@anonymous-matomo-user opened this Issue on March 5th 2009

Piwik statistics can be distortet by copying the JavaScript code to third party sites.
In the "Websites Management" you can add new sites with their URLs. But everybody can copy your JavaScript code to his own site and manipulate your statistics.

Piwik needs to be updated with a function that defines domains that are allowed to be counted.

@anonymous-matomo-user commented on March 5th 2009

This option will only be viewable if you login as an admin? Other users that you just want checking stats should be given different login w/o admin credentials so they cannot go to site management.

View access will not show the javascript code shown to track within the Piwik front end.

@robocoder commented on March 6th 2009 Contributor

Piwik relies on information sent by the browser. Whatever we do on the server, there is some implicit trust that what the client sends is not malicious.

Server side filtering might incur the performance penalty concern raised in ticket #9. Redesignating this ticket as a plugin feature request.

A benefit of the current implementation is that discrepancies in one's stats may help to identity copyvio or malicious activity to be blocked.

@robocoder commented on March 7th 2009 Contributor


  • UI to enter domain name(s) for this site, e.g., example.com, www.example.com, example.subhosting.com, subhosting.com/example/
  • Tracker: Filter out URLs which don't match domain names for this site
  • Tracker: cache the list of URLs in cache/tracker/* array via Common.fetchWebsiteAttributes hook

See also related: #2375

@mattab commented on March 11th 2009 Member

There is now a mechanism that is used to cache site- data in files to be loaded by piwik.php tracker code. That wouldn't add the lookup at tracking time.

on the UI side we already ask for multiple URL alias for the website. we could simply add a checkbox (disabled by default): "Exclude all visits that do not load the Piwik code from one of these URLs".

I agree with vipsoft suggestion of reporting malicious activity, but not in V1.

@mattab commented on January 17th 2011 Member

Also, the http referer should be checked and it should be non empty, and have one of the known domain URL.

@robocoder commented on January 26th 2011 Contributor

The basic check is on the url parameter in the request.

The Referer check has to be separately enabled/disabled to accommodate use cases, such as:

  • when the visited page is https, but the tracker is http (in which case, the Referer is empty)
  • to mitigate undercounting visits when user agents block the Referer via add-on / privacy setting
@mattab commented on August 7th 2012 Member

See related #2375 which may be done at the same time

@gaumondp commented on March 14th 2014

I can't think of a more important feature than this one.

Data integrity is way more important than anything I can think of.


@jasonbukowski commented on March 28th 2014

Agreed. There are several upcoming features/fixes I am looking forward to, but I cant help but ask myself how important new functionality may be when the underlying data is so openly exposed to corruption from any malicious 3rd party.

@anonymous-matomo-user commented on May 21st 2014

How's the status of this issue?
Is it already integrated to the current Piwik or it is still possible for anyone copy and pasting the tracking js code to spam the piwik tracking db?

@anonymous-matomo-user commented on May 28th 2014

I think don't having an option to exclude these spammy 3rd party sites is a major issue.
This option should have been available a long time ago!

It would be really important to have this implemented.

@mattab commented on May 30th 2014 Member

No it is not a major issue. But, there are also 400 other tickets opened or so. If you need this implemented soon, then please consider sponsoring this development.

@mnapoli commented on March 20th 2015 Contributor

There are several things to consider I guess:

  1. prevent a 3rd party to track visits on a 3rd party website:
    • in that case we check that the tracked URL is in the authorized domain list
  2. prevent a 3rd party to track visits on the tracked website: e.g. I could spam the demo to record 1000 fake visits on piwik.org homepage
    • here it's much more difficult because I see no way to differentiate between a normal tracker request and malicious tracker request? The referrer can be faked for example. One way would be to issue a token in piwik.js but we would have to make that token limited in time and unique for each piwik.js. But then again I can visit piwik.org, grab the token and spam demo.piwik.org with fake visits using that token…

I don't see a lot of value in fixing 1 if 2 is not fixed.

