Matomo 3.8.0 - Analytics Platform

We are proud to announce Matomo 3.8.0: a new release of Matomo Analytics. There are a lot of improvements in Security, Performance and Usability and we’re proud to share with you our best Matomo release ever.

What’s new?

Improving security of Matomo has been a focus for us in this release. For example: any IP address attempting to login to Matomo will be blocked after a number of unsuccessful login attempts (to keep away any bots and automated tools trying to guess your passwords). You can additionally keep your Matomo account safer by enabling the new Two Factor Authentication (2FA) feature. Also when changing password or email address, any user will be required to enter their old password. We’ve also fixed several XSS thanks to security researchers who reported issues as part of our Bug Bounty program.

We’ve also made several usability improvements. Up to now it wasn’t easy to get the evolution graphs to display a different period. Now under Evolution graphs, you will find a new icon “Change Periods” which lets you switch the period being displayed in just one click!

Also, under each report table, you will also find a new feature called “Show Totals Row”. When clicked, a new row will be displayed at the bottom of the table named “Totals”. This row shows the sum of each column values. This is useful when you’re analysing your data and need to know the total value of a given metric.

It’s never been easier to check out your Transitions report: they are now directly available under Behavior > Transitions.

You can also now generate Campaign Tracking URLs by using the Campaign URL Generator directly from Matomo! Go to Matomo > Acquisition > Campaign URL Builder to get started. (The tool has always been available on Matomo.org but is now directly available in your Matomo).

Users with the “Admin” permission can now share dashboards with other users (it used to be only Super Users who could share dashboards).

A new page is available to Super Users in Matomo > Administration > Diagnostics > Tracking Failures. This page lists any tracking failures that happened during the last 2 days. Please note that only the most common kind of tracking failures are recorded (for example, an un-used Site ID is found in the Tracking code).

Regarding the JavaScript Tracking: While the piwik.js and piwik.php file still exist (and will always work), we’re also introducing the new matomo.js and matomo.php files and they will be used by default now. And if you’re tracking mobile apps, we’ve released new Major versions of both the iOS and Android SDKs!

As always, new smartphone, tablets and other devices and browsers are detected, as well as new Search engines and social networks.

And the Tag Manager keeps getting better with several improvements and fixes over the last few weeks.

207 tickets have been closed by more than 20 contributors!

After You Update

Use the forums if you have any question or feedback (free support),
or contact the Business Support Team to make the most of your Matomo Analytics and get professional support (paid support).
Please help us spread the word about Matomo! Maybe you can write about the project on your blog, website, twitter, talk about Matomo Analytics at conferences, or let your friends and colleagues know what is Matomo. Already 1,000,000+ websites have liberated their web analytics, and with your help we can grow the community!
To improve Matomo in your language consider contributing to translations.
Support our efforts by donating to the project.

Security release

This release is rated critical.

Several XSS issues have been responsibly reported and fixed in this release. Our security bug bounty program (also on Hackerone) welcomes & rewards researchers who discover and responsibly report to us any security issues found in Matomo or any of the plugins created by Matomo/InnoCraft.

Database upgrade

This release does not contain any major database upgrade.

Platform Changes

Matomo is an open analytics platform. In an effort to help Matomo developers learn about improvements and changes in the core APIs, we document the changes since the last release.

In this 3.8.0 release there are breaking API changes, New APIs, New Features, Internal changes and deprecations. Read more in Platform Changelog for Developers to see all changes to the platform and APIs.

Note: the Marketplace showcases more than 83 plugins already compatible with Matomo 3 and this is just the beginning. Matomo is your universal data analytics platform!

New and updated SDKs (Tracking API Clients)

The Matomo team offers official SDKs (Tracking API Clients) for measuring your mobile apps and any other kind of apps. Both the iOS and Android SDKs have seen a major new release in December:

iOS SDK: new release 6.0.0 [by @brototyp]
Android SDK: new release 4.0.2 [by @d4rken]

Congratulations to the SDK maintainers and contributors for these great releases!

New and updated guides and FAQs

New:

Updated:

New plugins

By the Matomo team and InnoCraft:

Custom Translations

By third party developers:

Need help upgrading Matomo?

Read the Updating Matomo user guide or for more help contact the Matomo experts.

