Clickport vs Cloudflare Web Analytics: The Honest Comparison

Cloudflare Web Analytics is free. It also samples your data, shows the top 15 of everything and nothing else, and counts the same person as multiple visitors every time they re-enter your site from a different source. If you're already proxying through Cloudflare and just want a free pageview counter on a personal site, that trade-off works. For everyone else, it doesn't.

Let's start with where Cloudflare wins

Every comparison article skips this part. They shouldn't. Cloudflare Web Analytics has real strengths that no paid privacy-analytics tool can match, including Clickport. If you need any of these, Cloudflare might be the right tool for you.

If you're running a personal blog on Cloudflare Pages and you want to know whether anyone read your last post, this is the right tool. The rest of this article is for everyone else.

The question most site owners never ask after installing it: does it actually answer my questions?

For most marketing sites, the answer is no. And that's where the trouble starts.

Every chart in the dashboard is an estimate

Cloudflare Web Analytics doesn't store every event. It uses what Cloudflare calls Adaptive Bit Rate sampling, or ABR. The system stores your data at multiple resolutions, and the server picks one based on how much data your query touches.

From Cloudflare's own engineering blog, the company describes ABR as covering "seven orders of magnitude, from 100% to 0.0001%." That sounds technical. Here's what it means: when you load any chart in the Cloudflare Web Analytics dashboard, you may not be looking at your actual data. You're looking at an estimate computed from a small fraction of it.

Sampling at 10% is fine if you have millions of pageviews and you only care about top-line trends. Here's where it bites smaller sites:

The long tail disappears. The five-pageview referral that brought your best customer last quarter? It might be in the data. It might not. The 1% of visits that came from a specific Mastodon instance after one good post? Statistically dropped. Once you're sampling at 10%, anything that happened fewer than ten times in your raw data is now noise.

Clickport doesn't sample. Every event lands in ClickHouse, and every chart you load reads from the full event set. When the dashboard says you got 47 visits from r/selfhosted last week, the answer is 47, not "approximately four to five times whatever we observed."

For a personal site, sampling rarely matters. For anyone making decisions from the data, it's the difference between "we have an answer" and "we have a guess that might be off by 30%."

One person, four visits, four "visitors"

Here's a quirk in how Cloudflare counts visits that's easy to miss until it skews everything else.

Cloudflare defines a "visit" as a successful page view where the HTTP referer doesn't match the hostname of the request. The definition sounds reasonable. It isn't. Because Cloudflare has no visitor identifier (no cookie, no localStorage, no fingerprint), it has no way to know that the same person came back. Every fresh entry from outside counts as a new visit.

Read that twice. One person who enters your site four times today, via Google then Twitter then a newsletter then direct, shows up as four separate visits. Effectively four visitors, since the dashboard never deduplicates within the day.

This isn't a technicality. It changes the shape of every metric on the dashboard. Your visit count inflates whenever someone enters your site more than once in a day from different sources. Your conversion rate is artificially deflated, because the denominator is wrong. Your top sources are skewed, because the same person reading your blog three times today (Google, then Twitter, then email) shows up as three different "visitors" attributed to three different channels. Comparing the numbers to GA4 or anything else makes you think you have a tracking problem when you don't. Cloudflare is just counting differently.

It's not a bug. It's the documented definition.

Clickport dedupes within a day. Same browser, same day, multiple entries via different sources counts as one visitor with multiple visits. The hash combines the visitor's IP and user agent with a salt that rotates at midnight in your reporting timezone. No persistent identifier, no cross-day tracking, no consent banner. The same person tomorrow is a fresh visitor in the dashboard. Every privacy-first tool works this way. The point isn't to follow people across weeks. It's to give you an honest count of who showed up today.

The bots come through anyway

Cloudflare has an "Exclude bots" toggle in the Web Analytics dashboard. It's checked by default. You'd assume that means your data is reasonably bot-free.

Then you check your top pages and the second-most-visited page on your site is wp-login.php. Or xmlrpc.php. Or some /wp-admin/admin-ajax.php URL you've never linked to in your life.

This isn't hypothetical. An independent side-by-side review of CF Web Analytics ran the tool on a real WordPress site and found exactly this pattern: the top operating system was "Unknown," the second-most-visited page was a WordPress login URL, and the visitor count was 18 times higher than what a dedicated privacy-analytics tool reported on the same site over the same period.

