{
 "slug": "matomo",
 "name": "Matomo",
 "tagline": "Web analytics platform that keeps visitor data on your own server",
 "category": "analytics-bi",
 "use_cases": [
  "web-analytics",
  "privacy",
  "google-analytics-alternative"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Matomo (InnoCraft Ltd / Matomo community)",
  "url": "https://matomo.org",
  "license": "GPL-3.0",
  "license_url": "https://github.com/matomo-org/matomo/blob/5.x-dev/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "5.14.2",
   "last_build": "2026-10-25",
   "entity_id": "prod-a3tcs7lr4rd36",
   "ami_alias": "/aws/service/marketplace/prod-a3tcs7lr4rd36/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-dpyu5lwugfuba",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "5.14.0",
   "last_build": "2026-10-24",
   "offer_id": "matomo",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:matomo:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.matomo?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/matomo/",
  "json": "https://lynxroute.com/products/matomo/product.json"
 },
 "release_notes": [
  {
   "version": "5.14.2",
   "title": "Matomo 5.14.2",
   "notes": "* Matomo updated 5.14.0 -> 5.14.2, a patch release with no database upgrade. GPL-3.0 unchanged\n* Security: keeps the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619) via Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 or newer (USN-8948-1)\n* HTTPS on by default: self-signed TLS on port 443; Certbot pre-installed - sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-25"
   }
  },
  {
   "version": "5.14.0",
   "title": "Matomo 5.14.0 r2",
   "notes": "* Security: ships the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619; unauthenticated remote code execution in PHP) via Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Earlier images of this product carry the vulnerable PHP and should be replaced\n* The application version is unchanged (Matomo 5.14.0); this is a security rebuild\n* HTTPS on by default: self-signed TLS on port 443; Certbot pre-installed - sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23",
    "azure": "2026-10-24"
   }
  },
  {
   "version": "5.14.0",
   "title": "Matomo 5.14.0",
   "notes": "* Matomo updated 5.13.0 -> 5.14.0. GPL-3.0 unchanged\n* Aggregated real-time visit and action counters keep live reporting available when the Visits Log is disabled for compliance reasons\n* Goal conversions now appear in bar, pie and evolution charts, and forecasts extend to unique visitors and distinct counts\n* Security: changing trusted hosts now requires password confirmation, API responses and generated reports are sent with strict security headers, and two-factor exemptions are tied to the token that granted access\n* Changed for integrations: exporting a single goal report returns only the columns shown in the interface, and tooltips render only simple inline formatting\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23",
    "azure": "2026-10-24"
   }
  },
  {
   "version": "5.13.0",
   "title": "Matomo v5.13.0",
   "notes": "* Re-release of Matomo 5.13.0. The application version is unchanged; this build refreshes the underlying operating system image\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-03",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "5.13.0",
   "title": "Matomo 5.13.0",
   "notes": "* Matomo 5.13.0 on Ubuntu 24.04 LTS - feature update (from 5.12.0), shipped as GPL v3 core. See the upstream changelog at https://matomo.org/changelog/matomo-5-13-0/. No major database upgrade required.\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-03",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "5.12.0",
   "title": "Matomo 5.12.0",
   "notes": "* Matomo 5.12.0 on Ubuntu 24.04 LTS - feature update (from 5.11.2); adds AI Chatbots reports and refreshed evolution graphs, shipped as GPL v3 core. No major database upgrade required.\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-20",
    "azure": "2026-07-20"
   }
  },
  {
   "version": "5.11.2",
   "title": "Matomo 5.11.2 - June 2026",
   "notes": "* Matomo 5.11.2 on Ubuntu 24.04 LTS - security maintenance release (patch from 5.11.1); hardening across annotation date handling, dashboard export escaping, widgetization, password confirmation for mail-setting changes, and 2FA logging for failed logins. No database upgrade required.\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-24"
   }
  },
  {
   "version": "5.11.1",
   "title": "Matomo 5.11.1 - June 2026",
   "notes": "* Matomo 5.11.1 on Ubuntu 24.04 LTS - security release; certbot pre-installed for one-command trusted HTTPS\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-16"
   }
  },
  {
   "version": "5.11.0",
   "title": "Matomo 5.11.0 - Initial release (June 2026)",
   "notes": "* Matomo 5.11.0 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Unique MariaDB password generated at first boot; no admin pre-seeded\n* TLS on port 443; database and PHP-FPM bound to localhost only\n* Hourly report archiving as a scheduled task; browser archiving disabled\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-11"
   }
  }
 ],
 "release_history": [
  {
   "version": "5.14.2",
   "aws": "2026-10-25"
  },
  {
   "version": "5.14.0",
   "aws": "2026-10-23",
   "azure": "2026-10-24"
  },
  {
   "version": "5.13.0",
   "aws": "2026-09-03",
   "azure": "2026-08-19"
  },
  {
   "version": "5.12.0",
   "aws": "2026-07-20",
   "azure": "2026-07-20"
  },
  {
   "version": "5.11.2",
   "aws": "2026-06-24"
  },
  {
   "version": "5.11.1",
   "aws": "2026-06-16"
  },
  {
   "version": "5.11.0",
   "aws": "2026-06-11"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-a3tcs7lr4rd36/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer matomo --plan payg-gen2\naz vm create -g my-rg -n matomo --size Standard_D2s_v3 \\\n  --image lynxroute:matomo:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Matomo is the leading open-source web analytics platform and a privacy-friendly alternative to Google Analytics, used on over one million websites. It is a PHP application backed by a MySQL/MariaDB database and served by nginx with PHP-FPM. Matomo gives you visits and pageview reporting, visitor logs and profiles, real-time analytics, acquisition and campaign tracking, goals and e-commerce conversion, custom segments and dimensions, heatmaps and session-recording add-ons, a JavaScript tracker (matomo.js) and a server-side tracking API (matomo.php), an HTTP Reporting API, and a built-in Tag Manager. Because you self-host it, all visitor data stays inside your own AWS account, which makes GDPR, CCPA, and data-residency compliance straightforward. Matomo is GPL-3.0 licensed with no vendor lock-in; premium features are optional separate plugins and are not required to run it.",
  "image_adds": "Security hardening:\n* Unique MariaDB password generated at first boot (no shipped default credential)\n* No analytics admin account is baked into the image - the first super user you create during the install wizard owns the instance\n* TLS enabled on port 443 with a self-signed certificate (replace with your own CA/Let's Encrypt certificate for production)\n* MariaDB and PHP-FPM bound to 127.0.0.1 only - never exposed to the network\n* Hourly report archiving runs as a scheduled background task; browser-triggered archiving is disabled for predictable performance\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, and AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH key-only access, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}