Self-hosted Matomo: your analytics on a server that answers only to you

What Matomo needs before you start

Matomo, the project formerly known as Piwik, is a PHP web application that writes every tracked visit into a MySQL or MariaDB database. Any common web server works: Apache, Nginx, IIS or LiteSpeed.

Versions matter here. Matomo's requirements FAQ asks for PHP 8 with MySQL 5.5 or newer, or MariaDB, on Matomo 4.16 and 5, the line you download today. For Matomo 6.0.0, which is in beta, it raises the bar to PHP 8.1 and MySQL 8.0 or MariaDB 10.6. If you install PHP 8.1+ and MariaDB 10.6+ (or MySQL 8.0+) from day one, moving to Matomo 6 will not also mean upgrading your database server.

You will also want a handful of PHP extensions Matomo recommends: gd draws the little graphs, curl, xml and mbstring cover the rest, and the PHP command-line tool runs the background report job you will set up later.

How big a server does your traffic need?

Count page views, not people. Matomo's tiers are counted in monthly page views; its FAQ notes that events and downloads are tracked requests that add load too, as do more websites and more custom segments. Each row below is the tier's minimum recommended configuration, in Matomo's words:

Once you pass a million actions monthly, the same page recommends at least two servers, one of them just for the database, so plan the split before you reach that point. Plan for the database to keep growing too: Matomo's archiving guide says it stores finished days, weeks, months and years as archived reports and does not delete them, which is what keeps old reports instant.

The server that fits

Analytics is a quiet job most of the hour and a heavy one when reports are built, so you want the processor and disks to yourself. A dedicated server means a whole physical computer that runs only your work, with root access, an unmetered port and no contract to sign. Matching it to the table:

• A blog or a small shop: one of the compact cartridge servers, built for one job per machine. Pick one with an NVMe disk, since the database only ever grows.
• A busy site or several sites: an everyday single-processor server, the kind that carries a site and its database side by side. Check the disks: their standard drives are spinning SAS or SATA, so pick solid-state or NVMe drives of 250 GB or more, or take the Xeon D cartridge (16 cores, NVMe storage).
• Millions of page views: two machines, with a two-processor server holding the database. For lots of disk, look at storage servers.

Where the server sits is where your data lives. If it should stay inside the EU, choose Amsterdam or Bucharest (EU servers); all five cities are on our locations page. A ready server reaches you within 30 minutes of the payment being approved.

Up and running in an evening, with nobody racing you to the setup page

Here is the catch with any web installer: the first person to open it chooses the super user, Matomo's one all-powerful account. Matomo 5.2.0 and later close the installer 72 hours after it is first opened, but during those hours anyone who finds the address can use it. So keep the web ports shut, and open the installer over an SSH tunnel only you hold.

1. Turn on the firewall with only SSH allowed, before installing anything that listens on the web. Confirm /etc/default/ufw contains IPV6=yes first, so the same rules guard your IPv6 address.
2. Install Apache, MariaDB and PHP, then unpack Matomo (commands below). Get Matomo only from builds.matomo.org.
3. Make the database and its user at the MariaDB prompt, so the password is never typed as a shell argument where ps and your history file could see it.
4. On your laptop run ssh -L 9000:localhost:80 you@your-server and open http://localhost:9000/matomo/ in your browser.
5. Follow the wizard: system check, database details (host localhost), your super user, your first website. Save that login in a password manager.
6. Now let the world in: run sudo ufw allow 'Apache Full', then point your DNS name at the server and give Apache a TLS certificate.

sudo ufw allow OpenSSH && sudo ufw enable
sudo apt update
sudo apt install apache2 mariadb-server php php-cli php-curl php-gd php-mysql php-xml php-mbstring unzip
sudo mysql_secure_installation
cd /tmp && wget https://builds.matomo.org/matomo.zip && unzip -q matomo.zip
sudo mv /tmp/matomo /var/www/html/matomo
sudo chown -R www-data:www-data /var/www/html/matomo
sudo mysql

CREATE DATABASE matomo;
CREATE USER 'matomo'@'localhost' IDENTIFIED BY 'choose-a-long-password';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, INDEX, DROP, ALTER,
  CREATE TEMPORARY TABLES, LOCK TABLES ON matomo.* TO 'matomo'@'localhost';
EXIT;

Fast reports and a locked front door

Out of the box, Matomo crunches a report at the moment you ask for it. On a site with real traffic that makes the dashboard crawl and sometimes fail. The fix Matomo documents is a cron job that runs core:archive every hour as the same user as the web server (www-data on Ubuntu), plus one setting that stops visits to the dashboard from starting the work.

