Self-hosting Plausible or Umami for analytics

Self-hosting Plausible or Umami for analytics

You can run your own website analytics on a Hostworld VPS using Plausible or Umami. Both give you pageviews, sources and goals without handing data to a third party. The trade is that you give up Google Analytics features tied to Google Ads and BigQuery, but you gain control and can avoid cookies if you configure them that way.

This picks up from a server you can already reach over SSH.

Before you start

• Platform: this guide covers a Hostworld VPS running AlmaLinux 9 or Ubuntu 24.04 LTS. You manage the VPS itself in Virtualizor from your Hostworld client area. You will install and run the apps over SSH.
• Container runtime: both Plausible and Umami publish Docker Compose examples. On Ubuntu 24.04, install Docker Engine and the Docker Compose plugin using Docker’s official instructions. On AlmaLinux 9, Docker is not in the base OS. Either install Docker using Docker’s RHEL guide or the official convenience script, or use Podman with podman‑compose knowing Compose files may need adjustments.
• Memory: Plausible Community Edition stores events in ClickHouse. The community guidance is that 2 GB RAM is comfortable for small to moderate sites. Plan your VPS size accordingly.
• Domain and TLS: you will want an HTTPS endpoint such as analytics.example.com. Put the app behind Nginx or Caddy and enable TLS. Umami’s default is plain HTTP on port 3000; do not expose that directly to the internet.
• Backups: Plausible stores metadata in PostgreSQL and events in ClickHouse. Use pg_dump for PostgreSQL and ClickHouse’s native BACKUP and RESTORE for events. Do not rely only on container snapshots. Umami stores data in PostgreSQL in modern versions; plan proper database backups.
• Data loss safety: running docker compose down -v removes volumes created by the project. If your databases live in those volumes, that deletes your analytics permanently. Take verified backups first.
• Defaults and configuration traps: Umami starts with default credentials of admin/umami if you follow its quick start. Change them on first login. With Plausible, set BASE_URL to your public HTTPS URL. If you serve Umami under a sub‑path, set BASE_PATH and adjust your reverse proxy to match.
• Legal: both projects document cookie‑less operation and state that no consent banner is required. That is vendor guidance. Under UK PECR and UK GDPR you still owe transparency in your privacy notice. If any other tags on your site set cookies or use local storage before consent, a banner is still required for those.
• Licences: Plausible Community Edition is AGPL‑3.0‑or‑later. Umami is MIT. If you plan to redistribute or modify, check those licences.

Step 1: Decide whether self‑hosting is right for you

Be clear on what you gain and what you give up.

• Control and privacy: both Plausible and Umami can collect basic analytics without cookies or personal data. You host the data on your VPS and choose retention. This helps with minimising data and with regulator expectations.
• Limits compared to GA4: Google Analytics 4 integrates with Google Ads and Display & Video 360 for remarketing audiences. It offers demographics and interests reporting, BigQuery export and modelled events. Plausible and Umami do not provide those. If you rely on remarketing audiences or ad network integrations, GA4 is built for that and a privacy‑first self‑hosted tool is not.

Step 2: Choose Plausible or Umami

• Plausible: runs as three services in Docker Compose: the Plausible app, PostgreSQL for metadata and ClickHouse for events. You will configure environment variables including BASE_URL. There is an optional GeoIP updater. Community images are published and you can pin a specific version for reproducible deploys.
• Umami: offers a Docker Compose install that starts on http://localhost:3000. The quick start uses default admin credentials of admin/umami which you must change. Recent releases standardise on PostgreSQL and provide a MySQL to PostgreSQL migration path.
• Ad blockers: both projects document first‑party or proxy options so the tracking file is served from your own domain to reduce blocking.
• Single‑page apps: Plausible auto‑tracks history API routing and provides a hash‑routing mode you must enable if your app uses URL fragments. Umami’s tracker is configurable via data attributes.

Step 3: Prepare a Hostworld VPS

Make sure you have a VPS of the right size in our London or New York locations and that you can SSH in. If you are choosing a plan, start with at least 2 GB RAM if you want Plausible Community Edition.

