How to Deploy Matomo Analytics - An Opensource Google Analytics Alternative

The Matomo release file is a ZIP archive that contains the web application code needed to deploy Matomo analytics. Follow the steps below on your Ubuntu server.

1. Update the apt package index.

   CONSOLE

   Copy

   $ sudo apt update

   Explain Code

   Powered by Vultr AgentBeta

2. Download the release file using wget.

   CONSOLE

   Copy

   $ wget https://builds.matomo.org/matomo.zip -O matomo.zip

   Explain Code

   Powered by Vultr AgentBeta

   The release file is downloaded and saved as matomo.zip.

3. Extract the compressed file.

   CONSOLE

   Copy

   $ sudo unzip matomo.zip -d /var/www/

   Explain Code

   Powered by Vultr AgentBeta

   This command extracts the files to /var/www/ and creates a directory matomo containing the web application files. The extracted files are owned by the user root and group root.

4. Set the file ownership for Matomo to the www-data user and group.

   CONSOLE

   Copy

   $ sudo chown -R www-data:www-data /var/www/matomo

   Explain Code

   Powered by Vultr AgentBeta

5. Set the permissions to allow read, write, and execute for the user, read and execute for the group, and no permissions for others.

   CONSOLE

   Copy

   $ sudo chmod 750 -R /var/www/matomo

   Explain Code

   Powered by Vultr AgentBeta

   The web server can now read, write, and execute all files in the Matomo directory.

Install LEMP

LEMP is a stack of Linux, Nginx web server, MySQL database, and PHP. Follow the steps below to set up the LEMP stack on your server.

1. Install Nginx.

   CONSOLE

   Copy

   $ sudo apt install -y nginx

   Explain Code

   Powered by Vultr AgentBeta

2. Allow Nginx on the UFW firewall.

   CONSOLE

   Copy

   $ sudo ufw allow "Nginx Full"

   Explain Code

   Powered by Vultr AgentBeta

3. Enable and start Nginx.

   CONSOLE

   Copy

   $ sudo systemctl enable --now nginx

   Explain Code

   Powered by Vultr AgentBeta

4. Verify Nginx is running by sending a request with curl.

   CONSOLE

   Copy

   $ curl -I http://127.0.0.1

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   HTTP/1.1 200 OK
   Server: nginx/1.24.0 (Ubuntu)
   Date: Thu, 14 Aug 2025 14:06:05 GMT
   Content-Type: text/html
   Content-Length: 615
   Last-Modified: Thu, 14 Aug 2025 14:04:40 GMT
   Connection: keep-alive
   ETag: "689decf8-267"
   Accept-Ranges: bytes

   Nginx is installed and running on port 80 (HTTP). To confirm, visit http://SERVER_IP in the browser. Substitute SERVER_IP with your server's public IP.

5. MariaDB is an open source database management system that is a drop-in replacement for MySQL. Install MariaDB.

   CONSOLE

   Copy

   $ sudo apt install -y mariadb-server mariadb-client

   Explain Code

   Powered by Vultr AgentBeta

6. Secure MariaDB by running the mysql_secure_installation utility.

   CONSOLE

   Copy

   $ sudo mysql_secure_installation

   Explain Code

   Powered by Vultr AgentBeta
   1. At the prompt to enter the MariaDB root user password, press ENTER key since there is no password set.
   2. Switch to unix_socket authentication [Y/n] - Enter Y to accept the change.
   3. Change the root password? [Y/n] - Enter Y to change the root account password.
   4. Remove anonymous users? [Y/n] - Enter Y to remove anonymous users.
   5. Disallow root login remotely? [Y/n] - Enter Y to disable remote login for your database.
   6. Remove test database and access to it? [Y/n] - Enter Y to remove test database.
   7. Reload privilege tables now? [Y/n] - Enter Y to reload the privileges to apply the changes.

7. Enable the database service.

   CONSOLE

   Copy

   $ sudo systemctl enable --now mariadb.service

   Explain Code

   Powered by Vultr AgentBeta

8. Verify that MariaDB is running and ready to accept connections.

   CONSOLE

   Copy

   $ sudo systemctl status mariadb.service

   Explain Code

   Powered by Vultr AgentBeta

   Sample output:

   ● mariadb.service - MariaDB 10.11.13 database server
        Loaded: loaded (/usr/lib/systemd/system/mariadb.service; enabled; preset: enabled)
        Active: active (running) since Wed 2025-08-06 19:30:10 UTC; 1min 34s ago
   ...

   MariaDB is running and ready to handle connections.

9. Install PHP-FPM and required extensions.

   CONSOLE

   Copy

   $ sudo apt-get install -y php-fpm php-curl php-gd php-cli php-mysql php-xml php-mbstring

   Explain Code

   Powered by Vultr AgentBeta

   This installs the PHP FastCGI Process Manager and the required extensions. PHP-FPM is necessary because Nginx cannot process PHP source files directly.

10. Enable the PHP-FPM service to start automatically at boot.

    CONSOLE

    Copy

    $ sudo systemctl enable --now php8.3-fpm

    Explain Code

    Powered by Vultr AgentBeta

11. Download the FastCGI configuration file to the Nginx configuration directory.

    CONSOLE

    Copy

    $ sudo wget https://raw.githubusercontent.com/nginx/nginx/refs/heads/master/conf/fastcgi.conf -O /etc/nginx/conf.d/fastcgi.conf

    Explain Code

    Powered by Vultr AgentBeta

    The file is downloaded to the location /etc/nginx/conf.d/.

