Admin
Control panel
Overview
A snapshot of the platform right now.
Users
—
Sites
—
Events today
—
MRR
—
Users
Manage accounts, plans, and access.
| Signed up | Role | Plan | Status | Actions | |
|---|---|---|---|---|---|
| Loading… | |||||
Plans
Create, edit, and remove pricing plans and their limits.
| Plan | Price | Sites | Events/mo | Retention | Actions |
|---|---|---|---|---|---|
| Loading… | |||||
Price is per month (USD). Retention 0 = unlimited. Editing a plan applies to everyone on it.
Coupons
Discount codes and special marketing plans (hidden plans granted at a fixed price).
Create a coupon
All coupons
| Code | Type | Value | Used | Expires | Where | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Credits
Award or deduct credits for any account, and review the ledger.
Current balance
—
Affiliate → credits rate
Credits granted per $1 of affiliate earnings a user converts.
credits / $1
Recent activity
0 selected
| User | When | Change | Balance | Reason | By | |
|---|---|---|---|---|---|---|
| No movements yet. | ||||||
Full report
What the full report (every problem and its fix, from Explain) costs in credits, and how many each plan gets included every month. After the included ones, the discount applies. Admins never pay.
DesignScan fixes
“Have DesignScan fix it” under findings in Explain. The member fills in a short form, signs in on designscan.me with GhostStat and gets a quote there. Prices here are the “from” price shown on the button; the quote decides.
Plugins
Installed plugins and which plans may use them.
AI BotScore Engine
Shared scoring engine (0–100 BotScore, confidence, category). When active, the plugins you tick below use it to score AI & bot traffic.
Use the engine in these plugins
Loading…
Installed
Upload a plugin
A
.zip or .tar.gz containing the plugin folder (with manifest.json).| Plugin | Version | Scope | Enabled | Free/mo | |
|---|---|---|---|---|---|
| Loading… | |||||
Access by plan
Grant each user-scoped plugin to the plans (groups) allowed to install it. System plugins apply to everyone and aren't listed here.
| Plugin |
|---|
| Loading… |
Billing
Affiliate program, subscriptions, commissions, and payout requests.
Affiliate program
%
Applied to new affiliates. Recurring commission on each referred payment.
Affiliates
| Affiliate | Code | Rate | Balance | Paid out | Save |
|---|---|---|---|---|---|
| Loading… | |||||
Subscriptions
| User | Plan | Provider | Status | Renews |
|---|---|---|---|---|
| Loading… | ||||
Affiliate commissions
| Affiliate | Referred | Payment | Commission | Status | Date |
|---|---|---|---|---|---|
| Loading… | |||||
Payout requests
| Affiliate | Amount | Method | Destination | Status | Actions |
|---|---|---|---|---|---|
| Loading… | |||||
Data limits
Governs heavy capture (heatmaps & session recordings) by policy, not traffic: sampling, monthly cap, retention, and per-site storage budget. Blank = use the built-in default.
Loading…
Feature flags
Global kill-switches for advanced analytics features.
Visitors from AWS, Google Cloud, Azure and other datacenter/cloud IPs are always tagged. Turn this on to also drop them from human counts — they are often bots or prefetch, but sometimes a real person on a VPN or corporate proxy, which is why it is off by default. Applies to new traffic from the moment you enable it.
SMTP email
Used for scheduled reports, password resets, and alerts. The password is encrypted at rest.
Use this when your provider only lets you send as its own
address (iCloud, Gmail): send from that one, and replies come here.
The GhostStat Chronicle
Generate and send a test edition (with PDF) to any address — built from your own account's sites.
Blog
Posts on ghoststat.me/blog. Saving updates the blog straight away.
| Title | Status | Category | Published | Words | Actions |
|---|---|---|---|---|---|
| Loading… | |||||
ghoststat.me/blog/
Changing the address of a published post keeps the old one working (it redirects).
FAQ
Shown at the end of the post and sent to search engines and AI assistants as FAQ data. Answers may contain links, <strong> and lists.
Search & sharing
ghoststat.me › blog ›
Only used by the checks on the right.
Publish
Not saved yet.
Images
Cover image
No image
At the top of the post and on the blog list. 1600 × 900 or larger works best.
Share image (og:image)
No image
What Facebook, LinkedIn, X and chat apps show. 1200 × 630. Empty = the cover image.
SEO checks
—Mobile apps
Store IDs of GhostStat Guardian. As soon as an ID is filled in and saved, its badge appears on ghoststat.me and links to the store. Empty a field to hide that badge.