• If you need a server, see our Linux VPS range.
• For reboots and a VNC console, use Virtualizor from your Hostworld client area.
• Point a subdomain such as analytics.example.com to your VPS. If your domain’s DNS is hosted with Hostworld on cPanel, create the A record in your zone there. If your domain is elsewhere, update DNS at your registrar. If you are moving nameservers to Hostworld shared hosting, they are ns1.serverworld.uk, ns2.serverworld.uk, ns3.serverworld.uk and ns4.serverworld.uk.

Step 4: Install Docker and the Docker Compose plugin

Install the container runtime you will use to run Plausible or Umami. The following installs Docker using the official convenience script, then checks the versions. If you prefer packages, follow Docker’s Ubuntu and RHEL guides instead.

Ubuntu 24.04

This downloads Docker’s official convenience script and runs it to install Docker Engine and CLI.

curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
docker --version

This adds you to the docker group so you can run Docker without sudo. Log out and back in for it to take effect.

sudo usermod -aG docker "$USER"
newgrp docker

This verifies whether the Docker Compose plugin is available. If it is not, install it using Docker’s Linux instructions for the Compose plugin.

docker compose version
# If this errors, follow: https://docs.docker.com/compose/install/linux/

AlmaLinux 9

This downloads Docker’s official convenience script and runs it to install Docker Engine and CLI on a RHEL‑compatible system.

curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
docker --version

This adds you to the docker group so you can run Docker without sudo. Log out and back in for it to take effect.

sudo usermod -aG docker "$USER"
newgrp docker

This checks the Docker Compose plugin. If it is missing, install it per Docker’s RHEL instructions or use the Linux plugin install guide.

docker compose version
# If this errors, follow: https://docs.docker.com/engine/install/rhel/ and https://docs.docker.com/compose/install/linux/

If you choose Podman on AlmaLinux 9 instead of Docker, use podman‑compose and adapt the projects’ Compose files as needed. That is not covered in this guide.

Step 5: Deploy Plausible Community Edition

Next you will create a Compose project for Plausible. You will pin container versions, set environment variables and start the stack.

This creates a working directory for your Plausible stack and changes into it.

mkdir -p ~/plausible && cd ~/plausible

This opens a new Compose file for editing. Paste the example from Plausible’s self‑hosting docs, then adjust it for your domain. Ensure you pin images to a specific tag taken from the Community Edition images page rather than using latest.

nano docker-compose.yml
# Reference: https://plausible.github.io/docs/self-hosting
# Pin images using versions from: https://github.com/plausible/analytics/pkgs/container/community-edition/versions

In your environment, set:

• BASE_URL to your public HTTPS URL, for example https://analytics.example.com. This avoids cross‑origin issues and fixes links in emails.
• Database credentials for PostgreSQL and ClickHouse as documented.
• Any optional features such as the GeoIP updater.

This pulls the images you referenced and starts the stack in the background.

docker compose pull
docker compose up -d

This tails logs from the app so you can watch for errors on first boot.

docker compose logs -f plausible

Put Plausible behind your reverse proxy with TLS. Test that the tracker file is reachable over HTTPS on your analytics domain.

curl -I https://analytics.example.com/js/script.js

Note for existing Plausible users: the tracking script was updated in October 2025 and the data-api attribute was removed. If you previously relied on that for custom events, follow the update guide before deploying.

Step 6: Deploy Umami

If you prefer Umami, the process is similar. You will create a Compose file, set environment variables and run the app behind your reverse proxy.

This creates a working directory for Umami and changes into it.

mkdir -p ~/umami && cd ~/umami

This opens a Compose file for editing. Paste the example from Umami’s install docs and set PostgreSQL as the database as recommended. If you are serving Umami under a sub‑path, set BASE_PATH and make your reverse proxy match. Start it with Compose.

nano docker-compose.yml
# Reference: https://docs.umami.is/docs/install
docker compose up -d
docker compose logs -f

Umami’s quick start runs on http://localhost:3000 and uses default admin credentials of admin/umami. Log in via your reverse proxy on HTTPS and change those credentials immediately.

Before upgrades, check the releases page. Recent notes include minimum Node.js version bumps and security fixes. If you are migrating from an older MySQL install, follow the MySQL to PostgreSQL migration guide provided by Umami.

Step 7: Add the tracking snippet to your site

Once your app is up and reachable on your analytics domain, add the tracker to your website.

Plausible

This loads Plausible’s script from your own analytics domain and declares which site to track. Put it in the head of your pages.

