{"id":21043,"date":"2026-10-02T23:18:41","date_gmt":"2026-10-02T21:18:41","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=21043"},"modified":"2026-10-02T23:19:05","modified_gmt":"2026-10-02T21:19:05","slug":"stats4u-wordpress-plugin-how-it-works","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/wordpress-plugins-tricks\/stats4u-wordpress-plugin-how-it-works\/","title":{"rendered":"How the Stats4U WordPress plugin works: counter code, placement, consent and requests"},"content":{"rendered":"

Stats4U is a visitor counter by LW IT Solutions: a small image on the website that counts page views, plus statistics on stats4u.net<\/a> with where visitors came from, time on page, scroll depth and the visitors online right now. No account is needed; the counter number is enough. For WordPress there is a dedicated plugin. It has been listed in the WordPress.org plugin directory<\/a> since 29 September 2026, in version 1.6.0, and its source code is public on GitHub<\/a>.<\/p>\n

This post shows how the plugin works: how it reads a pasted counter code, how it places the counter right below the footer of any theme, how it waits for a consent tool, and what the browser then sends to stats4u.net. Everything was measured again on 2 October 2026 on a local test installation with WordPress 7.1.2, PHP 8.4 and Twenty Twenty-Five, using the plugin from the directory. The end covers the way through the WordPress.org review and lists all links.<\/p>\n

From pasted code to counter<\/h2>\n

Under \u201cSettings \u2192 Stats4U\u201d, a wizard leads through the setup in five steps: counter, appearance, placement, consent, done. The custom configuration offers all settings on one page instead. The first step takes the code that the creator on stats4u.net produces. There are three ways to get it: an existing code, a button that opens the creator and brings the code back at its end, or a new counter number on request. The last two run from the administrator\u2019s browser, not from the server.<\/p>\n

The creator knows several formats, and the plugin accepts all of them. The table shows what stats4u_code_lesen()<\/code> made of twelve inputs:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Pasted<\/th>\nResult<\/th>\n<\/tr>\n<\/thead>\n
HTML, image with link<\/td>\nnumber, design, dark mode and size 150%<\/td>\n<\/tr>\n
BBCode<\/td>\nnumber, design, dark mode<\/td>\n<\/tr>\n
Markdown<\/td>\nnumber, design, language German<\/td>\n<\/tr>\n
script code with s4u.js<\/code><\/td>\nnumber, design, dark mode, counting \u201cunique visitors\u201d, language Polish<\/td>\n<\/tr>\n
image address alone<\/td>\nnumber and design<\/td>\n<\/tr>\n
old long form ?action=pic&s4uid=\u2026<\/code><\/td>\nnumber and design<\/td>\n<\/tr>\n
the number only, also with #<\/code><\/td>\nnumber, design unchanged<\/td>\n<\/tr>\n
address of the statistics page \/live\/<number><\/code><\/td>\nnumber<\/td>\n<\/tr>\n
statistics page with a custom name<\/td>\nnote: paste the code or the number<\/td>\n<\/tr>\n
globe widget globe.js<\/code><\/td>\nnote: the plugin shows image counters<\/td>\n<\/tr>\n
any other text<\/td>\nnote: code not recognised<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

What the page then carries is no longer the image alone but the service\u2019s official script, the same <script src=\"https:\/\/www.stats4u.net\/s4u.js\" data-id=\"\u2026\" async><\/code> that the creator produces. Up to version 1.4.0, the plugin placed only the image. That was lighter, but with an image from another server a browser sends only the site\u2019s domain, neither the page nor where the visitor came from. Only the script delivers these details, plus time on page, scroll depth and \u201conline now\u201d. A single function decides what stands at the counter\u2019s place:<\/p>\n