List of 207 tickets closed in Matomo 3.8.0

matomo-org/matomo

#2888 Lock down accounts by IP after N failed attemps at logging [by @tsteur]
#13325 Two Factor Authentication in core + new setting “Require two-factor authentication for everyone.” [by @tsteur]
#955 Evolution graphs: buttons to switch the display of historical data by day, week, month or year [by @tsteur]
#5267 Display a new row “Total” showing the sum of values for all DataTable columns [by @tsteur]
#7414 When a report is flattened, show the Row Evolution icon [by @sgiehl]
#12795 Integrate the URL Builder directly into the app [by @tsteur]
#12170 Enable by default to store all session data in the database + remove feature of file-based sessions in tmp/sessions/* [by @tsteur]
#4301 Visitor Profile – Zoom map as near as possible [by @tsteur]
#12163 When exporting a flattened report, keep each flattened dimension as a separate column [by @sgiehl]
#12865 New report “Transitions” available under the “Actions” category [by @tsteur]
#6641 Use navigator.sendBeacon by default and minimise the tracker pause from 500ms to 100ms [by @tsteur]
#13815 Delete unused actions only at least monthly [by @tsteur]
#13305 Tooltips appear all over the place but shouldn’t [by @tsteur]
#13194 Edit capabilities in Users management pages [by @diosmosis]
#2932 When changing password or email address, require to type old password [by @tsteur]
#12785 Make matomo.js and matomo.php the default Tracking API endpoints used [by @tsteur]
#13698 Filter in Edit user permission view is confusing [by @diosmosis]
#13251 Make all emails use the pretty HTML emails with branding
#10685 Tracking API behaviour on incorrect token_auth should be improved
#13586 When creating HTML reports in tmp/assets/ include a random string in the filename [by @tsteur]
#13798 Introduce whitelist test for link protocols. [by @diosmosis]
#2814 nginx and lighttpd configuration recommendations
#3802 Allow excluding IPv6 addresses for tracking
#9227 Setup on demo.matomo.cloud a showcase of all Piwik features
#10054 add some “events” to demo
#10055 Add some “content tracking” to demo
#10914 Read Environment variables into Matomo config [by @tsteur]
#12183 “Loading data..” is not always displayed when changing dates in the dashboard [by @tsteur]
#12922 Report tracking into wrong Site ID [by @tsteur]
#12969 Rename Referrer Type to Acquisitions Type (or Channel) [by @tsteur]
#13489 Dashboard selector listing all widgets is hidden once the scroll bar is used [by @tsteur]
#13567 admins can’t share dashboard with users [by @tsteur]
#13679 Callback after tracking goal [by @tsteur]
#11645 flattened “entry page” and “exit page” take a long time to be generated [by @tsteur]
#13116 Content Tracking may cause huge POST requests to be sent (50Kb or more) [by @tsteur]
#13329 Segmented Visitor Log high CPU load [by @tsteur, @sgiehl]
#13536 Cache cacheBuster generation when rendering a view [by @tsteur, @sgiehl]
#13427 SEO plugin Alexa broken
#13800 deleteLogDataForDeletedSites locks database for a long period, bogus query? [by @tsteur]
#13828 Double encoded single quotes in goal names [by @sgiehl]
#13883 Fatal error in Goals/Pages.php, report is null [by @tsteur]
#13419 Same icon is used for “segmented visitor log” and “show visitor profile” [by @tsteur]
#13005 Make log and report data screen less technical [by @tsteur]
#13328 When you are logged out, the URL gets lost when you log in [by @tsteur]
#13456 Locations users country map should use Unique visitors by default [by @sgiehl]
#13597 When token_auth is re-generated, remove wording that user will be logged out [by @tsteur]
#1781 New diagnostic checking that max_allowed_packet is at least 64M or issue warning, and recommend 128M [by @tsteur]
#2857 Change html markup from xhtml4 to html5
#7052 Documentation for installing GeoIP PECL extension misleading
#7719 Write a user guide for Custom Alerts
#13566 Updates composer libraries [by @sgiehl]
#13910 Updates Device Detector to 3.11.4 [by @sgiehl]
#12284 Standardise actions of last visitor API output [by @tsteur]
#13539 Update JavaScript code in app/docs/faq to use window._paq instead of _paq [by @tsteur]
#13640 Adds new event to define units for metrics [by @sgiehl, @diosmosis]
#2956 Actions>Page Titles believes there is a subpage if page <title> includes a forwards slash [by @tsteur]
#11204 Event tracking with trackEvent: a value of 0 (zero) is not recorded [by @tsteur]
#13466 possible error while exporting API data [by @diosmosis]
#13513 Prevent trigger errors on demand for instances that are opened to anonymous [by @tsteur]
#13643 Unsubscribe link in scheduled report missing when report format is PDF [by @diosmosis]
#13648 Content Tracking not logged on a page with q= is in url ? [by @tsteur]
