[davidroetzel]

Have a look at piwik: http://piwik.org/

[sarciszewski]

I don't recommend Piwik. Using MD5 for passwords in 2015 is beyond irresponsible.

https://github.com/piwik/piwik/blob/7f375924db9328f20a0b7cb1...

https://github.com/piwik/piwik/blob/6846145992278b52a2a35a8f...

[ascorbic]

Unbelievable. Unsalted MD5, no less. There's an issue to fix this that's been open for seven years! https://github.com/piwik/piwik/issues/5728

[Karunamon]

Eh. The analytics data is pretty low value as far as hacker targets, and this can be mostly mitigated anyways by sane segregation of the admin backend from the publicly accessible site.

There's an open ticket for it, but it looks like it hasn't been addressed in a while since they don't want to break all existing passwords.

https://github.com/piwik/piwik/issues/5728

[onion2k]

There's a $555 bounty if you can demonstrate a security vulnerability in Piwik because of that.