Audit

Openmost Audit is a free, read-only Matomo On-Premise plugin that inspects the instance it is installed on and produces a structured configuration audit report: server, PHP, database, config.ini.php and Matomo general settings, each finding with its severity, the observed value, the expected value and a recommendation.

It is designed for consultants, ops teams and super users who need a quick, repeatable way to verify that a Matomo installation is properly configured, without touching a single setting.

Features

• 53 automated checks across 6 categories: Infrastructure & server, PHP, Database, config.ini.php settings, Matomo general settings, Backups & monitoring.
• Strictly read-only: never writes to config.ini.php, to the database or to any file, never stores the results. Every report is computed fresh.
• No outbound HTTP calls and no telemetry.
• Admin report with filters by category, severity, status and a free-text search.
• Markdown export of the report, ready to paste into a consulting deliverable, with an ASCII-only variant for diff-friendly pipelines.
• Console command audit:run with a table or Markdown output.
• 7 languages: English, French, German, Chinese (Simplified), Italian, Spanish and Swedish.
• 96 more checks (premium): Privacy / GDPR, Users & permissions, Web sites, Data quality, Matomo Tag Manager, Plugins, Public file exposure, High traffic / performance, Multi-server / HA, plus TLS certificate, CDN/WAF, HTTP/2 and HTTPS redirect checks through read-only HTTP probes. They are listed in the report with a "Premium" badge but not run by this plugin.

Requirements

• Matomo 5 (>=5.0.0-b1,<6.0.0-b1)
• PHP 8.1 or higher

The version checks report the Matomo 6 requirements (PHP 8.1+, MySQL 8.0+ / MariaDB 10.6+) as warnings, so an instance still on Matomo 5 can see what blocks the upgrade. For Matomo 6, use the 6.x releases of this plugin.

Installation

Install the plugin from the Matomo Marketplace (Administration > Marketplace), or copy this directory into plugins/Audit/ of your Matomo installation and activate it:

php console plugin:activate Audit

Then open Administration > Diagnostic > Audit as a super user.

Purchase Openmost Audit Premium version

• Filters

  

Openmost Audit is a free, read-only plugin that audits the configuration of your Matomo On-Premise instance and produces an actionable, structured report, without touching a single setting.

It is designed for consultants, ops teams and super users who need a quick, repeatable way to check that a Matomo installation is properly configured.

What the free plugin checks

The free plugin runs 53 automated checks across 6 categories:

• Infrastructure & server (14): Matomo version, web engine, archiving cron, GeoIP database and its freshness, SMTP, write permissions on tmp/ and js/, file integrity, codebase on NFS, tracker cache TTL, tracker status, tracker hostname obfuscation, private directories not reachable, reverse-proxy client headers.
• PHP (8): version, PHP-FPM, memory_limit, max_execution_time, post_max_size, OPcache, required extensions, shell_exec / proc_open.
• Database (14): database size, tracking volume, MySQL / MariaDB version, InnoDB engine, utf8mb4 charset, max_allowed_packet, wait_timeout, innodb_flush_log_at_trx_commit, InnoDB buffer pool, Transitions indexes, database not exposed, slow query log, SSD tuning, MySQL user privileges.
• config.ini.php settings (12): force_ssl, trusted_hosts, cors_domains, login brute-force protection, password complexity, auto-update, multi-server mode, unique visitors for ranges and years, custom reports max dimensions, MariaDB schema, admin IP allowlist.
• Matomo general settings (4): custom logo, TrackingSpamPrevention filters, CORS domains in sync with the UI, timezone consistency between PHP, MySQL and Matomo.
• Backups & monitoring (1): application logs written to a persistent file.

Each finding carries a severity (critical, high, medium, low, info), a status (pass, fail, warn, skip), the observed value, the expected value, a recommendation and, when relevant, a configuration snippet.

Premium checks

96 more checks are listed in the report with a "Premium" badge. They are not run by the free plugin:

• Privacy / GDPR (premium): IP and geolocation anonymization, data retention, PII removal, third-party cookies, Live reports, Heatmaps and Session Recording.
• Users & permissions (premium): super user count, 2FA, anonymous access, dormant and shared accounts, API token scope, Tag Manager roles, ActivityLog.
• Web sites (premium): URLs, excluded IPs and query parameters, e-commerce, site search, timezones, currencies, duplicates, cross-domain tracking.
• Data quality (premium): goals, event naming, Custom Dimensions, segments, custom reports, funnels, alerts, annotations, Search Console, tracking failures.
• Matomo Tag Manager (premium): containers, environments, Matomo tag, naming conventions, per-environment site ID.
• Plugins (premium): plugin inventory, invalid, deprecated and outdated plugins, recommended official plugins, QueuedTracking, FormAnalytics.
• Public file exposure (premium): tracker files, opt-out endpoints, favicon and heatmap configuration endpoint, through read-only HTTP probes.
• High traffic / performance (premium): archiving settings, PHP-FPM workers, MySQL connections, QueuedTracking with Redis, CDN for tracker assets, segments and custom reports counts.
• Multi-server / HA (premium): shared database, read replica, load balancer, dedicated archiver.
• HTTP probes (premium): TLS certificate validity, CDN/WAF, HTTP/2 and HTTPS redirect checks of the Infrastructure & server category.

