Core features

Privacy-first analytics

Analytics is implemented in development as a first-class Web Fleet subsystem, but it remains optional. Monitoring works without installing a tracker.

Works with remotely hosted sites

The Web Fleet server does not need to run beside the website. A static site on GitHub Pages, Netlify, Cloudflare Pages or ordinary object storage can send events from the visitor's browser to a central Web Fleet instance.

GitHub Pages ─┐
Netlify      ─┤
VPS apps     ─┼──→ Web Fleet analytics endpoint
Nift sites   ─┘             ↓
                         dashboard

Tracker

<script
  defer
  src="https://fleet.example.com/wf.js"
  data-webfleet="YOUR_PROPERTY_KEY">
</script>

The tracker is served at /wf.js on the Web Fleet host. The data-webfleet value is the analytics property key shown when an operator enables analytics for a site. Pageviews are then sent to /api/analytics/event on the same host, so a site hosted on GitHub Pages can track through a central Web Fleet instance.

A custom event API remains deliberately small:

webfleet.track("download", {
  package: "linux-x86_64"
});

Origin and abuse controls

The ingestion endpoint is intentionally public, so it is hardened as an attacker-reachable surface. Browsers sending the tracker must present an Origin matching the analytics property's allowed origin (the site's own origin); requests without an Origin are rejected by default. Non-browser/server-side ingestion is an explicit operator choice and requires WEBFLEET_ANALYTICS_SERVER_SIDE=1. Failed/unknown-property and valid-property traffic are rate limited per client address (bounded in memory; raw IPs are never persisted), event kinds and payloads are shape-validated, and request/body/field sizes are bounded.

Default privacy posture

No cookies required for normal pageview analytics.
No persistent raw IP storage by default; the visitor identity is a salted per-day hash rather than a stored address.
No browser fingerprinting.
Query strings are not reported by the default tracker (only the pathname is sent), so secret-bearing URLs are not collected.
Country/geolocation data is not collected yet. The dashboard reports visitors, pageviews, top pages and sources.
Configurable raw-event retention.
Transparent documentation of every collected field remains a goal; the collected fields are currently the property key, event kind, pathname, referrer, client class and a salted visitor hash.

The useful first dashboard

The goal is not hundreds of charts. A normal site should start with visitors, pageviews, top pages, sources, countries and client classes, then allow deeper filtering when needed.

Keep the boundary

Session replay, invasive fingerprinting, heatmaps and arbitrary user profiling are outside the initial product. Web Fleet should help operators understand websites without trying to reconstruct individual visitors.