You can absolutely get website analytics without invasive tracking, but "zero script" and "zero tracking" aren't the same thing. Here's what each method actually gives you, what it costs you in accuracy, and how to pick the right one for your site.
What "tracking scripts" actually means (and what it doesn't)
Most people searching for this aren't trying to avoid all code. They're trying to avoid the stuff that made Google Analytics a privacy problem in the first place: cookies that persist across sessions, cross-site identifiers shared with ad networks, fingerprinting scripts that rebuild a cookie from your device settings, and session recorders that capture every click and keystroke.
That's different from a single lightweight snippet that counts a pageview and forgets you exist five seconds later. One is surveillance. The other is a doorbell counter.
So before you go hunting for a "no script" tool, it helps to separate the two questions you're actually asking:
- Can I get real visitor numbers without cookies, fingerprinting, or cross-site tracking? Yes, easily.
- Can I get accurate, useful analytics with literally no code running in the browser? Sometimes, but you'll trade away accuracy to do it.
Can you get website analytics with zero JavaScript?
You can. There are two real methods, and each has a catch.
Server log analysis
Every web server already logs every request: IP address, user agent, URL, timestamp. Tools like GoAccess or AWStats parse those logs into traffic reports without adding a single line of code to your site.
The catch: logs count requests, not humans. Bots, crawlers, prefetch requests, and cached pages all show up as "visits" unless you filter aggressively. You also lose anything that happens after the page loads, like button clicks, scroll depth, or signup conversions, because none of that shows up in a server log.
Reverse proxy or edge analytics
Some tools sit between your visitor and your server (via a CDN or edge function) and log traffic at that layer instead of in the browser. No script touches the visitor's device at all.
This is more accurate than raw log parsing because you can dedupe bots and sessions at the edge. But it's genuinely harder to set up. You're changing infrastructure, not adding a snippet, and most small business owners don't want to touch their CDN config to see a traffic chart.
The "noscript" hybrid
A few tools use a tiny <noscript> pixel as a fallback so they still catch visitors who block JavaScript. It's not zero code, but it's about as close as you can get while still capturing real page views instead of raw server requests.
Why most privacy-first tools still use one line of code
Here's the honest trade-off: server logs and edge analytics avoid scripts entirely, but they can't tell you what actually matters to a founder, like which page a signup came from, whether someone clicked your pricing CTA, or which channel drove your last ten paying customers.
That's why most privacy-first analytics tools land on a middle ground: one small script that fires a pageview event and nothing else. No cookie is set. No device fingerprint is built. No ID follows the visitor to another site. It's not "no tracking script," it's "no invasive tracking script," and for almost every site owner that's the distinction that actually matters.
Pelagic works this way: install one line of code and it shows visitor counts, referral sources, and revenue attribution in a live dashboard, with no cookies, no fingerprinting, and no consent banner required. You get the accuracy of a script without the baggage that made "script" a dirty word in the first place.