@mattab commented on March 20th 2015 Member

there is value in (1) because sometimes it can be simple human error that a wrong tracking code is set (or the wrong idsite) and it records wrong data in the UI. When this happens currently there is no way for users to filter out the traffic, which creates bad data (while it's not their fault). Once fixed it'll be just enabling a per-website setting "Only record data from the website URLs" (disabled by default).

i've noticed that quite a few users have asked for this feature in the forums in the past...

maybe we could release it as an open source plugin on the Marketplace? it would be a nice use case for a plugin that adds a new per-website setting and make this easy for developers (maybe we also wait first for the Admin screen redesign in #7492).

@gaumondp commented on March 20th 2015

@mnapoli maybe for #2 add a maximum actions per visitor value in a certain duration would help ?

Someone using httrack software to download a whole site will get as many hits as you got pages. As a webmaster, I'm not too happy to see +200 actions from a single user in 15 minutes when you have 10 000 pages... But right now I live with it.

I really don't know the complexity behind the general idea but let's be frank, fake visits are nasty.

@barbushin commented on July 8th 2015 Contributor

I read all comments, and I have 2 ideas how we can implement it:

  1. Like this
  2. Or in more compact way

I think the good place for that option is Admin - Manage Websites - Edit Site Form.

Guys, what do you think?

@mattab commented on July 9th 2015 Member

@barbushin we already have the feature to exclude users based on user agents, see Administration > Websites:

user agent exclude

We don't need feature to exclude visits based on referrer.

I think this feature could be simply done as a new checkbox, on a per-website basis, something like this:

new feature

what do you think?


@JonasDoebertin commented on July 9th 2015

@mattab That looks amazing! 👍

@barbushin commented on July 9th 2015 Contributor

@mattab That's nice to keep it simple and easy to use, but what about subdomains?

@mattab commented on July 9th 2015 Member

Good point, I reckon we allow all subdomains automatically as well, and rename the checkboxes/inline help to clarify this Only track visits for actions on any of the website URLs: $URLs_here (and their subdomains)

@barbushin commented on July 9th 2015 Contributor

@mattab And what if somebody just using multiple site instances on one domain, like dev.piwik.com, stage.piwik.com.. and piwik.com for production, and he don't want to setup different Piwik integration options for different environments?

@JonasDoebertin commented on July 9th 2015

@barbushin Isn't it always a good practice to include your tracking code based on your environment? My local, dev or staging sites usually don't load the tracking code at all.

@barbushin commented on July 9th 2015 Contributor

@JonasDoebertin Of course it's not a good practice :) But how we can be sure that everybody are as smart as you?

@mattab commented on July 9th 2015 Member

@barbushin I think for our MVP version we can track all subdomains (to KISS / Keep It Simple & Stupid). If users ask for possibility to "not track" sub-domains, we could re-visit our product vision?

@JonasDoebertin commented on July 9th 2015

@barbushin We can't. But this is something you already had to think about all the time (for nearly any other analytics service, as well).

@barbushin commented on July 9th 2015 Contributor

@mattab Okay, so all we need is to add checkbox Only track visits for actions on any website URLs. But I'm not sure that I clearly understand what does it mean. Is it validation that referer equals to any of listed URLs?

@mattab commented on July 9th 2015 Member

I think the validation should check &url= tracking API parameter (not urlref) and check that this is part of one of the URLs set for this website.

@mattab commented on November 22nd 2015 Member
@tsteur commented on December 7th 2015 Member

I just issued a PR https://github.com/piwik/piwik/pull/9358 to no longer match the subdomain as it was not mentioned in the UI and it was unclear. On the other side if any of these URLs specify a path we will now also check whether the given path is actually present

@ramramra commented on November 19th 2018

Hi All
I am facing issue with matomo user data info .I added multiple user ids in java script and i am trying to lookup for data on particular id But this data coming under singe user id only .Can anyone please help me for this .Here is my added script
_paq.push(['setUserId', 'piwik']);

@tintjose commented on March 21st 2019

Hi All
I am facing issue with matomo user data info .I added multiple user ids in java script and i am trying to lookup for data on particular id But this data coming under singe user id only .Can anyone please help me for this .Here is my added script
_paq.push(['setUserId', 'piwik']);

@ramramra May be a late reply but I think you are hardcoding the setUserId to piwik so it will only output piwik as userId. You should fetch the dynamic userId like email or any name and then use that variable.
For Eg:
var userName= ....
_paq.push(['setUserId', userName]);

Hope this helps!

This Issue was closed on August 26th 2015
Powered by GitHub Issue Mirror