Cloudflare's bot exclusion is essentially user-agent string matching against a list of known bots. Anything that doesn't identify itself as Googlebot or bingbot slips through. That includes:

• WordPress login bruteforce attempts (extremely common, often the largest single source of "traffic" on small WP sites)
• xmlrpc and admin-ajax probes
• Headless Chrome instances doing scraping
• Datacenter IPs that any sane bot filter would block on sight
• AI training crawlers that ignore robots.txt
• The growing wave of LLM-driven web agents that look like real browsers

Clickport's bot detection runs across multiple layers: user-agent patterns plus an isbot library fallback, IP and CIDR range matching against datacenter ranges, behavioral signals (no scroll, no mouse, instant exits), spam pattern detection, and explicit AI bot classification. The unit test file alone has 151 cases for it. The result: real sessions in your dashboard, not the noise floor of the open internet.

If your CF dashboard shows wp-login.php in the top five, that's not a quirk of your site. That's what your data actually looks like once you stop user-agent-matching. The question is whether you want to see it.

The data lives behind row 15

Cloudflare's dashboard shows the top 15 entries for every dimension. Top 15 pages. Top 15 referrers. Top 15 countries. Top 15 browsers. There's no pagination, no "show more" link, no export to see what's in row 16.

The user request to lift this cap first appeared on the Cloudflare community forum in September 2022. Cloudflare staff have not publicly responded to it. Three and a half years later, the thread is still open.

For a small site with a handful of traffic sources, 15 rows is fine. For any site beyond that:

• A blog with 200 articles can see traffic to its top 15 posts. The other 185 are invisible.
• A site running paid campaigns across 30 UTM tags can see... well, there's no UTM tracking. We'll come back to that.
• A site that ranks for 500 keywords on Google has access to one row in CF Web Analytics: "Google."
• An e-commerce site with 50 product pages can see the top 15 sellers. The other 35 contribute revenue you can't attribute.

Cloudflare may have lifted the cap and not announced it. The 2025-2026 changelog doesn't mention either way, and we couldn't find a 2025-or-later screenshot to confirm. The original community request remains open and unanswered, and every privacy-analytics competitor's vs-CF page repeats the 15-row claim, which suggests it's still current.

Clickport's tables paginate. The Pages panel shows every page that received a visit. The Sources panel shows every referrer. You can sort, filter, search, and export the full list to CSV.

It's a dashboard, not a leaderboard.

The tracking you came for is missing

If you came to web analytics from Google Analytics or any other dedicated analytics tool, you have a mental model of what "analytics" means. Visits, sources, pages, sure. Also: campaigns, conversions, events, search terms, downloads, outbound clicks, scroll depth, time on page, real-time visitor counts.

Cloudflare Web Analytics has none of those.

The product was designed for a different job. Cloudflare's official framing is that Web Analytics shows "the minimum amount of information needed to understand how their websites perform." That's accurate. It's a real-user-monitoring (RUM) tool with a pageview count attached. It is not a marketing analytics platform.

The asymmetry hits hardest in four scenarios:

Running paid campaigns. You're tagging links with utm_source, utm_medium, utm_campaign. CF Web Analytics ignores all of them. The traffic shows up under the referrer's domain (facebook.com, t.co, linkedin.com) with no breakdown by campaign. You're flying without instruments.

Tracking conversions. Newsletter signups, purchases, contact form submissions, downloads. CF has no goals, no events, no conversions. The closest you get is looking at pageviews of a /thank-you URL, assuming you have one and assuming nobody bookmarks it.

Watching activity in real time. Did the post we just published land? Did the launch tweet drive traffic? CF has no live view, no real-time visitor counter. You'll know in a few hours.

Understanding engagement. Time on page, scroll depth, bounce rate. CF doesn't measure any of them. The Core Web Vitals data tells you how fast your page loaded. It tells you nothing about whether anyone read it.

Clickport tracks all of this in the default install. Goals are configured in the dashboard in about a minute each. Custom events use one line of JavaScript: clickport.track('Newsletter Signup', {plan: 'free'}). The realtime view shows the last 30 minutes with a 30-second auto-refresh. Engagement scoring runs continuously across every page and every source.

