Umami Hosting: Your Own Website Analytics Server

Umami is an open-source (MIT) web analytics tool: a lightweight alternative to Google Analytics that shows visitors, pages, referrers and events without cookies. Choose it with a plan, pay, and we build the VPS (KVM, NVMe, Ubuntu 24.04 LTS) and install Umami in about three minutes after boot. You get:

• Umami 3.4.1 with PostgreSQL 17, so your analytics data sits in your own database.
• An HTTPS address like yourname-x7k2.devoster.app with a Let's Encrypt certificate, which serves both the dashboard and the tracking script.
• Your admin account secured before go-live. A fresh Umami starts with a well-known default login (admin / umami). Ours is changed to a generated password before the app is reachable from the internet. You log in as admin with the password shown in the Devoster dashboard, where you can also reset it.
• Nothing phoning home. Umami's telemetry and update checks are switched off; the panel handles updates.
• Dashboard controls to open the app, restart, stop or start it, read its logs and connect your own domain.

The app is free; you pay only the VPS plan, with 10% off yearly. The server comes with full root, free nightly backups kept 3 days plus one snapshot, a dedicated IPv4 and DDoS protection. See the other apps that install this way on the One-Click Apps page.

In Umami, add a website and copy its tracking code. It is one script tag for the <head> of every page, pointing at your server:

<script defer src="https://yourname-x7k2.devoster.app/script.js"
        data-website-id="your-website-id"></script>

The script loads from /script.js on your Umami address and sends each pageview to /api/send on the same address, so no third-party analytics domain is involved. One Umami server can track as many websites as you like; each gets its own ID and dashboard.

• WordPress, Ghost and site builders all have a place for header scripts or code injection; paste the tag there.
• Single-page apps are handled by the script, which records route changes as pageviews.
• Your own domain: connect something like stats.example.com in the Devoster dashboard (a CNAME to your devoster.app name), then update the script's src on your sites. The devoster.app address keeps answering too, so nothing breaks while you switch.

Some ad blockers block analytics scripts even when they are self-hosted, so treat the numbers as a floor, not a census.

Umami's dashboard covers what most sites look at: visitors, pageviews, bounce rate and visit duration, top pages, referrers, browsers, operating systems, devices and countries. Beyond that it has:

• Custom events for button clicks, sign-ups and other actions, sent with a data attribute or a line of JavaScript, optionally with values.
• UTM campaign reports, to see which links and channels bring people in.
• Funnels, journeys, retention and goals, for drop-off points and repeat visits.
• Share links that show a website's stats to people without an account, and teams for colleagues who do need one.

What it doesn't do is just as important. Umami works without cookies, cross-site tracking or automatic collection of personal data, and it doesn't build profiles of individual people. That is why many sites use it with lighter consent requirements than cookie-based analytics, but whether your site needs a consent banner depends on the laws that apply to you; this is not legal advice.

Not much. Umami and PostgreSQL use about 210 to 245 MB of RAM at idle. Each pageview is a small request that writes one row, so load follows your traffic, and the database grows with the number of events you keep.

If dashboards get slow over very long date ranges, more RAM for PostgreSQL helps most. You can upgrade from the panel later; if you are not sure, start on Nano.

Umami sends no email at all, so the outbound mail block on Devoster VPS plans doesn't affect it: there is nothing to configure. Password resets go through the Devoster dashboard.

Your stats are less sensitive than, say, a document archive, but the admin account can add websites and users, so protect it:

• Turn on two-factor login (an authenticator app code) in Umami. A password reset from the Devoster dashboard does not clear two-factor, so keep your authenticator safe.
• Give colleagues their own accounts or a team, rather than sharing the admin login, and use share links for clients who only need to look.

Pair Umami with Uptime Kuma if you also want to know when your sites go down; analytics only tells you about visitors who got through.

We test new Umami versions and apply them in a maintenance hour you choose, or when you press Update now. A snapshot of the VPS is taken first, and if Umami doesn't come back healthy the server is rolled back automatically. Auto-update can be switched off.

The VPS is still an unmanaged server: you have full root, and its security and what you add to it are your responsibility. We don't provide support for configuring Umami; its documentation covers events and reports. Our VPS hardening checklist is a good first hour for any server with root access.

Nightly backups (3 days) and your snapshot slot cover the whole VPS, Umami's database included. If your analytics history matters, also keep a database dump off the server. And if your visitors' data must stay outside the US, note the servers are in Utah.