Matomo 6.0.0 RC - Analytics Platform

What’s new in our latest release?

Matomo 6.0.0 is the first major release since December 2023. It modernises the platform with PHP 8.1, MySQL 8 and a rebuilt front-end toolchain. It also builds spam and bot filtering into Matomo, introduces completely redrawn visitor maps, and applies the new design system to dropdowns, search fields and report headers.

On-Premise administrators should review the system requirement changes before updating.

Release Highlights

Improve Time on Page insights

With improvements to the Average Time on Page metric, you now get more accurate results automatically. This makes it easier to see which pages capture visitors’ attention and understand how they engage with your content.

Greater control over API token permissions

API tokens now support individual access levels allowing you to create read-only tokens without granting full user permissions. Users have greater control over data access and helps protect your Matomo instance when connecting external tools and integrations.

Percentage metrics included in Scheduled Reports

Scheduled Reports now include percentage-of-total columns, such as Visits (%) and Actions (%), in HTML emails, CSV and TSV exports. These additional metrics help you see how individual rows contribute to report totals without manual calculations.

Less junk in your data

Spam and bot filtering, previously available as a separate plugin, is now part of Matomo and enabled by default.

A fresh look at your maps

Visitor and real-time maps have been enhanced using current geographic data, improving region highlighting and country label accuracy.

Consistent controls everywhere

Dropdowns, select fields and search boxes now share a consistent appearance and behaviour, and reports use the same header design.

Faster page reports

New installations archive page URL and page title reports from a single flattened record, improving performance for large sites.

Update Matomo to the latest release

Before updating, confirm that your system meets the following requirements and plan for the database change included in this release.

System requirements

Matomo 6 requires PHP 8.1 or newer and MySQL 8.0 or MariaDB 10.6. Installations using older versions must upgrade them before updating Matomo.

Database upgrade

This release adds a consent column to the log_visit table in preparation for consent tracking. The update runs an ALTER TABLE operation, which may take time on installations with a large visits log.

The database upgrade also creates the log_page_view_time table to store one row per page view. On large installations, creating this table and adding the consent column to log_visit may be the most time-consuming part of the upgrade.

Need help updating Matomo?

Read the Updating Matomo user guide or for more help we offer paid support plans.

After you update

Please help us spread the word! Maybe you can write about the project on your blog, website, social media, get involved with MatomoCamp or let your friends and colleagues know what is Matomo. Already 1,000,000+ websites are keeping full control of their web analytics with Matomo!
Use the community forums if you have any question or feedback (free support), or purchase a Support Plan to get professional support and guidance.
To improve Matomo in your language, consider contributing to translations.
You can also purchase valuable Premium Features for Matomo or try our Matomo Cloud solution.

Tickets closed in Matomo 6.0.0

Requirements and removals

#21736, #24638 Require PHP 8.1 or newer. Installations using PHP 8.0 or older must upgrade PHP before updating to Matomo 6. [by @mneudert, @sgiehl]
#24858 Require MySQL 8.0 or MariaDB 10.6. Matomo now validates the actual database server type, distinguishes MariaDB Enterprise from Community and removes the experimental TiDB schema. [by @sgiehl]
#24877 Require One Click Update to download over HTTPS by removing the option to retry over HTTP. [by @sgiehl, @chippison]
#18675, #25206 Validate the effective hostname for Matomo installations behind a proxy. Before updating an installation that uses proxy_host_headers, add both the public hostname and the hostname used to access Matomo to trusted_hosts. [by @sgiehl]
#25062 Add a consent column to log_visit in preparation for consent tracking. The database upgrade runs an ALTER TABLE operation on the visits table. [by @sgiehl]
#19665, #21780 Remove the SEO plugin and the SEO.getRank API method. The SEO Rankings widget was retired in Matomo 5.9 because it could no longer retrieve rankings reliably. [by @sgiehl, @chippison]