Purchase Openmost Audit Premium version

Key features

• Read-only: never writes to config.ini.php, to the database or to any file, and never stores the results.
• No outbound HTTP calls, no telemetry.
• In-app report under Administration > Diagnostic > Audit, for super users, with filters by category, severity, status and a free-text search.
• Markdown export: one click downloads the report as a .md file, ready to paste into a Word, Notion or Confluence deliverable. Add &plain=1 to the export URL for ASCII status markers instead of emoji.
• Console command: php console audit:run prints the report as a table, --format=markdown as Markdown, --only=<id>,<id> restricts it to some checks.
• 7 languages: English, French, German, Chinese (Simplified), Italian, Spanish and Swedish.

Requirements

Matomo 5 and PHP 8.1 or higher. For Matomo 6, use the 6.x releases of this plugin.

Installation

Install the plugin from the Matomo Marketplace (Administration > Marketplace), then open Administration > Diagnostic > Audit as a super user.

If the premium version (AuditPremium) is also active, the free plugin hides its menu entry and redirects to the premium report.

Source code and support

The plugin is open source (GPL v3+): https://github.com/openmost/Audit. Questions: ronan@openmost.com.

What does the free plugin check?

53 automated checks in 6 categories: Infrastructure & server, PHP, Database, config.ini.php settings, Matomo general settings and Backups & monitoring. Each finding gives a status (pass, fail, warn, skip), a severity, the observed and expected values and a recommendation.

What are the checks with a "Premium" badge?

The report also lists 96 checks that only run in the premium version: Privacy / GDPR, Users & permissions, Web sites, Data quality, Matomo Tag Manager, Plugins, Public file exposure, High traffic / performance and Multi-server / HA, plus 4 Infrastructure & server checks that need HTTP probes (TLS certificate, CDN/WAF, HTTP/2, HTTPS redirect). The free plugin shows their title and severity but does not run them, so they have no result. Select "Premium" in the status filter to list only them.

Does the plugin modify anything on my instance?

No. The plugin is read-only: it reads config.ini.php, runs read queries (SELECT, SHOW) against the database and inspects the PHP runtime. It never writes to config.ini.php, to the database or to any file, and it does not store the results: every report is computed when you open the page or run the command.

Does it make outbound HTTP calls or send data to a third party?

No. The free plugin makes no HTTP request and has no telemetry. The HTTP probes (TLS certificate, CDN/WAF, HTTP/2, HTTPS redirect, public file exposure) are a premium feature.

Who can run an audit?

Only super users. The menu entry is hidden for other users and every page and export requires super user access.

How do I export the report?

Click Export Markdown on the report page to download a .md file with the instance information, a summary and the findings grouped by category. Add &plain=1 to the export URL to replace the emoji status badges with [PASS], [FAIL], [WARN], [SKIP] and [PREMIUM]. From the command line, use php console audit:run --format=markdown > audit.md.

The export contains the results of the free checks, followed by the list of premium checks (title, id and severity) without any result.

Can I run it from the command line?

Yes:

• php console audit:run prints the results as a table.
• php console audit:run --format=markdown prints the Markdown report.
• php console audit:run --only=srv-php-version,cfg-force-ssl runs only the given checks.

audit:debug-metrics and audit:debug-translations are helpers for troubleshooting.

What happens if both Audit and AuditPremium are installed?

AuditPremium runs every check of the free plugin. When it is active, the free plugin steps aside: its menu entry is hidden, its page redirects to the AuditPremium report and the audit:* console commands are the AuditPremium ones. You can deactivate the free plugin.

Which languages are available?

English, French, German, Chinese (Simplified), Italian, Spanish and Swedish. The report follows the language of the Matomo user.

Which Matomo versions are supported?

This 5.x release line targets Matomo 5, with PHP 8.1 or higher. The 6.x releases target Matomo 6.

On Matomo 5 the PHP and database checks report the Matomo 6 requirements (PHP 8.1+, MySQL 8.0+ / MariaDB 10.6+) as warnings rather than failures: those versions still run Matomo 5, they only block the upgrade to Matomo 6. PHP 8.2 or later is recommended, as PHP 8.1 no longer receives security fixes.

Where can I get help?

• GitHub issues: https://github.com/openmost/Audit/issues
• Email: ronan@openmost.com