#13781 Matomo crash when user has view rights
#13786 Report for “today” is not the same as report for any date explicitly selected
#13835 Matomo Tag Manager can be uninstalled [by @tsteur]
#13849 Do not show plugins notice when plugins admin is disabled [by @tsteur, @diosmosis]
#13871 [automatic translation update] Updated 1740 strings in 48 languages (es, nl, ar, de, el, it, pl, pt, sq, sv, tr, et, fa, fi, ja, cs, da, fr, hi, hu, id, ko, nb, pt-br, ro, ru, sl, sr, tl, uk, vi, zh-cn, zh-tw, be, bg, ca, es-ar, eu, hr, is, ka, lv, nn, sk, ta, te, th, he) [by @sgiehl]
#13915 [automatic translation update] Updated 651 strings in 8 languages (ru, zh-cn, es, pl, de, el, it, sq) [by @sgiehl]
#13927 [automatic translation update] Updated 331 strings in 7 languages (de, el, es, it, sq, tr, be) [by @sgiehl]
#13938 [automatic translation update] Updated 5 strings in 2 languages (es, ru) [by @sgiehl]
#13956 [automatic translation update] Updated 118 strings in 4 languages (ja, zh-cn, pt, de) [by @sgiehl]
#8758 Demo the awesome ecommerce functionnality
#11810 Release a last Piwik 2.18.0 version to announce end of LTS for Piwik 2 [by @tsteur, @mattab]
#12199 Keep flattened columns as extra columns [by @sgiehl, @diosmosis]
#12810 Improve wording of Opt-out-iFrame text [by @diosmosis]
#13175 Visit by hour should show report based on first action time [by @tsteur, @diosmosis]
#13272 Quickform2 throws warnings with PHP7.2 [by @tsteur]
#13277 Change default opt out text & allow opt out text to be customized across entire install [by @diosmosis]
#13307 Better wordings for sorting “alphabetically”. [by @johsin18, @sgiehl]
#13378 csv export is empty when using segmentation filters
#13518 Updated menu structure and naming fixes [by @tsteur, @diosmosis]
#13552 Added Fallback Method for Alexa in SEO Plugin [by @ozdemirburak, @diosmosis]
#13616 Add possibility to queue tracking requests so they are sent in bulk [by @tsteur]
#13633 prefer Gzip to Deflate [by @Findus23, @sgiehl]
#13634 Fix build and make join table sort stable by using DFS [by @diosmosis]
#13647 MySQL error when specifying offset with getUsersPlusRole API [by @diosmosis]
#13664 Autodiscover tables for segments w/ complex segment expressions [by @diosmosis]
#13667 Support tideways xhprof profiler [by @tsteur, @diosmosis]
#13677 Improved CORSHandler [by @MichaelHeerklotz, @diosmosis]
#13709 Notice – Array to string conversion – Matomo 3.7.0-rc1 – core/Period.php(288) [by @diosmosis]
#13714 Use angular to sanitize plugin description. [by @diosmosis]
#13715 Fix lbraces in widget names before setting widget titles. [by @diosmosis]
#13728 Fix two issues causing new/returning visitor conversion rate to not appear [by @diosmosis]
#13729 In LogAggregator, allow the use of a complex dimension w/ an already defined select as. [by @diosmosis]
#13732 Prevent possible fatal during update [by @tsteur, @diosmosis]
#13734 Update link to the cloud website [by @tsteur, @sgiehl]
#13735 Update app logos [by @tsteur, @sgiehl]
#13745 Update CustomDimensions repo. [by @diosmosis]
#13748 don’t allow chrome to translate Matomo pages [by @Findus23, @diosmosis]
#13758 Use new exception in PluginsArchiver & add previous exceptions to backtrace in fatal error report [by @diosmosis]
#13760 disable xdebug for all php versions [by @sgiehl]
#13766 Small API changes needed for a translation plugin [by @tsteur]
#13788 Mention the –yes flag in core:update description [by @axilleas, @tsteur]
#13789 Fix header color style should not be applied to menu [by @tsteur]
#13799 For special dates in evolution graphs, calculate date & timezone together, to get proper result. [by @diosmosis]
#13806 Wrong counting of concurrent archivers
#13808 Fixing build [by @diosmosis]
#13823 Fix possible json encoding error [by @tsteur]
#13826 Add user UI broken in IE11 [by @tsteur]
#13851 Trigger new event when a tracker has been added [by @tsteur, @diosmosis]
#13852 Upgrade to 3.8.0b4 triggered failure to login without ‘session_save_handler = ‘
#13855 Make sure to always trigger a callback in JS trigger when specified [by @tsteur, @diosmosis]
#13865 Fallback to php serialize handler in sessions when igbinary is used [by @tsteur, @diosmosis]
#13867 Force tracker failure if location url params are used in unauthenticated request. [by @diosmosis]
#13869 Send all session cookie params when updating session expire time. [by @diosmosis]
#13873 Allow setting different log levels per log writer if desired. [by @diosmosis]
#13874 Add generated unique request ID used in logs as custom HTTP header. [by @diosmosis]
#13901 fix donate widget [by @Findus23, @mattab]
#13912 Add config setting to disable sending emails. [by @diosmosis]
#13959 Skip downloading discontinued GeoLite databases without an error [by @sgiehl, @mattab]