<script defer data-domain="example.com" src="https://analytics.example.com/js/script.js"></script>

• Single‑page apps: Plausible auto‑tracks history API routing. If your SPA uses hash routing, enable the hash‑based tracker as documented.
• First‑party or proxy options: Plausible documents how to serve the script and event endpoint from your own domain to reduce blocking.
• Site‑specific scripts: Plausible can serve per‑site tracker files under /js/{id}.js using the Sites API if you need that.

Umami

This loads Umami’s script from your analytics domain and includes the required website ID. Put it in the head of your pages.

<script defer src="https://analytics.example.com/script.js" data-website-id="YOUR-WEBSITE-ID"></script>

• Configuration: you can add attributes such as data-host-url, data-auto-track, data-auto-pageview and data-domains for stricter tracking scopes.
• Google Tag Manager: GTM strips data‑attributes from script tags. If you install via GTM, add the attributes programmatically as Umami’s docs show.
• Bypass ad blockers: serve the script from a first‑party path as documented to reduce blocking.

Step 8: Verify that data is flowing

Confirm that the tracker is accessible over HTTPS and that the app is receiving events.

This checks that the tracker file answers with HTTP 200.

curl -I https://analytics.example.com/js/script.js   # Plausible
curl -I https://analytics.example.com/script.js      # Umami

This watches the app logs for incoming events in real time.

# Plausible
docker compose logs -f plausible

# Umami
docker compose logs -f umami

If you do not see events, recheck your domain in the snippet, your reverse proxy, Plausible’s BASE_URL, and Umami’s BASE_PATH if used.

Step 9: Plan backups and safe operations

• Plausible backups: use pg_dump for the PostgreSQL metadata database and ClickHouse’s native BACKUP and RESTORE for events. Back up any persistent volumes that Store your databases. Test restoring to a separate instance.
• Umami backups: back up the PostgreSQL database with pg_dump and store the dumps off‑server.
• Compose warnings: avoid docker compose down -v on a live stack. That removes volumes and deletes data. Use docker compose down instead and keep backups.
• Deletions: deleting a site in Plausible or wiping data in Umami is permanent. Export or back up first because there is no built‑in undelete.

Step 10: Meet UK GDPR and PECR requirements

• Consent for cookies: the ICO’s guidance on storage and access technologies explains when consent is needed for cookies and similar technologies. If your analytics tool does not set cookies or use local storage and you avoid personal data, consent for the analytics tracker itself may not be needed. You still owe transparency in your privacy notice.
• Transparency: update your privacy notice to describe what you collect, who operates the analytics (you, on your VPS), retention, and how to opt out where applicable. This is required under the UK GDPR right to be informed.
• Scope and purpose: EDPB statements emphasise that any audience measurement derogation is narrow. It is meant for low‑level analytics for the site operator. If you expand scope into profiling or marketing, consent is required.
• France: CNIL describes a consent exemption for audience‑measurement cookies under strict conditions. Many major analytics offerings do not qualify. Cookieless tools that do not use storage avoid that question.
• Vendor claims: Plausible and Umami describe their collection and state that no consent banner is required. Treat those as helpful, not as a substitute for checking your regulator’s stance.
• Other tags: if you also run ad tags, session replay or anything that sets cookies, those still need consent. A banner may still be required for them even if analytics itself is cookieless.

Step 11: Know the common pitfalls

• Plausible BASE_URL left unset or set to HTTP. This causes cross‑origin problems and broken links. Set it to your public HTTPS URL.
• Umami default credentials left in place. Change admin/umami on first login.
• Single‑page apps with hash routing tracked in Plausible without enabling the hash tracker. Turn on the hash‑based tracker if your SPA uses fragments.
• Serving Umami under a sub‑path without setting BASE_PATH and adjusting your reverse proxy. Fix both sides.
• Exposing Umami’s HTTP port 3000 to the internet. Put it behind Nginx or Caddy and enable TLS.
• Installing Umami via Google Tag Manager without adding data‑attributes programmatically. GTM strips them and tracking breaks.

What next

If you need a server to run this, pick a plan from our Linux VPS range. For more system administration topics, see our VPS guides.

If you would like us to check a network or reinstall issue on your Hostworld VPS, open a support ticket.

Next step in the playbook: put your analytics app behind Nginx or Caddy with HTTPS, then add the tracker to your production site and validate events with your browser’s developer tools.