12. Download the Matomo configuration file for Nginx from GitHub:

    CONSOLE

    Copy

    $ sudo wget https://raw.githubusercontent.com/matomo-org/matomo-nginx/refs/heads/master/sites-available/matomo.conf -O /etc/nginx/conf.d/matomo.conf

    Explain Code

    Powered by Vultr AgentBeta

13. Edit the Matomo configuration file.

    CONSOLE

    Copy

    $ sudo nano /etc/nginx/conf.d/matomo.conf

    Explain Code

    Powered by Vultr AgentBeta

14. Edit and modify it to match the following example. Replace the matomo.example.com value in the server_name directive with your actual domain name.

    INI

    Copy

    server {
       listen 80;
       server_name matomo.example.com;
       access_log /var/log/nginx/matomo.access.log;
       error_log /var/log/nginx/matomo.error.log;
    
       add_header Referrer-Policy origin always;
       add_header X-Content-Type-Options "nosniff" always;
       add_header X-XSS-Protection "1; mode=block" always;
    
       root /var/www/matomo/;
    
       index index.php;
    
       ## only allow accessing the following php files
       location ~ ^/(index|matomo|piwik|js/index|plugins/HeatmapSessionRecording/configs)\.php$ {
           include /etc/nginx/conf.d/fastcgi.conf;
           try_files $fastcgi_script_name =404; # protects against CVE-2019-11043.
           fastcgi_param HTTP_PROXY ""; # prohibit httpoxy: https://httpoxy.org/
           fastcgi_pass unix:/var/run/php/php8.3-fpm.sock; #replace with the path to your PHP socket file
           #fastcgi_pass 127.0.0.1:9000; # uncomment if you are using PHP via TCP sockets (e.g. Docker container)
       }
    
       ## deny access to all other .php files
       location ~* ^.+\.php$ {
           deny all;
           return 403;
       }
    
       ## serve all other files normally
       location / {
           try_files $uri $uri/ =404;
       }
    
       ## disable all access to the following directories
       location ~ ^/(config|tmp|core|lang) {
           deny all;
           return 403; # replace with 404 to not show these directories exist
       }
    
       location ~ /\.ht {
           deny  all;
           return 403;
       }
    
       location ~ js/container_.*_preview\.js$ {
           expires off;
           add_header Cache-Control 'private, no-cache, no-store';
       }
    
       location ~ \.(gif|ico|jpg|png|svg|js|css|htm|html|mp3|mp4|wav|ogg|avi|ttf|eot|woff|woff2)$ {
           allow all;
           ## Cache images,CSS,JS and webfonts for an hour
           ## Increasing the duration may improve the load-time, but may cause old files to show after an Matomo upgrade
           expires 1h;
           add_header Pragma public;
           add_header Cache-Control "public";
       }
    
       location ~ ^/(libs|vendor|plugins|misc|node_modules) {
           deny all;
           return 403;
       }
    
       ## properly display textfiles in root directory
       location ~/(.*\.md|LEGALNOTICE|LICENSE) {
           default_type text/plain;
       }
    }

    Explain Code

    Powered by Vultr AgentBeta

15. Test the configuration.

    CONSOLE

    Copy

    $ sudo nginx -t

    Explain Code

    Powered by Vultr AgentBeta

    If the configuration file has no issues, you'll get the output below.

    nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
    nginx: configuration file /etc/nginx/nginx.conf test is successful

16. Reload Nginx.

    CONSOLE

    Copy

    $ sudo systemctl reload nginx

    Explain Code

    Powered by Vultr AgentBeta

    Nginx is ready to handle incoming requests. However, you must install and configure the database server to store all the analytics data.

Create the Matomo Analytics Database

Before configuring Nginx to serve Matomo, you must create a database to store the data collected.

1. Connect to MySQL to start creating the database and user:

   CONSOLE

   Copy

   $ mysql -u root -p

   Explain Code

   Powered by Vultr AgentBeta

   Enter the password you set as the MySQL root password earlier.

2. Create a database to store analytics data:

   SQL

   Copy

   MariaDB [(none)]> CREATE DATABASE matomo_analytics;

   Explain Code

   Powered by Vultr AgentBeta

3. Create a dedicated user for Matomo:

   SQL

   Copy

   MariaDB [(none)]> CREATE USER 'matomo'@'localhost' IDENTIFIED VIA mysql_native_password USING PASSWORD('StrongP155word#');

   Explain Code

   Powered by Vultr AgentBeta

4. Grant the user the required database permissions to manage analytics data.

   SQL

   Copy

   MariaDB [(none)]> GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, INDEX, DROP, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES ON matomo_analytics.* TO 'matomo'@'localhost';

   Explain Code

   Powered by Vultr AgentBeta

5. Grant the FILE privilege for faster report archival:

   SQL

   Copy

   MariaDB [(none)]> GRANT FILE ON *.* TO 'matomo'@'localhost';

   Explain Code

   Powered by Vultr AgentBeta

6. Exit MariaDB.

   SQL

   Copy

   MariaDB [(none)]> exit;

   Explain Code

   Powered by Vultr AgentBeta

Secure Matomo Analytics with Trusted SSL Certificates

To secure the Matomo analytics web interface, use certbot to deploy TLS certificates from Let's Encrypt.

1. Install the certbot utility and Nginx plugin.

   CONSOLE

   Copy

   $ sudo apt install -y certbot python3-certbot-nginx

   Explain Code

   Powered by Vultr AgentBeta

2. Deploy a certificate for your Matomo subdomain.

   CONSOLE

   Copy

   $ sudo certbot --nginx -d matomo.example.com

   Explain Code

   Powered by Vultr AgentBeta
   1. Enter a valid email address to receive certificate expiry alerts.
   2. Accept the terms of service for a certificate to be provisioned. You may decline subscribing to marketing emails from the Electronic Frontier Foundation.

3. Visit the https://matomo.example.com webpage in a web browser.