: CNIL describes a consent exemption for audience-measurement cookies under strict conditions. Many major analytics offerings do not qualify. Cookieless tools that do not use storage avoid that question.
• Vendor claims: Plausible and Umami describe their collection and state that no consent banner is required. Treat those as helpful, not as a substitute for checking your regulator's stance.
• Other tags: if you also run ad tags, session replay or anything that sets cookies, those still need consent. A banner may still be required for them even if analytics itself is cookieless.

Step 11: Know the common pitfalls

• Plausible BASE_URL left unset or set to HTTP. This causes cross-origin problems and broken links. Set it to your public HTTPS URL.
• Umami default credentials left in place. Change admin/umami on first login.
• Single-page apps with hash routing tracked in Plausible without enabling the hash tracker. Turn on the hash-based tracker if your SPA uses fragments.
• Serving Umami under a sub-path without setting BASE_PATH and adjusting your reverse proxy. Fix both sides.
• Exposing Umami's HTTP port 3000 to the internet. Put it behind Nginx or Caddy and enable TLS.
• Installing Umami via Google Tag Manager without adding data-attributes programmatically. GTM strips them and tracking breaks.
• Installing Docker with the convenience script on a production box. Use the repository packages instead.

What next

If you need a server to run this, pick a plan from our Linux VPS range. For the command-by-command version of Steps 4 to 8, see our how-to on installing Plausible or Umami on a Hostworld VPS. For more system administration topics, see our VPS guides.

If you would like us to check a network or reinstall issue on your Hostworld VPS, open a support ticket.

Next step in the playbook: put your analytics app behind Nginx or Caddy with HTTPS, then add the tracker to your production site and validate events with your browser's developer tools.