Core improvements

#25035, #25079 Build Tracking Spam Prevention into Matomo and enable it by default, including filtering for headless-browser traffic generated by AI tools. The plugin is no longer available from the Marketplace and cannot be uninstalled. [by @sgiehl]
#10739, #24983 Add a …_percent_of_total column for each metric in API responses and every export format. Add percent_of_total=0 to a request to retain the previous columns. [by @caddoo]
#11929, #9170, #10963, #24878 Regenerate visitor and real-time maps using current geographic data to improve region matching, highlighting and country accuracy. [by @sgiehl, @ysard]
#25150 Archive page URL and page title reports from a single flattened record on new installations, improving performance for large sites and preventing long page categories from being truncated with a summary row. Updated installations retain their existing behaviour. [by @sgiehl, @snake14]
#24788, #24841 Measure time on page per page view in a new log_page_view_time table, and accept a tracker-supplied pv_time value [by @caddoo]
#24450 Give each auth token its own access level, so a token can be read-only instead of inheriting everything its owner can do [by @mneudert]
#24990 Add percentage-of-the-report-total columns to scheduled reports in HTML, PDF, CSV and TSV [by @tzi]
#25208 Split cloud hosting provider blocking into two settings, and make the organisation list editable again [by @snake14]
#25332 Run the ungrouped visits log query on every installation, so a page or event segment no longer sorts every matching visit [by @chippison]
#25304, #25368 Speed up row evolution on deep Actions labels, and reuse one reader for flat archive records [by @sgiehl, @chippison]
#25497 Load Manage Segments rows and sparklines as they come into view, one at a time [by @tzi]
#25543, #25577 Stop tracking requests loading the autoloaded options, and stop tracker workers deadlocking on log_page_view_time [by @tzi, @snake14]
#25410 Add the core:rotate-encryption-keys console command, with a dry run [by @snake14]
#25449, #25493, #25502, #25542 Let super users unsubscribe from plugin request emails, keep a trial request history, and check for requests less often [by @snake14]

Interface improvements

#23917, #25033, #25100, #24868 Standardise dropdowns, select fields, menus and reorderable lists across Matomo. [by @snake14, @chippison, @tzi]
#24970, #24991 Use a consistent search component for menu search, segment search and quick access, and support pasted text and input method editors in quick access. [by @tzi]
#24966, #24989 Use a consistent header for full-page reports, exported widgets and dashboard widgets, and add a More details link when an online guide is available. [by @tzi]
#25109, #25122, #25131 Rebuild the Transitions report as a Vue component and retain its side-by-side layout in narrow panes by allowing horizontal scrolling. [by @chippison]
#24891, #24953 Separate the green success colour from Matomo’s teal brand colour. [by @tzi]
#24987, #25225, #25290, #25401, #25402, #25412, #25424, #25499 Redesign the site selector dropdown, render the metric picker with the shared selector, settle the report header on hover, move the expandable select’s option list out of its container, and turn borders, tooltip type and the positive, negative and neutral colours into theme tokens [by @tzi, @snake14, @chippison]
#25413, #25473, #25496 Stack the All Websites cards on small screens, fit the KPI band on one row, and show the exact figure on hover [by @tzi]
#25472 Let arrow keys move through and select in “Choose metrics” [by @tzi]
#25287 Tidy spacing and touch targets in the mobile menu [by @tzi]

Bug fixes

#23979, #24854 Update report help when switching between related reports. [by @chippison]
#20216, #24742 Allow Unique Visitors and Unique Users to be selected as KPIs for weekly and monthly periods. [by @chippison]
#24543 Correctly combine a selected report row with an applied segment when opening the visits log, and clarify the popup title. [by @tzi]
#24088, #25094 Position country labels inside the correct country on region maps. [by @sgiehl]
#25161 Show the selected data period in downloaded HTML reports instead of the report delivery schedule. [by @sgiehl]
#25001, #25002 Prevent correctly rendered dashboard widgets from displaying an error caused by an internal API call. [by @snake14, @sgiehl]
#25040 Apply the correct comparison colours to overview card sparklines from the first page load. [by @tzi]
#25501, #25509 Include a plugin’s re-archived reports in week, month and year totals [by @snake14]
#25425, #25462, #25475, #25486, #25532 Carry the clicked row into the visits log, the segment created from it and the export, and export the report on screen after switching dimension [by @chippison, @AltamashShaikh, @awss1i]
#25350 Credit a conversion to the custom dimension value its visit ended with when the conversion arrived first [by @tzi]
#25271 Stop percentages decoding as stray letters in Turkish and Kurdish, where the percent sign precedes the number [by @snake14]
#25248 Apply the language URL parameter to the whole interface, not only the selectors [by @tzi]
#25485, #25505 Make usernames readable in dark mode in the “Copy dashboard to user” dropdown [by @tzi]
#25465 Allow an invitation to be sent again when a user confirmed without setting a password [by @AltamashShaikh]
#25197, #25489 Accept HTTP authentication credentials consisting of 0 [by @Ehsan-hash]
#25434 Stop reusing translations cached by the previous version after an update [by @tzi]
#25310, #25552 Continue updating plugins past one that fails, and render install and update results in their own request [by @sgiehl, @snake14]
#25159 Make the DataTable pattern filter case-insensitive for accented and non-Latin text [by @oliinykdm]
#25110 Replace the loading indicator that painted a white block in dark mode [by @chippison]
#25230 Keep the update notification open while the pointer moves into it, so its links can be clicked [by @tzi]
#25236 Tell the user that real-time AI chatbot reports ignore the selected segment [by @tzi]

