Umami Review

Overview

Umami is an open-source, cookieless web analytics platform you can self-host under the MIT license or run on the vendor's cloud, created in 2020 by Mike Cao and now at v3 with roughly 38,600 GitHub stars. It tracks pageviews, sessions, referrers, countries, devices, UTM parameters, and custom events without cookies and without collecting personal data, which is why sites use it to drop consent banners entirely. The v3 line has grown well past simple dashboards: session replay (v3.1, rrweb-based, off by default, replays kept 30 days), click and scroll heatmaps (v3.2), an attribution report with first-click and last-click models, funnels, retention, revenue, journey, and UTM reports, custom Boards dashboards, and TOTP two-factor auth, plus short links and tracking pixels on the cloud platform. Deployment is a Node.js app (18.18+) on PostgreSQL (12.14 minimum); v3 removed MySQL and MariaDB, and the docs publish a migration path through v2.19 for anyone still on MySQL. Install is docker compose up -d with a two-service file (app plus postgres:15-alpine) or pnpm install and pnpm run build from source; the build creates an admin/umami login you replace on first sign-in. Self-hosted instances keep an admin-only API, retain data indefinitely, and can turn off the app's anonymous telemetry with one environment variable. Cloud pricing is usage-based per event rather than per seat: Hobby is free to 100,000 events a month, Pro is $20 for 1 million, Business is $200 for 10 million with session replay, heatmaps, and the streaming API included, and Enterprise is custom. Self-hosted installs get the core analytics but not email reports or the streaming API. Compared with Google Analytics, Umami trades ad-ecosystem integrations and behavioral depth for a script the vendor puts under 2KB, no sampling, and full data ownership; compared with Matomo, it is lighter and less configurable. Best for developers and privacy-conscious marketing teams that want campaign and conversion numbers without surveillance overhead.

Key Integrations

How to install

1. Docker path: docker pull docker.umami.is/umami-software/umami:latest, or clone the repo and run docker compose up -d with the shipped file, which starts the app on port 3000 plus postgres:15-alpine, each with a health check and a persistent umami-db-data volume.
2. Source path: git clone https://github.com/umami-software/umami.git && cd umami && pnpm install, set DATABASE_URL (postgresql://username:mypassword@localhost:5432/mydb, the only required variable), then pnpm run build and pnpm run start. Node.js 18.18+ and PostgreSQL 12.14+ are required.
3. The build creates a default admin/umami login; change it on first sign-in. Two-factor auth needs TWO_FACTOR_ENCRYPTION_KEY set (generate with openssl rand -hex 32), required since v3.3.
4. Updates: git pull && pnpm install && pnpm build from source, or docker compose pull && docker compose up --force-recreate -d for Docker deployments.
5. Get data flowing: add the tracking script to your site (Next.js via the next/script component; a WordPress community plugin exists), then watch events land in the dashboard. Server-side events post to /api/send or /api/batch as JSON and require a valid User-Agent header; requests without one are rejected.

Requirements

Node.js 18.18+ and PostgreSQL 12.14+; v3 dropped MySQL and MariaDB, and the docs document a v2.19 stepping-stone migration for anyone moving off MySQL. DATABASE_URL is the only required variable; APP_SECRET, TRACKER_SCRIPT_NAME (renames script.js), COLLECT_API_ENDPOINT (renames /api/send), IGNORE_IP, and DISABLE_TELEMETRY=1 cover most configuration. Self-hosted data is retained indefinitely unless you delete it. The docs list three ways around ad blockers: reverse-proxy the script, self-host the tracker file with data-host-url, or rename the tracker and collect endpoint.

Best for

Developers and privacy-conscious marketing teams that want campaign and conversion reporting without cookies or consent banners: UTM and attribution reports, funnels, retention, revenue, and shareable dashboards, with unlimited websites when self-hosted and an API-first design for custom pipelines.

Not for

Buyers who want zero infrastructure: self-hosters are responsible for the security of their own deployment, and session replay, heatmaps, email reports, and the streaming API sit behind paid Cloud tiers (Business and up for replay and heatmaps). Also not for teams that need certified compliance attestations, since the security page states Umami claims no certifications it has not completed, and not for MySQL shops, which v3 no longer supports.

Review notes

Assessed from umami.is, docs.umami.is (about 120 pages, fetched through its published llms.txt), the GitHub repo, and the release log in September 2026; we have not deployed an instance. The docs cover v3 only, with v2 split off at v2.umami.is, and the release cadence is healthy: v3.3.1 (August 20, 2026), v3.3.0 (August 12), v3.2.0 (June 24), v3.1.0 (April 16), with a push to master the day before we checked.

The correction that matters: our earlier record listed AI-powered insights, AI anomaly detection, and AI event tracking. None exist. A search across the full documentation set, the README, and every release from v3.0.3 to v3.3.1 finds no AI feature of any kind; Insights in Umami is a menu of deterministic reports (compare, breakdown, funnel, retention, UTM, goals, journey, revenue, attribution). We have removed the AI claims.

Second correction: our cloud pricing was wrong. Hobby is free to 100,000 events a month, not $20; Pro is $20 for 1 million events; Business is $200 for 10 million; Enterprise is custom, with overage billed per event and no interruption to collection. The old claim that Umami lacks session recordings and heatmaps is also out of date: replay shipped in v3.1 and heatmaps in v3.2, both off by default and both Cloud Business tier and above on the hosted side.

Two more stale facts: v3 removed MySQL and MariaDB in favor of PostgreSQL-only, and the integration list was padded. Zapier, Slack, and Google Search Console appear nowhere in the docs; WordPress is a community plugin, Next.js and Vercel are documented guides rather than integrations, and the official integrations page lists community plugins for ten platforms plus API clients.

Verdict

Light, honest, cookieless analytics you can own outright; the AI-free tracking script is the point, not a gap. Self-host for unlimited sites, or pay $20 a month for 1 million cloud events.

Similar Tools