29,001 stars sit behind a deliberately small analytics view
Plausible Analytics had 29,001 GitHub stars and a last push on September 10, 2026. The product counts page views and events, then reports sources, campaigns, locations, devices, goals, and live traffic without building the interface around individual visitor profiles. Its browser script avoids cookies and persistent identifiers. For a site owner who wants to answer which pages and campaigns worked, the dashboard is easier to reason about than a general marketing data warehouse.
There are two products under the name. Plausible Cloud is the paid service, with the company handling hosting, updates, backups, and support. Community Edition gives you the open server and direct access to raw ClickHouse data, while leaving infrastructure ownership with you. The repository we measured contained 2,057 files, about 51,445 source lines, and 20.1 MB of checked-out code. This is an established application with a meaningful operating surface.
Community Edition needs PostgreSQL and ClickHouse
Plausible Community Edition v3.2.1 is deployed from a separate repository using Docker Compose. Its guide requires a BASE_URL, a secret of at least 64 bytes, and port configuration. Public use adds DNS and TLS. The host CPU needs SSE 4.2 or NEON for ClickHouse, and the guide recommends at least 2 GB of RAM. Those are reasonable server requirements, though they are far beyond dropping a tracking script into a page.
Contributing to the main application is more involved. The guide calls for Docker, Elixir, Erlang, and Node.js, then starts PostgreSQL and ClickHouse before fetching server and frontend dependencies, migrating both databases, building tracker assets, and downloading a country database. Our 20.1 MB checkout measurement does not include those running services or their stored data. A local contributor should expect a complete application stack, not one npm project.
What happened when we ran it
Our sandbox entered ./e2e and installed 117 npm packages in 11 seconds. That dependency tree occupied 89 MB. The project had no build script or target, so the build step was skipped. npm audit reported 0 known vulnerabilities at critical, high, moderate, and low severity. The measurement setup used commit 3a0cc64, 3 CPUs, 8 GB of RAM, the lab-node:22 image, no secrets, and an unprivileged container.
Playwright tests failed with exit code 1 after 8 seconds. The useful part of the log is short: npx playwright test ended with TypeError: Invalid URL. It did not name the missing or malformed value, so blaming a particular environment variable would be guesswork. We can only say the end-to-end target did not start successfully in the stated fresh environment. The scan also found 14 CI workflow files, no Dockerfile, and a tests directory.
Privacy claims still leave the operator responsible
Plausible's v3.2.1 README says it stores no personal data or IP addresses and uses no cookies or persistent identifiers. That design can reduce consent-banner and data-minimization work, but legal fit depends on your site, events, integrations, and hosting choices. Community Edition lets you choose any server country. Plausible Cloud says visitor data stays on infrastructure owned by European providers in the EU. Buyers should verify those policies against their own obligations rather than treating a product label as legal advice.
Licensing also deserves attention. The server is AGPLv3 or later, while the JavaScript tracker embedded on customer sites has an MIT license. A company modifying the server over a network should review what the AGPL requires for its changes. The 0-vulnerability npm audit from our run applies only to the 117-package end-to-end dependency set. It does not clear the Elixir application, containers, PostgreSQL, ClickHouse, or host operating system.
Community Edition receives two releases per year
The project says Plausible Cloud changes several times a week, while Community Edition follows a long-term schedule with 2 releases per year. CE also omits marketing funnels, ecommerce revenue goals, SSO, and the sites API. Advanced bot filtering and premium support belong to Cloud. These are product boundaries rather than missing documentation. Self-hosting buys infrastructure control and raw database access, but it is not the free equivalent of every paid feature.
Support follows that split. The maintainers direct Community Edition questions to a discussion forum and state that creators offer no troubleshooting guarantee. That matters when 14 CI workflow files in the source repository create an impression of a fully packaged contributor experience. The engineering project is active and well maintained, yet a production CE operator still owns capacity, upgrades, monitoring, backups, and incidents. Paying for Cloud is often the cheaper staffing decision for a small company.
v3.2.1 is the minimum sensible self-hosted release
Release v3.2.1, published May 15, 2026, removed a /storybook endpoint affected by a remote-code-execution vulnerability in earlier v3 releases. Anyone running an affected tag should update or block that endpoint as the release notice directs. An open report from September describes /api/health staying at HTTP 500 for 3 hours after a transient database error during boot, with a specific workaround and separate liveness route. That report is detailed enough to include in a deployment test plan.
The May release date does not indicate an idle project. GitHub recorded a September 10 push, 59 combined issues and pull requests, and fresh work on the UI, funnels, routes, and dependencies. Our 117-package e2e install was painless, but the invalid-URL stop kept the suite from giving us product confidence. Choose Plausible Cloud for low-attention analytics. Choose CE when control of raw data and hosting location justifies two databases and an on-call owner.