App Store Connect → your app → App Information → Apple ID (a number). A full apps.apple.com link works too.
Play Console → your app → package name; for Guardian that is me.ghoststat.guardian. A full play.google.com link works too. The link only opens once the app is published.
Where the badges appear: the GhostStat Guardian section on the ghoststat.me home and features pages, and the footer of every page. With both fields empty, that section and the footer line are hidden.
Social accounts
GhostStat's own accounts on social networks. Every account with a handle or link is shown on ghoststat.me as its icon, in a row in the footer of every page; the handle shows on hover. Leave the field empty to hide it; the network stays in this list so you can fill it in later.
Where they appear: a row of icons in the footer of every ghoststat.me page, under Product, Account and Sites, in this order and on one line with the App Store and Google Play badges (Mobile apps). Search engines also get them as GhostStat's official profiles. A handle (@GhostStatMe) or the full link both work; Mastodon needs the server too (@GhostStatMe@mastodon.social).
Blog posting
Connect the networks GhostStat posts to. Then the Social button next to a published post in Blog plans it in the social queue (a morning digest first, then the posting hours in Social rules), or posts it right away. Passwords and keys are stored encrypted and never shown again.
Bluesky
Not connected
- In Bluesky: Settings → Privacy and security → App passwords → Add App Password.
- Name it GhostStat (leave access to direct messages off) and copy the password (xxxx-xxxx-xxxx-xxxx).
- Paste it below with your handle and click Connect.
Mastodon
Not connected
- On your Mastodon server: Preferences → Development → New application.
- Name: GhostStat. Scopes: tick only read:accounts and write:statuses. Submit.
- Open the new application, copy “Your access token” and paste it below.
Facebook page
Not connected
- developers.facebook.com: your GhostStat app (use case “Manage everything on your Page”), set to Live.
- business.facebook.com → Settings → Users → System users → Add: name GhostStat, role Admin. Then Assign assets: Pages → GhostStat (full control) and Apps → GhostStat.
- On that system user: Generate token → app GhostStat → expiry Never → tick pages_show_list, pages_read_engagement, pages_manage_posts and business_management → copy the token.
- Paste it with the App ID and App secret (App settings → Basic) and, if you like, the Page ID. The app secret is not kept. (A token from the Graph API Explorer works too.)
Threads
Not connected
- In the same Meta app: add the use case “Access the Threads API” with threads_basic and threads_content_publish.
- App roles → Roles → add your Threads account as Threads tester, then accept it in the Threads app: Settings → Account → Website permissions → Invites.
- Use cases → Threads API → Settings → User Token Generator: generate a token for your account and paste it below. It lasts 60 days; GhostStat renews it by itself.
Instagram
Not connected
- Instagram must be a professional account (business or creator), linked to GhostStat’s Facebook page (Meta Business Suite → Settings → Instagram accounts).
- Using a system user for Facebook? Assign the Instagram account to it as well (Business settings → System users → Assign assets), and make the token with instagram_basic and instagram_content_publish next to the page permissions.
- Connect Facebook again with that token (GhostStat keeps the page key from that moment), then click Connect with Instagram.
X
Not connected
- console.x.com: create an app for the GhostStat account. X’s API is pay-per-use: add credit first.
- App → User authentication settings → App permissions: Read and write.
- Keys and tokens: copy the API Key and Secret, then generate the Access Token and Secret (after setting Read and write).
- Use the four keys under OAuth 1.0 (Consumer Key and Secret, Access Token and Secret), not the OAuth 2.0 Client ID. Regenerate the consumer key first, then the access token. The link goes in the post.
Pinterest
Not connected
- developers.pinterest.com → My apps → Connect app (a Pinterest business account is needed). Trial access is enough to pin on your own account.
- In the app: add the Redirect URL below, exactly as shown.
- Copy the App ID and the App secret key, paste them here and click Connect with Pinterest. Allow GhostStat at Pinterest.
- Back here, choose the board new pins go to. The key renews itself.
Redirect URL to add at the network (exactly this):
LinkedIn
Not connected
- linkedin.com/developers → Create app, linked to the GhostStat company page.
- Products: add “Share on LinkedIn” and “Sign In with LinkedIn using OpenID Connect” (both instant). Leave the page number below empty: GhostStat then posts on your own profile.
- Posting as the company page needs the “Community Management API”, which LinkedIn only gives to a separate app after a review (often weeks). Only fill in the page number once that app is approved and its Client ID is here.
- Auth: add the Redirect URL below, copy the Client ID and Client secret, click Connect with LinkedIn and allow it. The key lasts 60 days; the days left show here.
