Most guides on this answer a different question than the one people are actually asking. "Track visitors" usually means one of three things: how many people came, what they did once they got there, or who they were. Free analytics tools handle the first two well. Almost nothing handles the third one completely, and any tool that claims it does is overselling.
Decide what you actually need
Before installing anything, separate the three jobs, because a tool built for one does not do the others.
| What you're asking | Job name | What answers it |
|---|---|---|
| How many people visited, and from where | Traffic counting | Free analytics (GA4, Plausible, server logs) |
| What did they do once they landed | Behavior tracking | Session recording, heatmaps, funnels |
| Who, specifically, was this person or company | Visitor identification | IP based matching tools, login based systems |
Almost every website only needs the first two. Identification is worth the extra cost and complexity mainly for B2B sites trying to spot which companies are researching them, or for anyone who just wants to know which post or campaign a specific click came from. That second case is easier to answer than whole-site identification, and it is often what people meant by the bigger question in the first place.
Set up free analytics for traffic and behavior
Google Analytics 4 is the default choice and it is genuinely free at normal traffic volumes. It reports sessions, page views, referral source, device type, and rough geography, all without identifying anyone. Plausible and similar cookie-light tools give you a lighter, more privacy-friendly version of the same numbers, usually with a simpler dashboard and no cookie banner requirement in most jurisdictions. Neither tool tells you a name. Both are the correct starting point for "check visitors on website" style questions, because that is exactly what they are built to answer.
Add session recording if you want to watch behavior
Microsoft Clarity and similar tools record anonymized replays of real sessions, so you can watch where a visitor's cursor hesitates, which section they scroll past, and where they give up. This is a behavior layer, not an identity layer. Clarity is free with no visitor cap, which makes it worth adding alongside your analytics tool rather than instead of it, since the two answer different halves of "what happened on my site."
Check server logs for a raw, unfiltered count
Every hosting provider keeps raw access logs of every request that hits your server, human or not. This number will not match your analytics dashboard, and that gap is informative rather than a bug. Analytics tools miss visitors who block scripts, run ad blockers, or have JavaScript disabled. Server logs miss nothing, but they also do not filter out bots, so raw log counts run high. Comparing the two gives you a rough sense of how much of your "traffic" is not a person at all.
Try IP based identification if you need names or companies
This is where "how to identify website visitors" gets honest answers instead of hype. IP based identification tools take the IP address behind a visit and try to match it to a company, using a database of known IP ranges, or to a probable individual, using data broker matching. Neither approach identifies every visitor. Shared IP ranges, VPNs, mobile carrier networks using carrier grade NAT, and corporate proxies routinely return either nothing or a match for the wrong company. A vendor that quotes a specific resolution percentage on your traffic before it has ever seen that traffic is guessing. The honest framing is a confidence tier: some matches are strong, most are partial, and a meaningful share of visits will never resolve to anything.
This category is also where what a visitor ID actually is matters, because the identifier assigned to a session is not the same thing as a verified identity, and treating the two as interchangeable is the single most common misread in this space.
Use a link level visitor ID if you only need identity on specific links
A whole-site identification tool is trying to solve a hard, general problem. A narrower and much more answerable version is: who clicked this specific link, from this specific post. That is what a link-in-bio tool with its own visitor ID is built for. Raydar, for example, assigns an IP-hash based visitor ID to clicks on the links it hosts, with an explicit high-confidence and low-confidence split rather than a single blended number, and pairs that with first-touch and last-touch cookies so a click can be tied back to the post or campaign that produced it. It is worth being precise about the boundary here: Raydar can only see activity on the pages and links it actually serves. It has no visibility into what a visitor does on your website afterward, because that is a fundamentally different job, the one covered above under whole-site analytics and identification.
Add a privacy notice and respect opt outs
Anything beyond a raw server log, cookies, session recording, IP based matching, sits inside privacy regulation in most jurisdictions, and the requirements scale with how identifying the data is. A cookie-light analytics tool needs less disclosure than an identification tool that resolves company names. Put a visible privacy notice on the site regardless of which layer you install, honor opt-out requests promptly, and avoid any tool that cannot tell you plainly what it stores and for how long. This is not just a legal formality. A vendor that is vague about what it collects is usually vague about what it can actually do, and the two problems tend to travel together.
A mistake that inflates every number above
Every method on this page, free or paid, is vulnerable to the same quiet distortion: bot and crawler traffic getting counted as human visitors. Search engine crawlers, uptime monitors, link preview generators, and increasingly, AI agents fetching pages on someone's behalf, all generate real HTTP requests that show up in server logs and sometimes in analytics dashboards too. Raw server logs are the most exposed to this, since they log every request with no filtering. Analytics platforms filter out known bots reasonably well, but new or unlisted ones slip through. If your visitor count jumps sharply with no matching change in referral traffic, check for a crawler spike before assuming real interest picked up.
Comparing the free and low-cost options
Six tools cover nearly every version of "website visitor tracking free." Lined up side by side, the tradeoffs get easier to see.
| Method | Cost | Shows behavior | Identifies visitors | Main limitation |
|---|---|---|---|---|
| Google Analytics 4 | Free | Yes, aggregate | No | No individual or company level identity |
| Plausible / cookie-light analytics | Paid, low cost | Yes, aggregate | No | Lighter feature set than GA4 |
| Microsoft Clarity | Free | Yes, session replay | No | No traffic counting on its own |
| Raw server logs | Free (included with hosting) | No | No | Includes bot traffic, needs filtering |
| IP based company identification | Paid, often per-lead pricing | No | Partial, B2B focused, confidence tiers | Fails on VPNs, mobile networks, shared IPs |
| Link-level visitor ID (Raydar and similar) | Free tier available | Click level only | Partial, only on links it serves | Sees your links, not your whole site |
What none of this can do
No method on this list, free or paid, can hand you a name and email for a stranger who lands on your site and closes the tab. Any product that implies otherwise is describing a small, favorable slice of traffic as if it were the whole picture. The honest goal is layering: free analytics for the numbers, session recording for behavior, and identification tools for a partial read on who's showing up, applied where it earns its cost, usually B2B lead research or campaign-level attribution rather than blanket site-wide surveillance. If your actual question is closer to which post or ad produced a click, that is a click tracking problem, and it has a much cleaner answer than whole-site visitor identification does. And if it is a UTM-tagging question specifically, a UTM builder solves it directly without any identification layer at all.