\/\/ stats4u.php (excerpt)\nfunction stats4u_zaehler_teile($e) {\n    $daten = stats4u_skript_daten($e);\n    if (stats4u_cmp($e) === null) {\n        return array('skript' => array('src' => STATS4U_SKRIPT, 'async' => true) + $daten);\n    }\n    stats4u_wartet(true);\n    return array('platzhalter' => $daten);\n}\n\nfunction stats4u_html() {\n    $e = stats4u_einstellungen();\n    if ($e['id'] === '') { return ''; }\n    $t = stats4u_zaehler_teile($e);\n    if (isset($t['skript'])) {\n        return '<span class=\"stats4u-zaehler\">' . trim(wp_get_script_tag($t['skript'])) . '<\/span>';\n    }\n    return '<span class=\"stats4u-zaehler\" data-stats4u=\"' . esc_attr(wp_json_encode($t['platzhalter'])) . '\"><\/span>';\n}<\/code><\/pre>\n
Without a consent tool, this is a script tag built with wp_get_script_tag()<\/code>, which escapes every attribute. With a tool, it is an empty placeholder that carries the counter\u2019s settings as JSON. More on that below.<\/p>\n
Right below the footer of any theme<\/h2>\n
By default, the counter appears directly below the theme\u2019s footer. That sounds simple, but WordPress has no hook \u201cafter the footer\u201d. The usual hook, wp_footer<\/code>, sits just before <\/body><\/code>. Up to version 1.3.0 the counter hung there, and on a page whose body<\/code> is laid out as a flexbox it ended up as a column beside the content, halfway down. Since 1.3.1, the plugin buffers the output from the end of wp_head<\/code>, looks for the footer in the buffer and places the counter behind it. An element counts as the footer if it identifies itself as one:<\/p>\n
\/\/ stats4u.php (excerpt)\nfunction stats4u_ist_seitenfuss($name, $tag) {\n    if (preg_match('\/(?<![\\w-])role\\s*=\\s*[\"\\']?contentinfo\\b\/i', $tag)) { return true; }\n    if (preg_match('\/(?<![\\w-])itemtype\\s*=\\s*[\"\\']?[^\"\\'>]*WPFooter\/i', $tag)) { return true; }\n    $namen = array('colophon', 'footer', 'site-footer', 'main-footer', 'page-footer', 'global-footer',\n                   'elementor-location-footer');\n    if ($name === 'footer') { $namen[] = 'wp-block-template-part'; }\n    foreach (array('id', 'class') as $attr) {\n        if (preg_match('\/(?<![\\w-])' . $attr . '\\s*=\\s*(?:\"([^\"]*)\"|\\'([^\\']*)\\'|([^\\s>]+))\/i', $tag, $m)) {\n            $wert = strtolower(($m[1] ?? '') . ($m[2] ?? '') . ($m[3] ?? ''));\n            if (array_intersect(preg_split('\/\\s+\/', trim($wert)), $namen)) { return true; }\n        }\n    }\n    return false;\n}<\/code><\/pre>\n
Among several candidates, the last outermost one wins, so that with themes that wrap a <footer><\/code> in another footer area the counter sits below the whole bar. Without a recognisable footer, the counter goes to the end of the page. Until the script has drawn the image, a CSS rule with :has()<\/code> hides the empty box, so no margin is left as a gap. Since version 1.6.0, the callback of the output buffer does this work; the plugin no longer prints the buffered page itself. That change came from the WordPress.org review.<\/p>\n
On the test installation, the counter landed in the described place for every setting. \u201cBelow the footer\u201d put it directly after <\/footer><\/code>, \u201cinside the footer\u201d just before it, \u201cat the end of the page\u201d before the final scripts. \u201cBelow the content\u201d put it on single pages only, not on the front page. The corners fixed it at the bottom right or left, and \u201cnowhere automatically\u201d left it out. For custom places there are the block \u201cStats4U counter\u201d and the shortcode <\/span><\/code>, in a template as do_shortcode( '<\/span>' )<\/code>. Block and shortcode on the same page gave two counters, the block with its own alignment.<\/p>\n
Only after consent<\/h2>\n
A site with a consent tool selects it in the fourth step. The list has 27 entries: 25 tools, CookieYes additionally in its legacy mode, and the WP Consent API, plus any tool that blocks scripts through attributes of its own. The counter\u2019s place then holds an empty span<\/code> with the settings in data-stats4u<\/code>. At the end of the page sits a small release script that the tool runs only after consent and that then puts the official s4u.js<\/code> into every placeholder. Measured, it looked like this:<\/p>\n\n\n\n\n\n\n\n\n\n
Tool<\/th>\nRelease script in the HTML<\/th>\n<\/tr>\n<\/thead>\n
Complianz<\/td>\n<script type=\"text\/plain\" data-category=\"statistics\"><\/code><\/td>\n<\/tr>\n
Cookiebot<\/td>\n<script type=\"text\/plain\" data-cookieconsent=\"statistics\"><\/code><\/td>\n<\/tr>\n
consented.eu<\/td>\n<script type=\"text\/plain\" data-consented=\"stats4u\"><\/code><\/td>\n<\/tr>\n
CookieYes<\/td>\n<script data-cookieyes=\"cookieyes-analytics\" src=\"\u2026\/freigabe.js\"><\/code><\/td>\n<\/tr>\n
WP Consent API<\/td>\ninline script that asks wp_has_consent()<\/code> and listens for changes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