matomo-org/tag-manager

#122 Matomo tag: set a custom page name when tracking a pageview [by @tsteur]
#133 Variable for Matomo idSite not working [by @tsteur]
#135 Trigger activity only if that api was called directly [by @tsteur]
#137 Make sure super user can edit custom templates when only allowing super user [by @tsteur]
#99 Etracker event [by @ben-dw, @tsteur]
#124 Tag Manager out of beta [by @tsteur]
#126 Improve TagManager plugin activation behaviour [by @tsteur]
#127 Update UI test files after theme update [by @sgiehl, @tsteur]
#130 Event Value: “The value is not a number” when using variable [by @tsteur]
#143 Load matomo tracker only when the tracker is fired [by @tsteur]
#145 Prevent possible recursion when custom tags are disabled [by @tsteur]

matomo-org/matomo-log-analytics

#224 Support replay of piwik.php and matomo.php
#235 By default support replaying tracking requests to both piwik.php and matomo.php. [by @diosmosis]

matomo-org/device-detector

#5808 Missing detections for known brands and new browsers
#5871 Added Breaker to client regular expressions. [by @scrothers, @sgiehl]
#5872 Adds detection for Impression, Vinsoc and Zync devices [by @sanchezzzhak, @sgiehl]
#5875 Added devices and tests related to #5874 and #5873 [by @GregOriol, @sgiehl]
#5876 Add Pecl YAML parser [by @mallsbill, @sgiehl]
#5877 Improves detection of Trekstor devices [by @sgiehl]
#5879 Adds OS detection for TwitterAndroid [by @arvinv, @sgiehl]
#5882 Add huawei devices [by @pongee, @sgiehl]
#5883 Adds detection for Advance devices [by @sgiehl]
#5884 Adds detection for Sanei devices [by @sgiehl]
#5886 Adds detection for new Google bot [by @liviuconcioiu, @sgiehl]
#5888 Cannot detect models and brands of Huawei
#5889 Some Brand Model not get Detected [by @sgiehl]
#5890 Adds detection for some missing devices [by @sgiehl]
#5891 Adds detection for Sky and Vestel devices & Mastodon bots [by @sgiehl]
#5892 Added a few Android devices [by @GregOriol, @sgiehl]

