Open Web Analytics - Self-Hosted Web Analytics by cloudimg

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Open Web Analytics (OWA) is an open source web analytics framework and a privacy-respecting, self-hosted alternative to Google Analytics and Matomo. This AMI is purpose-built for marketing teams, solo developers, and small businesses that need full ownership of their visitor data without dedicating DevOps resources to server configuration.

This image delivers OWA fully installed, configured, and security-hardened. A deployment that typically requires four to six hours of manual work, installing PHP and extensions, configuring Apache, provisioning MariaDB, running the install wizard, and hardening credentials, is completed before first boot. Your team can sign in and begin collecting analytics data within approximately five minutes of instance launch.

Because OWA runs entirely within your own AWS account, all visitor data stays under your control as the data controller. No analytics data is transmitted to third-party servers, no external tracking pixels are loaded, and no cookies are shared with advertising networks. This architecture aligns with GDPR data-minimization and data-sovereignty principles, making it suitable for organizations that must demonstrate where personal data resides.

Unlike free community images that ship shared or default passwords, every instance of this image generates a fresh MariaDB password, fresh application secrets, and a fresh OWA administrator password on first boot, unique to that instance, and writes them to a root-only file. No two deployments share the same password, and the image ships with a clean, empty analytics dataset and one ready-to-use default site.

• Open Web Analytics 1.8.2, the official packaged release
• PHP 8.3 with OPcache enabled for fast dashboard rendering
• Apache 2.4 with a TLS-ready configuration and clean-URL rewriting
• MariaDB database engine bound to localhost only

All components are installed from the operating system package repositories; the packaged OWA release is the only third-party artifact.

On first boot, a one-shot service generates unique credentials, rotates the database and administrator passwords, and regenerates application nonce and authentication secrets. The install wizard is pre-completed and locked behind an Apache deny rule. Sign in, add your website, copy the tracking snippet, and start measuring visits, page views, referrers, search terms, and campaigns immediately.

OWA derives its public URL from the incoming request, so the tracking snippet works correctly on the instance public IP, the private IP, or any custom domain you point at it later. It switches to HTTPS automatically once you place a certificate in front of it, with no reconfiguration needed.

• Amazon CloudFront for global content delivery and DDoS protection
• Amazon Route 53 for custom domain DNS management
• AWS Certificate Manager for TLS termination at a load balancer
• Amazon EBS with the database and application on independently resizable volumes

The database listens only on localhost and is never exposed externally. The image is TLS-ready; attach an SSL certificate via AWS Certificate Manager or Let's Encrypt directly. We recommend enabling EBS encryption for data at rest and restricting SSH access to trusted IP ranges.

A detailed user guide is included with every deployment, covering instance launch, credential retrieval, first sign-in, adding your first site, and copying the JavaScript tracking snippet. To discuss your deployment requirements before purchase or to request a guided walkthrough of the setup process, contact cloudimg support via email or live chat.

Every subscription includes around-the-clock technical support from cloudimg engineers via email and live chat. Our team assists with deployment, tracker and site configuration, version upgrades, performance tuning, and MariaDB database administration. Critical issues receive a one-hour average response time.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.