How it works
Visits.report is web analytics with one unusual feature: a page you can hand to somebody who does not trust you.
The problem
Every analytics tool answers 'how much traffic do I have'. Almost none answer 'how do I show that to an advertiser, a sponsor, or a buyer in a way they will believe'. A screenshot proves nothing — it is an image. A dashboard invite proves little more, because the account holder controls what is in it. So traffic claims get discounted by default, and the honest sites pay for the dishonest ones.
What we do about it
Three things, in order of how much they actually prove.
Counted by us. Hits land on our servers, not yours. You can stop sending them, but you cannot edit them.
Sealed daily, in a chain. When a day finishes, its three counters are hashed together with the previous day's digest. Change any past number and every digest after it changes too. Anyone who noted an older digest — a sponsor, a buyer, an archive — can show the mismatch. Days are sealed once and never re-sealed, because re-sealing would launder exactly the edit the chain exists to expose.
Domain ownership by DNS. A TXT record on the domain proves the traffic belongs to whoever publishes it. Without it, anybody could create a report claiming any domain they liked, so an unverified page says so prominently rather than quietly.
What it does not prove
That the counters were right at the moment of sealing. We run the collector, so in principle we could seal a wrong number in the first place, and nothing self-hosted can rule that out. What the chain removes is quiet revision after the fact — which is the thing that actually happens when somebody wants last month to look better than it was.
It also says nothing about quality. A visitor is a browser that loaded a page. We drop obvious bots by user-agent and nothing else.
Privacy
No cookies, no local storage, no fingerprinting, no cross-site identifiers. A visitor is a hash of a random daily salt plus the site, the IP and the browser string. The IP is never written to disk. The salt is deleted after two days, and once it is gone those hashes cannot be traced back to an address by anyone, ourselves included. The cost is that we cannot tell you a returning visitor from a new one across days — which is the trade that lets the tag run with no consent banner.
Who runs it
Muddy Holdings LLC. IP geolocation data by DB-IP, used under CC BY 4.0.