# Apache, our snippet rather than Matomo's docs: /etc/apache2/conf-available/matomo.conf
# then: sudo a2enconf matomo && sudo systemctl reload apache2
<Directory /var/www/html/matomo>
    AllowOverride All
</Directory>

# Matomo: config/config.ini.php, below the [General] line already there
trusted_hosts[] = "stats.example.com"
force_ssl = 1
browser_archiving_disabled_enforce = 1

# Cron: /etc/cron.d/matomo-archive (make /var/log/matomo first, owned by www-data)
5 * * * * www-data /usr/bin/php /var/www/html/matomo/console core:archive --url=https://stats.example.com/matomo/ > /var/log/matomo/archive.log 2>&1

• Why the Apache block (our addition): Ubuntu's Apache skips .htaccess files under /var/www unless told otherwise, and Matomo relies on its own to keep the tmp and config folders out of reach.
• trusted_hosts: Matomo trusts the hostname used during installation. Our inference is that this is the tunnel's address, so look at the trusted_hosts[] line already in the file and add your real name, or you will see an untrusted-hostname warning. The check exists to block host header injection attacks.
• force_ssl: switch it on only after the https address loads cleanly. It sends every plain-http visit to https, and Matomo warns it can make the site unreachable if TLS is not working yet.
• The cron line: run it once by hand first with sudo -u www-data in front of the php command and look for a clean summary.

Keeping it healthy

Backups. Matomo's FAQ makes the copy with mysqldump in a single transaction. Our suggestion: run it from a small root script on a nightly timer that starts with umask 077, which keeps the dump readable by root alone. MariaDB on Ubuntu lets root in through the local socket, so no password has to appear anywhere. Copy config/config.ini.php as well, because it holds the database password; keep both copies at mode 600, ship them off the server, and practise a restore now and then. For a database over 10 GB the FAQ prefers Percona XtraBackup.

Updates. Matomo shows an alert in Administration when a release is out, and its one-click updater works because www-data owns the files. Doing it by hand instead? Save the config, unpack the fresh zip over the old folder, hand ownership back to www-data (our step, since files you unpack belong to your login), and run core:update from the console, which Matomo prefers for busy servers.

Location data. City and country reports need a geolocation file. Matomo fetches the no-cost City Lite file from DB-IP for you from its Geolocation settings and has an auto-updater for it; MaxMind's GeoIP2 files are the other option, after signing up with MaxMind.

Accounts. Turn on two-factor login for every user, as Matomo's security guide advises, and keep MariaDB answering on 127.0.0.1 only.

Privacy switches, and what is free

Matomo gives you the tools privacy law asks about: masking part of each visitor IP, an opt-out for visitors, tracking without cookies, a screen to find, export or erase one person's data, automatic deletion of old raw logs, and the option to turn off visitor profiles and the visits log. Set them before the tracking code goes live. Whether you need consent is still a question for your own privacy policy.

The Matomo platform is free software, released under GPL version 3 or any later version, and free to download. Extras such as Media Analytics, an Audit Log and Experiments for A/B testing are premium plugins bought on the Matomo Marketplace, and their licences forbid passing them on. Only want a simple visitor count with less to look after? Read our Plausible guide too.

Questions people ask

Does Matomo cost anything if I host it myself?

The software itself costs nothing: Matomo's core is GPL-licensed and stays free to download. You pay for the server, plus any premium plugins you choose from the Matomo Marketplace. Everything this page sets up uses only the free core.

When do I need a second server for the database?

Matomo's FAQ says one machine can be enough up to about a million page views monthly, and advises moving the database to its own server beyond that. Until then, one well-sized server with fast SSD or NVMe storage does both jobs.

The installer says access is blocked. What now?

Since version 5.2.0 Matomo shuts its installer 72 hours after the first visit to it. Open config/config.ini.php, delete the installation_first_accessed line, save, and reload the page. Doing the wizard through your SSH tunnel straight after unpacking avoids the problem.

Why is my Matomo dashboard so slow?

Most likely reports are still being built on demand in your browser. Set up the hourly core:archive cron job as www-data, check that it finishes without errors, and then add browser_archiving_disabled_enforce = 1 to the config. The dashboard then reads finished reports instead of computing them.

Can I keep the analytics data inside the EU?

With Matomo On-Premise the data lives wherever your server is. Rent the server in Amsterdam or Bucharest and the database stays on that machine. Where you copy your backups is up to you.