Security and privacy

#22605 Require Write permission to add, edit or delete annotations through the API. [by @sgiehl]
#24865 Prevent user capabilities from being granted or removed when user management is disabled. [by @sgiehl]
#24917 Respect the visits log setting for every site included in a Live API request. [by @chippison]
#25137 Harden tracking code generation by escaping output consistently, preventing unusable tracker URLs and requiring view access to generate image tracking code. [by @sgiehl]
#24864 Use constant-time comparisons for signed cookie values, improve pattern handling when rewriting URL parameters in the browser and remove unused internal methods. [by @sgiehl]
#25306 Require the word delete to be typed before automatic data deletion and the CNIL retention setting are turned on [by @chippison]
#25347 Filter a dashboard layout against the widgets the user may use before serving it, instead of relying on the browser to hide them [by @tzi]
#25378 Stop a concurrent request restoring a session that has just been ended [by @tzi]

Platform changes for plugin developers

#24880, #24893 Remove long-deprecated APIs, including Archive::getBlob(), Report::getThirdLeveltableDimension(), API.getSettings, the [APISettings] configuration section and database adapters’ getDefaultPort(). See CHANGELOG.md for their replacements. [by @sgiehl, @caddoo]
#23183, #25072, #24988, #24933 Remove the archive.sh script, deprecated Git console commands, the jQuery UI liveWidget and obsolete PHP polyfills. Use core:archive and the Live.AutoRefreshWidget Vue component instead. glob() must no longer be listed in disable_functions. [by @sgiehl]
#25074 Preserve parameter whitespace and value types when parsing requests. Use Request::getBoolParameter() to read Boolean parameters. [by @sgiehl]
#24869 Add the #[Piwik\Http\JsonResponse] attribute for returning JSON from controller actions. An overriding subclass must redeclare the attribute. [by @sgiehl]
#21440, #24668, #25027 Move the front-end build from Vue CLI to Vite on Node 24, update to Vue 3.5 and use Vitest. The vue:build command no longer creates an unminified bundle, so plugin authors can remove committed vue/dist/<Plugin>.umd.js files. [by @sgiehl]
#25051 Update all eleven Example plugins to use native types, current APIs and a consistent structure. [by @sgiehl]
#24925, #24937 Remove unused colour variables and Piwik-era aliases, and deprecate component-oriented theme variables in favour of usage-oriented names. Deprecated variables remain available until Matomo 7. [by @tzi]
#25305, #25613, #25615, #25616, #25617, #25618, #25619, #25623, #25628 Answer an unknown website, module, action, visitor profile or plugin licence, a brute-force-blocked address, an administration page for a disabled feature, invalid opt-out styling and an unusable parameter value with 400, 403 or 404 instead of 500, and log them at debug level [by @sgiehl]
#25612, #25626 Separate client errors from server errors at the tracking endpoint, and reject a custom timestamp that cannot be parsed, is more than a day in the future or more than twenty years old with 400 [by @sgiehl]
#25451 Pass the archive processor to the Archiver.filterRecordBuilders event [by @snake14]
#25376 Drop the “Goals Overview” entries that no report serves from the report metadata [by @mneudert]
#25316, #25318, #25328, #25354, #25358, #25362, #25603 Remove checks the PHP 8.1 and MySQL 8.0 floors made impossible and adopt the string and array functions they allow [by @sgiehl]

Matomo Tag Manager

tag-manager #1219 Show who created each container version and who published it to each environment [by @snake14]
tag-manager #1226 Keep the tag, trigger and variable lists loading, and the container publishable, when a type is no longer available [by @lachiebol]
tag-manager #1218, tag-manager #1224 List every item that still uses a trigger or variable before it can be deleted, and link each reference to its edit form [by @snake14]
tag-manager #1236 Let the Activity Log filter Tag Manager activities by container, tag, trigger, variable or version [by @snake14]
tag-manager #1190 Type tag, trigger and variable type parameters as plugin settings [by @mneudert]
tag-manager #1179, tag-manager #1184, tag-manager #1207 Follow the restyled selects, the shared loading indicator and the border colour variable [by @snake14, @chippison]

New and Updated Guides and FAQs

Updated: