jeffersongoncalves / laravel-goatcounter

1.1.0 2026-10-09 17:15 UTC

Requires

• php: ^8.2|^8.3|^8.4
• laravel/framework: ^12.61.1|^13.12.0
• spatie/laravel-package-tools: ^1.14.0
• spatie/laravel-settings: ^3.0

Requires (Dev)

• larastan/larastan: ^3.0
• laravel/pint: ^1.27
• orchestra/testbench: ^10.0|^11.0
• pestphp/pest: ^3.7.4|^4.0
• pestphp/pest-plugin-laravel: ^3.0|^4.0

MIT

• Jefferson Gonçalves

• analytics
• laravel
• privacy
• cookieless
• open-source
• jeffersongoncalves
• spatie-laravel-settings
• laravel-goatcounter
• goatcounter

Published on Packagist.org on 2026-10-09 17:15 UTC

README

Laravel GoatCounter

Add GoatCounter — open source, privacy-friendly web analytics — to your Laravel app. The settings are stored in the database with spatie/laravel-settings, so you can change them at runtime (e.g. from an admin panel) instead of in .env.

For a Filament settings page, use jeffersongoncalves/filament-goatcounter.

Installation

composer require jeffersongoncalves/laravel-goatcounter

Publish and run the settings migration:

php artisan vendor:publish --tag=goatcounter-settings-migrations
php artisan migrate

Configuration

$settings = goatcounter_settings();
$settings->code = 'mysite';
$settings->save();

Or through the settings class or the Facade:

use JeffersonGoncalves\GoatCounter\Facades\GoatCounter;
use JeffersonGoncalves\GoatCounter\Settings\GoatCounterSettings;

$settings = app(GoatCounterSettings::class);
$value = GoatCounter::getFacadeRoot()->code;

Available settings

Setting	Type	Default	Description
code	?string	null	Your GoatCounter code. The script only renders when it is valid.

Usage

Add the script to your Blade layout, inside <head>:

@include('goatcounter::script')

Nothing is rendered until the settings are complete, so you can ship the include everywhere and turn GoatCounter on later.

Content Security Policy

When your app sets a CSP nonce through Laravel's Vite (Vite::useCspNonce(), as laravel-security-headers does), every <script> this package renders carries it, so a script-src 'self' 'nonce-{nonce}' policy works without 'unsafe-inline'. Scripts loaded afterwards from the vendor's own CDN still need that host in script-src (and its API in connect-src).

Testing

composer test

Changelog

Please see CHANGELOG for more information on what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

• Jefferson Gonçalves
• All Contributors

License

The MIT License (MIT). Please see License File for more information.