Umami vs Google Analytics

Notice the row about your own server. It's the one thing on this table that only Umami offers.

Umami is free in two ways, and they cover different things. Umami Cloud's Hobby plan costs nothing and needs no server. Self-hosting costs nothing in licences, but you run the server. Pro, at $20 a month, sits between them (pricing, Cloud and self-hosted). Umami Software, Inc. runs Cloud in the United States or Germany, and you pick one at sign-up (terms).

Notice the replays row. Self-hosting gets you the session replays and heatmaps that Cloud keeps for its $200 Business plan, while email reports go the other way.

What counts as an event. On Cloud, each page view is one event, each custom event is one, and each property stored with an event is one more (Cloud FAQ). Say you send a sign-up click with two properties, the plan and the source. That's three events on top of its page view. So Hobby's 100,000 events hold 100,000 page views only if you track nothing else.

Umami doesn't say what happens when Hobby goes over. Paid plans keep collecting and bill the extra. They come with a 14-day trial, and prices are published per month only.

Free hosting for self-hosters. Developers often try to run Umami on free tiers. Vercel's free Hobby plan is for personal, non-commercial use only (Vercel). Supabase's free database holds 500 MB (Supabase), and Neon's free plan gives you 1 GB per project (Neon). A self-hosted Umami keeps every event until you delete it (FAQ), so the database is what runs out. We haven't measured how many events fit in a gigabyte.

Agencies outgrow Hobby first. It allows one site and no team; Pro covers 20 sites and 10 people.

Notice what each one counts, in the last row. Umami's "free" at 100,000 holds only on Hobby with nothing but page views counted, and Nora counts visitors, where Umami counts events.

Read the first six rows as a to-do list. The install, the database, the first password, the updates, the optional parts and the telemetry switch are all yours to handle.

Umami publishes no server sizes, and we haven't benchmarked it. The upgrade threads are the best guide to the upkeep.

• A failed migration. After v3.0, a migration failed on databases that already held data (#3729).
• A busy database. One self-hoster on Hetzner with Coolify watched PostgreSQL take 3 cores and 2.6 GB of RAM after upgrading, until a fresh install restored from backup fixed it (#3777).
• Broken logins. Logins broke for some Docker users after v3.2 (#4352).

All three are closed now.

Security is yours too. In December 2025, a flaw in Next.js (CVE-2025-66478) let attackers run code on unpatched servers, and people running Umami v2 found crypto miners on theirs. Umami shipped a patched v2 within a day, and its maintainer told affected users to change every secret in their environment (#3839). If you self-host, watch the releases.

Our read: the software is free and the upkeep is real. If nobody on your team will watch Umami's releases, Cloud is the easier way to run it.

We installed each tool alone on a test page and opened it in Chrome four ways: as a person who moves the mouse and scrolls, and as three kinds of bot. One announces it's automated. One hides that. One clicks without moving the mouse, the way AI agents click. No data reached Umami or Google; our lab answered every request itself.

Start with weight. Umami's own comparison page puts its script at about 2 KB against about 45 KB for GA4, "over 20x" (Umami). Other pages ranking for this search give GA4 as 28 KB, 45 KB or 74 KB. All of them understate it today. We measured 154 KB as downloaded, about 67 times Umami's 2.3 KB. That's GA4 at its lightest, with a property that has nothing configured; the tags we fetched from real sites were heavier still.

Then the requests. Umami made 1 request per page view, when the page opened. GA4 made 2 requests, one of them as the visitor left. That matters for time on site. Umami's docs say it's counted only for visitors who view more than one page (metric definitions), so a reader who spends ten minutes on one article adds no time, and every one-page visit is a bounce.

Notice the cookie row. GA4 left _ga and _ga_<property>, each for 400 days, which is Chrome's limit; Google sets two years. Umami and Nora left nothing, in cookies or in storage.

Ad blockers stop Umami as well as GA4. EasyPrivacy blocks Umami Cloud's script with a rule for the whole umami.is domain, and GA4's tag too. Self-hosting doesn't escape it by default: the list also blocks any script named umami.js, and script.js on any host whose name starts with "umami." (EasyPrivacy). Umami documents renaming the script and its endpoint (TRACKER_SCRIPT_NAME, COLLECT_API_ENDPOINT) or serving both through your own domain (Umami). Nora isn't on it.

Now the bot rows. Umami's script has no checks for automation, so it sent all three. Its server checks each user agent against the isbot list (code), which includes the word "headless" (isbot). So Chrome as shipped, which announces itself as HeadlessChrome, would most likely be dropped there. The disguised browser and the agent-style click carry an ordinary Chrome user agent, and nothing in Umami sets them apart.

GA4 sent a page view for every visitor and filters known bots later, on its servers (Google). Nora labelled the as-shipped browser a bot and the agent-style click an AI agent. The disguised browser that never touched the page passed as a person, as it did everywhere.

Umami drops a request when its user agent matches the isbot list, and, since v2.18, when the user agent is empty (code, release). DISABLE_BOT_CHECK turns the check off (docs). There's no list of data-centre networks and no check in the script. You can exclude IP addresses and ranges by hand, with IGNORE_IP when self-hosting or IP filters on Cloud from the Pro plan (IP filters). A pull request to flag sessions from data-centre cities was closed without being merged (#3853).

That gap shows up as visitors from Singapore. In one thread, self-hosters found requests from Singapore data-centre addresses with an ordinary Windows Chrome user agent, which no user-agent list can tell from a person. One cut about 80% of them by challenging a single address range at Cloudflare. A user who'd just moved client sites from Matomo found Singapore among their top countries. The thread was closed in December 2025 while users kept reporting (#3862).

