Get Started
Visitor Traffic Real Time Statistics pro featured image

Visitor Traffic Real Time Statistics Pro v11.26

Developer: Wp BuyCategory: WordPress PluginsTrusted with 11 downloadsProLatest v11.26Updated 1w ago

Supercharge Your WordPress Site with Real-Time Visitor Stats - No Coding, No Consent Required!

Related items

Related Analytics Plugins

Analytify Pro WordPress Plugin icon

Analytify Pro - Google Analytics Dashboard Plugin For WordPress

by Devin Walker

Google Analytics Was Never This Fun In WordPress!

Monsterinsights Ecommerce Addon icon

Monsterinsights Ecommerce Addon

by MonsterInsights

Truly understanding your audience is crucial for the success of your Ecommerce store.

Monsterinsights Forms Tracking Addon icon

Monsterinsights Forms Tracking Addon

by MonsterInsights

Forms are one of the most important points of interaction on your website.

Supercharge Your WordPress Site with Real-Time Visitor Stats – No Coding, No Consent Required! Visitor Traffic Real-Time Statistics Pro is your all-in-one marketing tool for tracking visitor activity, analyzing content performance, and growing your traffic effortlessly. With just one simple install, you’ll unlock the power to: Track Visitors in Real-Time – See who’s on your site and what they’re doing.

Pinpoint Visitor Locations – Discover where your traffic comes from (country, city, region). Uncover Top Search Engines & Keywords – Find out what’s driving the most traffic. Measure Content Performance – Monitor pages, posts, authors & categories with ease. Access Smart Traffic Reports – View trends daily, weekly & monthly to plan smarter. Stay GDPR-Compliant – Get deep insights without needing user consent.

Filter Out Bots & Noise – Exclude IPs, bots, and irrelevant data for clean reporting. Use Shortcodes Anywhere – Display traffic stats wherever you want. Why Choose Us? Just accurate, real-time insights that help you understand your audience, monitor site performance, and make informed decisions to manage and improve your website more effectively.

Recent releases

Release history

View all 15 versions
v11.26LatestVerified Safe
Oct 19, 20263.1 MB
Fixed
  • search engine and referral visits were counted twice for every new visit, and once more on every reload of an already-recorded page. Each visit is now counted once.
Other
  • Stronger bot filtering: crawlers and automated browsers that run JavaScript but do not call themselves "bot" (GoogleOther, Google-InspectionTool, Chrome-Lighthouse, HeadlessChrome, Puppeteer/Playwright/Selenium, uptime monitors, HTTP libraries, AI crawlers...) are no longer counted. Both the real request User-Agent and the one reported by the page are checked, and automated browsers (navigator.webdriver) are ignored. Real visitors on CUBOT phones are counted again.
  • Pages prerendered by the browser are only counted when the visitor actually opens them. Chrome prerenders top Google results, which was inflating "search engine visits".
  • Accurate time on site: engaged time is measured in the browser (visible tab + recent interaction) and reported per page view. It replaces the Heartbeat-based duration, which kept counting for idle/background tabs and measured the first-to-last request of an IP over the whole day. Single-page visits are part of the average. Visits recorded before 11.26 show "-" instead of an invented value. The "Engaged" journey filter and the duration sort use the new value.
  • "Online now" is kept up to date by a lightweight report every 60 seconds while the visitor's tab is visible (background tabs no longer count as online).
  • Clearer traffic sources: each visit is counted once, under the source of its first page (Organic Search, Direct, Referral, Social Media, UTM Traffic). Google visits now appear under Organic Search, and Gmail, Google Docs, Translate and similar links are no longer counted as search engine visits.
  • Security: the visitor IP is now strictly validated before it is stored (forged X-Real-IP / X-Forwarded-For headers could store arbitrary text). The Heartbeat receiver that trusted an IP sent by the browser was removed.
  • More accurate countries: the visitor IP is taken from Cloudflare/CDN headers first, internal proxy addresses are skipped, "IP:port" values are understood, the city is no longer borrowed from a different country, and the location cache now expires after 30 days.
  • Visitors whose IP cannot be determined are no longer counted as a new visitor on every page view.
  • Performance: database schema checks (including ALTER TABLE statements) no longer run on every request, only once after an update. The front end no longer loads jQuery and WordPress Heartbeat for visitors, and the visitor IP is no longer printed into the page HTML.
Sep 27, 20262.9 MB
View changelog
* Security: fixed an unauthenticated stored XSS vulnerability via the "page_title" parameter of the visitor-tracking endpoint (ahcpro_track_visitor). A crafted page title could be stored in the title-traffic table and execute in the admin dashboard when the "Traffic by Title" table was loaded. Page titles, user agents and referers are now stripped of any HTML on storage (both in the AJAX handler and in the hit counter itself), and page titles and links are escaped on output, so payloads stored by older versions can no longer execute either. The Excel export keeps clean, readable titles. * Security: fixed reflected XSS in the dashboard date-range search fields, which echoed submitted values back into the page without escaping. * Security: hardened output escaping in the "Latest Search Words" block and in the mobile-app REST API (page titles, keywords and referers are no longer returned with markup). * Hardening: admin redirects now use wp_safe_redirect(), and the database index upgrade routine validates table/index identifiers before running.
Sep 9, 20262.9 MB
View changelog
* Security: fixed a stored XSS vulnerability in the search-keywords path of the visitor-tracking endpoint. An unauthenticated visitor could submit a crafted "referer" (e.g. a search-engine URL whose query string contained a percent-encoded HTML payload) that survived URL sanitization, was decoded back to markup, stored in the keywords table, and executed in the admin dashboard when viewing the Latest Search Words / keywords report. Extracted keywords are now stripped of any HTML on storage and escaped on output (URL via esc_url, text via esc_html), in both the table view and the Excel export. This completes the 11.19 tracking-endpoint hardening by closing the sibling "referer" parameter.

Frequently asked questions

Is Visitor Traffic Real Time Statistics pro GPL licensed?
Yes, Visitor Traffic Real Time Statistics pro is distributed under the GNU General Public License (GPL). You can legally use, modify, and redistribute it on unlimited websites.
What is the latest version of Visitor Traffic Real Time Statistics pro?
The latest version of Visitor Traffic Real Time Statistics pro on GPLCoffee is v11.26 (released Oct 19, 2026, 3.1 MB download size). Every new release is synced automatically, and subscribers can update directly from their WordPress dashboard with the one-click connector plugin.
How much does Visitor Traffic Real Time Statistics pro cost on GPLCoffee?
Visitor Traffic Real Time Statistics pro is available for $5.99 for a 1-year license or $15.99 for a lifetime license. Membership plans also include credit-based access so you can download Visitor Traffic Real Time Statistics pro along with thousands of other plugins, themes, and PHP scripts for a single subscription.
Which WordPress versions does Visitor Traffic Real Time Statistics pro support?
The current release of Visitor Traffic Real Time Statistics pro requires WordPress 3.0.1 or higher, tested up to WordPress 7.0. Per-release compatibility details are listed in the version history.
Is Visitor Traffic Real Time Statistics pro safe to download?
Yes. The latest release of Visitor Traffic Real Time Statistics pro (v11.26) was scanned with VirusTotal and came back clean. Scan results are visible on each version page, and releases flagged as malicious are blocked from the catalog.

Auto-updates included

Install it once, update automatically.

The GPLC Connector installs this plugin from your wp-admin and rolls out new versions to your connected sites. Included with every membership plan: 10 to 40 connected sites depending on the plan (Lite 10, Pro 20, Geek and Lifetime 40).