matomo-org/referrer-spam-blacklist

#934 Add blog2019.xyz [by @ericguirbal, @spmedia]
#935 Add mycheaptraffic.com [by @nubranch, @spmedia]
#936 Add growth-hackingan.info [by @nubranch, @spmedia]
#937 Add getfy-click.info [by @nubranch, @spmedia]
#938 Add perform-like-alibabaity.info [by @nubranch, @spmedia]
#940 Add seo-services-b2b.com [by @nubranch, @spmedia]
#941 Add krumble-adsen.info [by @nubranch, @spmedia]
#942 Add growth-hackingy.info [by @nubranch, @spmedia]
#945 Add krumble-adsde.info [by @nubranch, @spmedia]
#946 Add seo-services-wordpress.com [by @nubranch, @spmedia]
#947 Add auto-b2b-seo-service.com [by @nubranch, @spmedia]
#948 Add for-marketersy.info [by @nubranch, @spmedia]
#949 Add local-seo-for-multiple-locations.com [by @nubranch, @spmedia]
#950 Add 12-reasons-for-seo.net [by @nubranch, @spmedia]
#951 Update spammers.txt [by @spmedia]
#952 Add 100-reasons-for-seo.com [by @nubranch, @spmedia]
#953 Add 99-reasons-for-seo.com [by @spmedia]
#954 Add 99-reasons-for-seo.com [by @nubranch, @spmedia]
#955 Add 15-reasons-for-seo.com [by @nubranch, @spmedia]
#956 Add blogseo.xyz [by @ericguirbal, @spmedia]
#957 Add vardenafil20.com [by @smokris, @spmedia]
#958 Add seobook.top [by @smokris, @spmedia]
#959 Patch 21 [by @nubranch, @spmedia]
#960 Add 2-best-seo.com [by @nubranch, @spmedia]
#961 Add 3-best-seo.com [by @nubranch, @spmedia]
#962 Add 4-best-seo.com [by @nubranch, @spmedia]
#963 Add 5-best-seo.com [by @nubranch, @spmedia]
#964 Add 6-best-seo.com [by @nubranch, @spmedia]
#965 Add 7-best-seo.com [by @nubranch, @spmedia]
#966 Add 8 and 9-best-seo.com [by @nubranch, @spmedia]
#967 Add seo-tips.top / xtrafficplus.com
#968 Added seo-tips.top [by @daniol, @spmedia]
#969 Add kozhniebolezni.com [by @smokris, @spmedia]
#970 Add promotion-for99.com [by @spmedia]
#971 Add dailyseo.xyz [by @smokris, @spmedia]
#974 Add bestfortraders.com [by @ericguirbal, @spmedia]
#975 Add videotop.biz [by @ericguirbal, @spmedia]
#976 Add svensk-poesi.com [by @ericguirbal, @spmedia]
#977 Add hit-kino.ru [by @ericguirbal, @spmedia]
#978 Add rus-lit.com [by @ericguirbal, @spmedia]
#979 Add jav-fetish.site [by @ericguirbal, @spmedia]
#980 Add serialsx.ru [by @ericguirbal, @spmedia]
#981 Add okoshkah.com [by @ericguirbal, @spmedia]
#982 Add onlinewot.ru [by @ericguirbal, @spmedia]
#983 Add eurocredit.xyz [by @ericguirbal, @spmedia]
#984 Add tamada69.com [by @ericguirbal, @spmedia]
#985 Add drev.biz [by @ericguirbal, @spmedia]
#986 Add porndl.org [by @ericguirbal, @spmedia]
#987 Add arabic-poetry.com [by @ericguirbal, @spmedia]
#988 Add allvacancy.ru [by @ericguirbal, @spmedia]
#989 Add belreferatov.net [by @ericguirbal, @spmedia]
#990 Add wakeupseoconsultant.com [by @spmedia]
#991 Add moyparnik.com [by @ericguirbal, @spmedia]
#992 Add inmoll.com [by @ericguirbal, @spmedia]
#993 Add kakadu-interior.com.ua [by @ericguirbal, @spmedia]
#994 Add ege-essay.ru [by @ericguirbal, @spmedia]
#995 Add sssexxx.net [by @ericguirbal, @spmedia]
#996 Add pornhive.org [by @ericguirbal, @spmedia]

matomo-org/matomo-php-tracker

#39 Custom IP should be only sent when token is specified, otherwise the request fails [by @tsteur, @diosmosis]

We are together creating the best open analytics platform in the world. You can help make Matomo even more awesome by getting involved in Matomo!