In none of these cases did s4u.js<\/code> appear directly in the HTML. For tools that release only scripts with an address of their own, such as CookieYes, the plugin includes the file freigabe.js<\/code>. With the WP Consent API, the script first checks whether a consent type is set at all, because without a type wp_has_consent()<\/code> returns true<\/code> even after a refusal. For a tool that is not in the list, custom attributes can be entered. Only type<\/code>, class<\/code> and data-*<\/code> get through:<\/p>\n
\/\/ stats4u.php (excerpt)\nfunction stats4u_eigene_attribute($roh) {\n    $aus = array('type' => 'text\/plain');\n    if (preg_match_all('\/([a-zA-Z][a-zA-Z0-9_.:-]*)\\s*=\\s*(?:\"([^\"]*)\"|\\'([^\\']*)\\'|([^\\s\"\\'>]+))\/', (string) $roh, $m, PREG_SET_ORDER)) {\n        foreach ($m as $a) {\n            $name = strtolower($a[1]);\n            if (!preg_match('\/^(data-[a-z0-9_.:-]+|class|type)$\/', $name)) { continue; }\n            $wert = $a[2] !== '' ? $a[2] : ((isset($a[3]) && $a[3] !== '') ? $a[3] : ($a[4] ?? ''));\n            $aus[$name] = substr(preg_replace('\/[^A-Za-z0-9 _.:\\\/,#-]\/', '', $wert), 0, 80);\n        }\n    }\n    return $aus;\n}<\/code><\/pre>\n
An entered onload=\"alert(1)\"<\/code> was missing from the output; what remained was type=\"text\/plain\"<\/code> and data-category=\"statistics\"<\/code>.<\/p>\n
\n\"From
The Stats4U plugin places the official counter script where chosen; counting happens in the browser, and the WordPress server never contacts stats4u.net<\/figcaption><\/figure>\n
What the browser sends to stats4u.net<\/h2>\n
For this measurement, a Chrome with a fresh profile paused every request. Only the script file s4u.js<\/code> itself was allowed to load. Every other request to stats4u.net was logged and then aborted, so no test count reached the service. The page stayed open for 70 seconds, then the browser navigated away.<\/p>\n\n\n\n\n\n\n\n\n\n
When<\/th>\nRequest<\/th>\nContent<\/th>\n<\/tr>\n<\/thead>\n
on load<\/td>\ns4u.js<\/code><\/td>\n13,237 bytes transferred, Brotli, cached for an hour, no Set-Cookie<\/code><\/td>\n<\/tr>\n
on load<\/td>\naction=cfg<\/code>, GET<\/td>\nthe counter number only: the counter\u2019s settings<\/td>\n<\/tr>\n
on load<\/td>\naction=pic<\/code>, image<\/td>\ncounter number, design, dark mode, language, page address, referrer and a random number against caching; this request counts<\/td>\n<\/tr>\n
after 60 s<\/td>\naction=ping<\/code>, POST<\/td>\nthe counter number only, for \u201conline now\u201d<\/td>\n<\/tr>\n
on leaving<\/td>\naction=puls<\/code>, beacon<\/td>\ncounter number, page address, visible seconds, scroll depth and load time<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
After loading, the browser held no cookies and nothing in local storage. The script turned the counter into a link to its statistics page, https:\/\/www.stats4u.net\/live\/<number><\/code>. The service sets this link, not the plugin; a counter set to \u201cnot public\u201d on stats4u.net links to the service\u2019s home page. The WordPress server itself never contacts stats4u.net: the plugin\u2019s code contains not a single HTTP call. The preview on the settings page and in the editor carries the parameter rl=1<\/code> and does not count.<\/p>\n
Multilingual and without full reloads<\/h2>\n
When the counter\u2019s language is set to \u201cthe language of each page\u201d, the plugin takes it from the locale of each request. With Polylang, the counter carried data-lang=\"en\"<\/code> on the English front page, de<\/code> on the German one and pl<\/code> on the Polish one. Themes that switch pages without a full reload count only the first page unless they help. For them there is the event s4u:seiteweg<\/code>, which closes the time on the old page, and, after consent, the function window.stats4uAn()<\/code>, which fills new placeholders. This website uses exactly that: it runs Stats4U 1.6.0 with consented.eu, and its page switching without reload fires s4u:seiteweg<\/code> before every swap.<\/p>\n
Through the WordPress.org review<\/h2>\n
The first submission was put on hold on 26 September 2026. The review team asked for every value to be escaped at output, including HTML that a function returns, and for no translation files in the package. Version 1.6.0 does both. Every output goes through esc_html()<\/code>, esc_attr()<\/code>, esc_url()<\/code>, wp_kses()<\/code> or wp_print_script_tag()<\/code>, and the callback of the output buffer places the counter below the footer. The 18 translations that shipped in the package up to 1.5.0 now sit in the GitHub repository as templates; translation happens on translate.wordpress.org<\/a>, and WordPress loads the language packs by itself. On 29 September 2026, the review team approved Stats4U.<\/p>\n
On deletion, the plugin removes its option and the remembered view of its settings page. Measured: an option of 236 bytes and the view were present before, both gone afterwards. The counter on stats4u.net and its statistics remain.<\/p>\n
All links<\/h2>\n