PHP 8.1 and MySQL 8.0 are the starting line
Matomo runs on PHP 8.1 or newer with MySQL 8.0 or MariaDB 10.6 and a PHP database extension. Installation produces a JavaScript tag for each site, and tracking data stays in the operator's database. The product covers visits, campaigns, goals, e-commerce, custom segments, scheduled email reports, geolocation, and a reporting API. That scope makes it a credible replacement for a hosted analytics suite, with the corresponding server duties.
Owning the data is useful only if the organization can own the system around it. A production instance needs HTTPS, database backups, retention choices, user access controls, upgrades, and archiving that keeps reports current as traffic grows. Matomo's current requirements explain the server baseline. The JavaScript snippet is the easy part; operational quality depends on how the PHP application, database, cron work, and reverse proxy are managed.
Version 5.13.0 should come from the release archive
The latest stable GitHub release we fetched was Matomo 5.13.0, published August 16, 2026. Its release note tells operators to use the attached archives for installation or updates. GitHub's automatic source download is meant for developers and requires extra work. That distinction matters because a repository checkout contains development tooling and source that a prepared production package handles differently.
Developers have a DDEV route, but Matomo's DDEV instructions explicitly discourage exposing that environment as a public production installation. DDEV can start the app, run the browser installer, initialize development dependencies, prepare test suites, generate sample visits, and mount plugin checkouts. It also needs DDEV plus a Docker provider, and its local ports can conflict with a Kubernetes router. This is a useful contributor environment, not an operations shortcut.
What happened when we ran it
Our sandbox installed 746 npm packages in 80 seconds at commit 378d443, leaving 310 MB of dependencies on disk. The repository exposed no build script or target, so the build step was skipped. Vitest completed in 48 seconds: 2,229 tests passed, 0 failed, and 9 were skipped out of 2,238. Npm audit reported 0 known vulnerabilities across critical, high, moderate, and low severities.
The checkout was much larger than a front-end package: 17,884 files, roughly 1,035,175 source lines, and 160.1 MB before npm dependencies. Our scan found 21 CI workflow files and a tests directory, with no Dockerfile. The run used a fresh unprivileged Node 22 container with 3 CPUs, 8 GB of RAM, and no secrets. Install and Vitest succeeded without needing service credentials.
Those 2,238 Vitest results do not establish that PHP requests, database migrations, tracking ingestion, scheduled archiving, email delivery, or browser flows work on your infrastructure. We did not start MySQL or MariaDB, install the PHP application, send visits, or run the project's PHP, integration, system, and screenshot suites. The measured result is still useful: the checked JavaScript unit surface passed, and its installed dependency audit was clean. It is one slice of a much larger application.
Privacy control still needs tests against your own policy
Matomo 5.13.0 gives operators control over storage and advertises privacy configuration, but self-hosting does not choose a lawful or appropriate tracking policy for them. Teams still decide which identifiers to collect, whether consent is required, who can inspect visitor detail, how long records remain, and which plugins or reports expose sensitive fields. Those decisions need documentation and tests tied to the organization's actual configuration.
Open issue 25217 describes a precise inconsistency: disabling Visits Log and Visitor Profile removed some identifying segments, while visitId remained registered and usable for segmentation. The report was triaged and had one comment when fetched. Open issue 18675 covers trusted_hosts behind a reverse proxy, where the reporter found Matomo checking the internal container host instead of the forwarded public host. Both deserve targeted regression cases before rollout.
The September 5 push comes with 2,579 open items
GitHub recorded 21,840 stars, 2,579 open issues and pull requests combined, and a last push on September 5, 2026. A queue that large contains feature requests, support-shaped reports, bugs, and code contributions, so it is not a count of defects. Recent issues were being labeled and discussed, and the same-day push plus the August 5.13.0 release show current maintenance. The queue also tells buyers to search for their exact proxy, database, consent, and reporting edge cases.
Matomo earns its place when an organization wants a mature analytics application under its own control and can staff it accordingly. The 80-second npm install and 2,229 passing tests make the front-end checkout approachable, while the million-line repository and multi-service runtime set the true scale. Plausible and Umami are easier comparisons for a narrower analytics brief. GoAccess is the cleaner choice when existing server logs answer the question without client-side tracking.