MetricPulse: A GDPR-Conscious, Dependency-Free GA4 Dashboard & Heatmap Plugin for WordPress

MetricPulse is an open-source, GDPR-conscious analytics plugin that brings Google Analytics 4 (GA4) reports, local click heatmaps, and statistical anomaly insights straight into your WordPress dashboard. Visitors load a dependency-free tracker under 5 KB, while the heavier interface is served only to logged-in administrators.

Requires WordPress 6.0+ Tested up to WordPress 7.0 PHP 8.1+ GPLv2+ Open Source GA4 Data API

---

Why I built it

GA4 is powerful, but its interface overwhelms most WordPress owners — and the answers to everyday questions ("which page performs best, where does my traffic come from, where do visitors click?") are always a few screens away. So I built a plugin that gathers the answers I actually need in one panel, without sacrificing performance or privacy: MetricPulse.

Key features

📊 GA4 Dashboard

Users, sessions, pageviews, engagement rate and average session duration KPIs, plus a multi-series 7/30-day traffic trend.

🔗 Traffic Acquisition

Source/medium (referrer) breakdown with sessions, users, engagement and key events (conversions) — so you can see which channel brings quality traffic.

🌡️ Local Click Heatmap

See where visitors click, stored in your own database. Contains no PII and is purged automatically after 30 days.

🟢 Realtime

Track your site's pulse with a live active-visitor count and a "last 30 minutes" sparkline.

🧭 Audience & Geography

Top landing pages, top countries, top events, device distribution, and a new-vs-returning visitor split.

🎯 GA4 Event Builder

Define custom GA4 events without writing code by visually selecting buttons or links on the page.

🔒 Privacy first

Click telemetry contains no IP address or personal identifiers — only the page path, the clicked element, and normalized coordinates. The tracker starts in strict opt-in mode by default and waits until consent is granted via Complianz, Borlabs, CookieLawInfo, or Google Consent Mode v2.

Under the hood (for developers)

Authentication uses an RS256-signed JWT generated from the Service Account JSON. To respect GA4's 5-reports-per-batch limit, reports are split into two batches; high-cardinality dimensions are bounded with orderBys + limit, results are cached for 10 minutes, and generation-based cache versioning ensures correct invalidation even behind Redis/Memcached.

Visitors download only a 4 KB dependency-free (vanilla JS) tracker, loaded in the footer, which batches clicks into a single request. The heavy dashboard (ApexCharts) and interface assets load for authorized users only. Assets are versioned with filemtime for safe cache-busting, and fonts are bundled locally — there are no remote Google Fonts requests.

Service Account credentials are encrypted at rest with AES-256-GCM. REST endpoints are protected by capability checks and nonces; the anonymous click endpoint is protected with a cache-safe same-origin check + rate limiting + bot filter. Cron cleanup and IP refresh use genuine atomic locks based on add_option().

Charts are rendered with a locally bundled ApexCharts (no remote CDN). The codebase ships with PSR-4 autoloading, a layered service/repository structure, and a PHPUnit test suite; it supports multisite-aware uninstall and opt-in data deletion. Insights are based on classic mean + standard deviation statistics — not "AI", just honest math.

Technical summary

Platform	WordPress 6.0+ (tested up to 7.0) / PHP 8.1+
License	GPLv2 or later (open source)
Data source	Google Analytics 4 — Data API (Service Account)
Front-end tracker	~4 KB vanilla JS, no jQuery, consent-aware
Heatmap	Local table, no PII, auto-purged after 30 days
Charts	ApexCharts (bundled locally)
Languages	English + Turkish (i18n)

Who is it for?

• Site owners who want core metrics at a glance without GA4's complexity.
• Agencies and freelancers looking for lightweight, privacy-friendly analytics to embed in client sites.
• Content and SEO teams measuring visitor behavior — heatmaps, landing pages, and channel quality.

Frequently asked questions

Yes — it is fully open source under GPLv2+. You can get the source code on GitHub; submission to the WordPress.org plugin directory is in progress.

To use real data you need a GA4 property and a Service Account. However, you can preview the interface and every report with sample data — no connection required — using Demo Mode. The local click heatmap works independently of GA4.

The goal is the opposite. Visitors download only a ~4 KB dependency-free script; heavy dashboard assets load solely for logged-in administrators, and no external requests (such as Google Fonts) are made.

Click data contains no personal information and is stored on your own server. The tracker starts in opt-in mode by default and integrates with popular cookie-consent plugins.

Explore the source, contribute

MetricPulse is open source. Star it, report issues, or contribute.

View on GitHub

MetricPulse is an independent open-source project developed by Rıdvan Bilgin. Google Analytics and GA4 are trademarks of Google LLC; this project is not endorsed by or affiliated with Google.

What are your thoughts on this topic?

Every article is an open conversation. Whether you have a counter-argument, a local example, or a different perspective based on your own experience, your contribution makes this space better.

💡 Feel free to share in the comments:

• Do you agree or disagree with the points mentioned above?

• Are there any specific examples or experiences you can add from your own journey or country?

• What areas do you think could be expanded or improved in this analysis?

➔ Drop your comments, critiques, or insights below. Let's discuss!