You can install Clickport on a personal site and never touch any of it. When you do need it, it's already there.

Cookieless doesn't mean Schrems-free

Let me give Cloudflare credit where it's due. At the data-collection layer, CF Web Analytics is genuinely cleaner than GA4. There are no cookies, no localStorage, no fingerprinting. Cloudflare's stated practice is that visitor IPs are received at the edge, used to derive country, then discarded before the data is stored. There's no advertising integration, no Google Signals equivalent, no cross-site identity stitching. By the standards of free analytics tools, this is a real privacy improvement over GA4.

The legal layer is a separate conversation, and that's where the picture changes.

Cloudflare is a US-headquartered company. Like every other US company, it is subject to FISA Section 702 and the CLOUD Act, the same surveillance laws that triggered the Schrems II ruling against the EU-US Privacy Shield framework in 2020. The reasoning that led seven European data protection authorities to rule Google Analytics illegal between 2022 and 2023 wasn't about cookies. It was about whether US surveillance law gave EU data subjects an unacceptable level of exposure.

Cloudflare sits inside that same legal framework.

There is one DPA decision that has applied Schrems II reasoning to Cloudflare directly: in April 2021, the Portuguese DPA (Deliberação 2021/533) suspended the Portuguese National Statistics Institute's transfers of census data to Cloudflare within 12 hours. The CNPD concluded that Standard Contractual Clauses were insufficient because Cloudflare is subject to US surveillance law.

That ruling was about census data, not Web Analytics. No DPA has issued a Cloudflare Web Analytics-specific decision. The legal reasoning is the same one that struck down GA4 in seven jurisdictions, but applied to this product specifically, it remains untested.

Two practical implications:

There's no EU-residency option for Web Analytics. Cloudflare offers EU data localization through products like Zaraz and the Data Localization Suite, but Web Analytics is not on that list. EU visitor data is processed at the nearest edge (which for EU visitors is in the EU), but the aggregated analytics flows to Cloudflare's global infrastructure.

Cookieless is necessary but not sufficient. GDPR and ePrivacy compliance isn't only about cookies. The processing of an IP address, even briefly, by a US-jurisdictional processor still falls under the Schrems II reasoning. Cloudflare's marketing line that "your site won't need a cookie banner because of us" is technically defensible at the cookie level. At the legal-basis level, opinions differ.

Clickport is hosted in Germany on Hetzner servers in Gunzenhausen. EU-incorporated processor, EU data residency, zero sub-processors that touch visitor analytics data. No US jurisdictional exposure, no Schrems chain to break. When a customer hits your site from Berlin, their data stays in the EU all the way through.

If you're a US company serving US customers, this is irrelevant. If you're an EU site or a US site with EU traffic, it's the single most important difference between the two products.

Features Cloudflare doesn't have

Past the missing fundamentals, Clickport has several features with no Cloudflare equivalent. These aren't "alternatives to features CF has." They're things CF has no version of.

Real-time view

Cloudflare's dashboard doesn't show what's happening on your site right now. You can pick a date range as short as the last 24 hours, but the data is aggregated and lagged. There's no live visitor counter, no auto-refresh.

Clickport's realtime view shows the last 30 minutes of activity with a 30-second auto-refresh. You see who's on the site, what page they're looking at, where they came from, and what country they're in. When you publish something, you watch the wave land in real time.

Engagement score (0-100)

Cloudflare has no engagement metric of any kind. The Core Web Vitals data measures whether your page rendered quickly. It says nothing about whether anyone read it.

Clickport calculates a continuous engagement score from 0 to 100 for every page and every source, combining scroll depth and time on page. The math: average of the scroll percentage and the duration in seconds divided by six. Color-coded: green at 50 or above, amber at 25 to 49, red below 25. You see at a glance which pages and which sources actually engage visitors versus which ones bounce.

Copy detection

When someone selects and copies text from your page, that's one of the strongest signals of content value. They found something worth saving, comparing, or sharing. Clickport captures this automatically: what was copied, from which page, and which session. You can filter sessions by "Copied" to find your most engaged visitors.

No analytics tool in the privacy-first category tracks this. Not Cloudflare. Not Plausible. Not Fathom.