Redirect URL to add at the network (exactly this):
Social queue
Blog posts planned for GhostStat’s social accounts. Edit, hold or send each one before it goes out.
…
Social rules
When planned posts go out. A morning digest mails what goes out that day, so there is time to change it.
WordPress plugin
Which GhostStat sites use the GhostStat Analytics plugin for WordPress, which version they run and when they started. Only sites with a GhostStat site key show here; WordPress.org never says who installs a plugin.
Sites with the plugin
—
Active, last 7 days
—
New, last 7 days
—
On the newest version
—
New sites per day, last 30 days
Plugin versions (active sites)
WordPress versions (active sites)
Sites
| Site | Account | Plugin | WordPress | First seen (UTC) | Last seen (UTC) |
|---|---|---|---|---|---|
| … | |||||
How sites are found: from plugin 1.1.2 on, the tracker tag carries the plugin version, and visitors' browsers pass it on with the request they already make. The WordPress version comes from WordPress itself when the site reads its statistics with an API key or sends a software report. Active = seen in the last 7 days.
Support mail
Every message sent through the contact form on ghoststat.me, kept here even if the email never arrived. Newest first.
0 selected
Spam gets no mail and the sender sees the normal “sent”. It is deleted by itself after the days set below. Something real in here? Tick it and press Not spam.
| When | From | Message | ||
|---|---|---|---|---|
| Loading… | ||||
Anti-spam
Every contact-form message gets a score. At the threshold or above it is spam: it goes to the Spam box, nobody gets a mail, and the sender sees the normal “sent”, so a bot learns nothing. No IP address is stored.
| Rule | Value | Hits | Last hit | Note | |
|---|---|---|---|---|---|
| Loading… | |||||
What is checked by itself
The “I wanted to know your price” bot in 50+ languages (+70) · SEO, backlink, crypto, loan, adult and bulk-list offers (+30 each) · Telegram/WhatsApp contact lines (+30) · link markup or 3+ links (+30 to +50) · bot-style names like Robertbiz (+40) · throwaway addresses (+25) · mostly non-Latin text (+25) · the same text as earlier spam (+60) · one company name used with 3+ addresses in 14 days (+40) · plus the honeypot, the time trap and the rate limit, as before. A block rule scores 100.
Ecosystem
Platforms that consume GhostStat intelligence — GhostBanner, GhostRipple, anything else.
A client is inert until you switch it out of standalone and a site owner grants it a site.
Clients
Mode decides whether unified login and the intelligence API are available at all.
| Slug | Client ID | Mode | Scopes | Provisioning | Grants | Links | Status | Actions |
|---|---|---|---|---|---|---|---|---|
| Loading… | ||||||||
Create client
The client secret and JWT signing secret are shown once and never again — the first is hashed, the second encrypted. Lose them and you rotate.
Site grants
Which client may read which site. No grant, no data — this is the only thing standing between a connected platform and every site on the instance.
| Client | Site | Domain | Owner | Status | Actions |
|---|---|---|---|---|---|
| Loading… | |||||
Recent activity
Every token issued, every link made, every read refused.
0 selected
| When | Client | Action | Detail | |
|---|---|---|---|---|
| Loading… | ||||
Login security
When a returning account must re-enter an emailed verification code. Applies to every account.
Counted from each account’s last successful verification.
A code is also required when a login arrives from a browser/OS the account has never verified from. Turning this on re-verifies everyone once, then trusts the device they use. Matched on family (Chrome, Windows…), so an auto-update doesn’t count as new.
System
Live health, scalability, data retention, and asset optimization.
Storage usage
…Database size and rows per plugin (mapped from each plugin’s install.sql), plus on-disk plugin files. Spot which plugins are growing.
| Plugin | DB size | Rows | Files on disk |
|---|---|---|---|
| Loading… | |||
Asset optimization
…Minify + gzip/brotli + source-maps for JS/CSS. Assets also auto-rebuild when a source file changes (via
asset() and the build_assets.php cron); use Generate to force a full rebuild now.| Asset | Original | Minified | Gzip | Brotli | Built |
|---|---|---|---|---|---|
| Loading… | |||||
Health
Checking…Overall API status, open alerts, cache, and ingestion in the last 24h.
Scalability
Checking…Table partitioning (needed at high volume) and current ingestion rate.
Data retention
Checking…How long raw events are kept per plan before the nightly cleanup drops them.
Cache
Checking…Memcached when available, file cache otherwise. Toggle Memcached and clear the cache here.
Auto picks the fastest available. Redis and Memcached are in-memory; File is a safe fallback that always works.