What stops a copy of Plausible working?

Counting a unique visitor without a cookie is a genuine design problem, and the privacy-preserving answers all involve rotating salted hashes that you must remember to actually rotate. Bot filtering. Roughly a third of raw hits are not people, and an analytics tool that says otherwise is worse than none. Query performance once you have a billion rows. This is a columnar-database problem and the schema decisions are hard to undo. Ad blockers eat your script by default, so the honest version of this needs a proxied or first-party endpoint.

Can AI copy

Plausible

Q: Can AI copy Plausible?

One shot. One prompt, one session, a copy you would actually use. Realistically an afternoon.

Website analytics that fit on one screen and do not follow anyone around.

One shot

They asked for it · AGPL-3.0 — this product open-sources itself or publicly invites clones.

Verdict: One shot
Time to copy: an afternoon
Category: ◱ Analytics
Source: AGPL-3.0

The prompt

Written to be pasted straight into an agent with no editing. It describes the whole job, including the parts that will go wrong.

Build a privacy-first web analytics service. A small script posts pageviews to a collection endpoint; identify unique visitors without cookies by hashing IP, user agent and site with a salt that rotates daily, storing only the hash. Filter known bots by user agent and by behavioural signals. Store events in a columnar database partitioned by day, with pre-aggregated rollups for the dashboard. Dashboard shows visitors, pageviews, bounce rate, top pages, referrers, countries and devices for a selected range, plus custom goals and UTM breakdowns. Serve the collection endpoint from a first-party path so ad blockers do not silently remove your data. Collect no personal data and set no cookies.

Open inClaude ↗Terminal agents take it from the clipboard.

What copies cleanly

The whole thing, and you do not even need to: it is open source and self-hosting is a documented, supported path.
A script that posts a pageview, a table of paths and referrers, and a line chart. That is the product surface.
Goals, funnels, UTM breakdowns and a public dashboard link.

Where it stops

Counting a unique visitor without a cookie is a genuine design problem, and the privacy-preserving answers all involve rotating salted hashes that you must remember to actually rotate.
Bot filtering. Roughly a third of raw hits are not people, and an analytics tool that says otherwise is worse than none.
Query performance once you have a billion rows. This is a columnar-database problem and the schema decisions are hard to undo.
Ad blockers eat your script by default, so the honest version of this needs a proxied or first-party endpoint.

What actually protects them

Almost nothing technical, and they are open about that — the code is public and self-hosting is encouraged.
They sell the not-running-it, and a trustworthy privacy position that a random clone cannot assert credibly.
Being the recommended answer when someone asks how to stop using the big one.

Editor's note

A rare case where the honest verdict and the company's own position agree: yes, you can have it, here is the source. They are selling operations and trust, not software, and they say so on the tin.

Somebody already did it

Go and look at the original

We would rather you formed your own opinion than took ours. They built the thing; we only measured it.

plausible.io ↗