A newer thread, open since August 2026, shows rows of near-identical Singapore sessions on Cloud and self-hosted alike. A maintainer says it looks like bot activity, and another user matched them to Alibaba Cloud and other data-centre addresses (#4448).

Google Analytics 4 drops known bots using Google's research and the IAB spiders and bots list. The filter is always on, you can't turn it off, and you never see how many it removed (Google).

AI assistants. Umami's LLM channel, released in v3.2.0 on 24 June 2026 (release), groups visits referred by six domains: chatgpt.com, claude.ai, copilot.microsoft.com, gemini.google.com, meta.ai and perplexity.ai (code). GA4's AI Assistant channel, since 13 May 2026, matches AI assistants by referrer, ChatGPT, Gemini, DeepSeek, Copilot and Grok among them (Google).

Neither labels AI agents. In GA4, visits from ChatGPT Atlas and Perplexity Comet show up as ordinary Chrome, often as Direct (MarTech), and Umami's user-agent check can't tell them apart either.

Nora keeps every page view and labels it: a person, an AI agent or a bot, with the test that caught it (a signature check, the name it gives, how it behaves, machine signs). A bot that a test catches is counted apart from the people, so it doesn't swell a country. One that behaves like a person and gives nothing away still passes.

Our read: Umami's user-agent check is a fair first filter for bots that say what they are. It does nothing for the ones that don't, and that's where the Singapore visitors get through.

None of the three sees crawlers such as GPTBot or ClaudeBot, which fetch pages without running scripts. That takes your server or CDN logs.

Run both and the totals will differ, often by a lot. On one developer's blog over two weeks in 2025, GA4 logged 242 page views and Umami 491, in a test Rybbit sponsored (Tsykin). Four things cause most of the gap.

• Consent. In the EEA, the UK and Switzerland, GA4 needs consent to set its cookies (Google), and visitors who decline go uncounted or estimated. Google models them only once a site has 1,000 declined events a day for a week and 1,000 consenting users a day. Most small sites never get there. In one study, GA missed 55.6% of visits when a banner was shown (Orbit Media).
• Blocking. EasyPrivacy blocks both by default. A self-hosted Umami with a renamed script and endpoint slips past those rules, so it keeps visitors that blockers take from GA4.
• What a visitor is. Umami hashes the site, IP address and browser with a salt that changes each month (sessions, metric definitions, SALT_ROTATION). A phone that changes network is a new visitor. A regular reader on one laptop at home is one visitor a month, three over a quarter. GA4 keeps one user per cookie for up to 400 days in Chrome.
• Bots. Bots with ordinary user agents get through Umami's check, as the Singapore threads show, while GA4's list removes some of them. On the first site running Nora, 3.3% of the page views its script saw over nine days in October 2026 were bots or AI agents.

Where GA4 is ahead

• Google Ads. Import conversions, build audiences, report spend against results.
• Search Console queries inside the reports. Umami lists no Search Console integration.
• Raw data. A free daily export to BigQuery, up to 1 million events a day (Google).
• Age, gender and interests, though small reports are hidden by thresholds.
• No event cap at any price. Umami Cloud charges past 100,000 a month.

Where Umami is ahead

• Open source under MIT. You can read it, change it and run it where your data must stay.
• Funnels, journeys, retention, revenue and attribution on every plan, Hobby included (pricing).
• Session replays and heatmaps at no cost when you self-host. GA4 has neither.
• No cookies and nothing stored in the browser, so there's no consent to wait for.
• Data kept longer. 6 months to 5 years on Cloud, and as long as you like on your own server. GA4 keeps the event-level data behind its explorations 2 or 14 months (Google).
• Short links and tracking pixels for downloads and email opens, since v3.0 (release).

From each maker's pages on 13 October 2026. Umami's API needs Pro on Cloud; replays and heatmaps need Business on Cloud.

We read reviews and threads from the past two years. The same few things come up again and again. Here they are, in our words, with links to where people said them.

1. Keep your history where it is. Umami can't import GA4. Leave the property open, or export it to BigQuery first (Google). Cloud imports, from Pro up, take only Umami databases and CSV files (import).
2. Run both for two to four weeks. Compare Monday with Monday; weekends and campaigns move the totals.
3. Rebuild your key events as Umami events. On Cloud, count each property as an event when you size your plan.
4. Keep Search Console open on its own. Umami doesn't bring its queries in.
5. Keep Google's tag for Ads if you buy Google Ads and rely on its conversions.
6. Self-hosting? Rename the script and endpoint, change the default admin password, and turn off telemetry if you'd rather not send it (environment variables).
7. Remove GA4, then check whether your cookie banner still has anything to ask about.

Nora is for you if you like Umami's simplicity but don't want to run a server or fit under 100,000 events, and you want to know how much of your traffic is people. It's free up to 1 million visitors a month, sets no cookies, weighs 2.7 KB, and labels every page view person, AI agent or bot, with the test that caught it. You also get live visitors, pages, sources (AI assistants among them), countries, goals, a weekly email and CSV export.

It gives up a lot that Umami has. Nora isn't open source and can't be self-hosted, so your data sits with us in the US. It has no funnels, no heatmaps and no session recordings, and it can't import data. It launches on 1 November 2026, so it has no track record yet. If you need the code on your own server, or replays and funnels, Umami is the better pick.

Nora Lab, the research team at Nora Analytics, ran every test on this page the same way for each tool. Here is exactly how, so you can judge the results yourself.

The full method, with what each visitor stands for, is on How we test. Every result from the lab run is public as JSON.