Weekday-aware comparisons

Cloudflare has no comparison logic. You can pick a date range, that's it.

Clickport's KPIs compare against the average of the last four identical weekdays. A Monday is compared to previous Mondays. A Saturday to previous Saturdays. When the KPI says "visitors are up 12%," it means something. Not "it's a weekday instead of a weekend."

Smart bounce rate

Cloudflare has no bounce rate. There's no engagement signal to derive one from.

Clickport requires four criteria before calling a session a bounce: single pageview, no outbound clicks, less than 25% scroll depth, and under 15 seconds on page. A reader who scrolls through your entire article but doesn't click anything? Not a bounce. A visitor who lands, reads for a minute, and leaves satisfied? Not a bounce.

Session drill-down

Cloudflare has no concept of individual sessions. The dashboard is aggregate-only.

Clickport's Sessions panel shows every visitor's full journey on one screen: pages visited, clicks made, forms submitted, goals triggered, what they copied, where they came from. Filter by "Converted," "Bounced," or "Copied" to find exactly the sessions you care about. Two clicks from the dashboard.

16-channel classification including AI Search

Cloudflare lumps everything into a flat referrer list. chatgpt.com shows up alongside google.com and t.co with no further structure.

Clickport classifies traffic into 16 channels: Direct, Display, Paid Search, Paid Social, Paid Video, Paid Shopping, Affiliates, Email, SMS, Audio, Organic Shopping, AI Search, Organic Search, Organic Video, Organic Social, Referral. AI Search rolls up ChatGPT, Perplexity, Gemini, Claude, and Copilot. You see at a glance how much of your traffic comes from LLMs, broken out from organic search.

The honest feature comparison

Here's what actually changes if you switch. No spin.

Cloudflare wins three rows: free pricing, auto-injection on the proxied stack, and the bundled Core Web Vitals data. Real wins, worth keeping if those are the dimensions that matter most for your site. Most other rows go the other way.

If your decision rides on price or CWV, stay on Cloudflare. If it rides on anything else in the table, the gap shows up the first time you need the column.

Who should stay with Cloudflare

I'd rather lose a potential customer to honesty than gain one through omission. Cloudflare Web Analytics is the right call for these scenarios:

Your site is already proxied through Cloudflare and you don't want to add a script tag. The auto-injection feature is genuinely zero-effort. If you're running a personal site or a small SaaS on Cloudflare Pages and you just want to know whether anyone visited, this is the path of least resistance.

You only care about pageviews and Core Web Vitals. No campaigns, no conversion goals, no events, no behavioral data. Just "did people show up and did the page load fast." CF gives you a reasonable answer to both, for free.

Free is the only acceptable price. If €9 a month is outside the budget for the project, the trade-offs in this article don't change the math. Free wins.

You're using CF Pages or Workers as your full hosting stack. The integration is tight enough that having analytics inside the same dashboard adds real convenience. You're not switching tabs, you're not managing another vendor.

If none of those describe you, you're paying for the simplicity by giving up half the picture.

Making the switch

Switching from Cloudflare Web Analytics to Clickport takes about five minutes.

If you have goals to track (signups, purchases, clicks, form submissions), set them up in the dashboard in about a minute each. No developer required.

You can keep Cloudflare Web Analytics enabled alongside Clickport for as long as you want to compare. Most people who do this find the same thing: Clickport shows fewer "visitors" (because it's deduplicating return visits properly) and more pages (because it's not capping at row 15). Looking at the broader field? Our GA alternatives comparison covers Plausible, Fathom, Matomo, and 12 more.

See past the top 15

Every Cloudflare Web Analytics chart stops at row 15. Every number is an estimate. The same person entering your site four times today shows up as four visitors. There's no real-time view, no UTM tracking, no goals, no events, no engagement metric, and bot traffic comes through whether the toggle is checked or not.

If you're already on Cloudflare and you only need pageviews, none of this matters. If you're using analytics to make decisions, all of it does.

Clickport shows everything. Real-time, no sampling, paginated lists, EU-hosted. Engagement scores, copy detection, weekday-aware comparisons, and a full behavioral surface that Cloudflare's product was never built to provide.

Start your 30-day free trial. No credit card. No cookie banner required.