A Laravel middleware package for sending analytics data to the Mattitja Analytics API. The package automatically registers middleware for web routes and sends data synchronously to the analytics service.

Installation

composer require mattitjaab/mattitja-analytics

Configuration

Publish the configuration file (optional):

php artisan vendor:publish --tag=mattitja-analytics-config

Add your site key and ingest secret to your .env file:

MATTITJA_ANALYTICS_SITE_KEY=your-site-key
MATTITJA_ANALYTICS_INGEST_SECRET=your-ingest-secret
MATTITJA_ANALYTICS_ENABLED=true

Both values are found under Site → Install in Mattitja Analytics. Click "Generate secret" to create the ingest secret. Without it the API ignores the forwarded visitor IP and user agent and rejects the request, so nothing is tracked.

Usage

The package automatically registers middleware for the web group and starts collecting analytics data immediately after installation and configuration.

Manual middleware registration

You can also add the middleware manually for specific routes:

// In routes/web.php
Route::middleware(['mattitja-analytics'])->group(function () {
    // Your routes here
});

Configuration Options

Basic Settings

MATTITJA_ANALYTICS_SITE_KEY - Your site key from Mattitja Analytics (required)
MATTITJA_ANALYTICS_INGEST_SECRET - Your site's ingest secret, sent as a Bearer token (required)
MATTITJA_ANALYTICS_TIMEOUT - HTTP timeout in seconds (default: 1)
MATTITJA_ANALYTICS_CONNECT_TIMEOUT - Connect timeout in seconds (default: 0.5)
MATTITJA_ANALYTICS_PAUSE_ON_FAILURE - Seconds to stop sending after the API is unreachable or returns 5xx (default: 60, 0 disables)
MATTITJA_ANALYTICS_ENABLED - Enable/disable tracking (default: true)
MATTITJA_ANALYTICS_BOTS - Track bots (default: false)

Privacy Settings

MATTITJA_ANALYTICS_RESPECT_DNT - Respect Do Not Track header (default: true)

Filtering

You can configure paths and IP addresses to ignore in the config file.

Data Sent

The package sends the following data to https://analytics.mattitja.se/api/send:

k - Site key
u - Full URL of the visited page
r - Referrer URL (if available)
ip - Visitor's complete IP address
ua - User agent string

The request is authenticated with Authorization: Bearer <ingest secret>, and the visitor's Accept-Language header is forwarded.

Only successful GET requests that render HTML count as pageviews. Form posts, redirects, JSON responses and requests that expect JSON are skipped.

Security

Data is sent from the middleware's terminate() step, after the response has been sent to the browser
IP addresses are NOT anonymized (needed for geolocation)
No queue, worker or cache is required. If the API is down, sending pauses for pause_on_failure seconds, tracked with a marker file in storage/framework, so visitors and PHP workers are never held up
All errors are caught and logged, so the API being down never breaks your site
Bot traffic is filtered out by default
Do Not Track header is respected by default

Development

Run tests:

composer test

License

MIT License