Visitor Tracker in WordPress: Real-Time Count and Admin Pop-up

How the snippet works

1. Enqueue: on wp_enqueue_scripts it registers an empty script handle and attaches the tracker as an inline script. The front end has no ajaxurl variable, so the snippet passes admin_url( 'admin-ajax.php' ), the action name and a nonce in its own window.bmcVT object.
2. Visitor ID: each browser gets a random ID in localStorage. All tabs in one browser share it, so three open tabs count as one visitor. No IP address is read or stored.
3. Ping: every 5 seconds each visible tab POSTs its ID to admin-ajax.php. Hidden tabs skip the ping and send one right away when they become visible again.
4. Handler: one function is hooked to both wp_ajax_bmc_vt_ping (logged-in users) and wp_ajax_nopriv_bmc_vt_ping (guests). It checks the nonce, sanitizes the ID, reads the list with get_transient() using a strict false === check, removes anyone silent for more than 30 seconds, updates the current visitor and saves the list with a 60-second expiry.
5. Admin data: only users with manage_options get the count back. The admin's browser sends the server time of its previous poll, and the handler counts visitors first seen after that time. That number triggers the pop-up. The first poll after page load never shows a pop-up.
6. Output: the button and pop-up are built with textContent, never raw HTML, and the CSS loads only for admins.

Expiry on a transient is a maximum, not a guarantee. WordPress or your object cache can drop it early. The handler then starts from an empty list, and the count rebuilds itself within one poll cycle. See the introduction to the Transients API for the details.

How to test it

1. Log in as an admin in one browser and open any front-end page. You should see "Online: 1".
2. Open a private window in a different browser (or the same browser's private mode) and load the site logged out.
3. Within about 5 seconds the admin page should show "Online: 2" and the pop-up "A new visitor just arrived". The guest window shows nothing.
4. Close the private window. After roughly 30 to 35 seconds the count drops back to 1.
5. Repeat with your page caching plugin on and off. Open DevTools, then the Network tab, and filter for admin-ajax.php. Each request should return status 200.

Accuracy, load and privacy

The count is approximate. Visitors with JavaScript off are not counted. Neither are most bots, but bots that run JavaScript are. A private window or a second browser counts as a new visitor. Background tabs drop out after 30 seconds. Two pings that arrive at the same moment can overwrite each other, so a visitor may briefly go missing until their next ping. Anyone can also send fake pings, which is why the list is capped at 2,000 IDs. Treat the number as a live indicator, not analytics.

Load: every visible tab sends one admin-ajax.php request per interval, and each request writes the transient. On a default install that write goes to the options table. On busy sites or shared hosting, raise interval to 10 or 15 and timeout to about three times the interval. A persistent object cache such as Redis or Memcached takes these writes off the database, because transients then live in the cache.

Privacy: the snippet stores only a random ID with timestamps, never IPs. If you change it to use IP addresses, hash them, and check whether GDPR or similar rules apply to you. Mention the localStorage ID in your privacy notice if your jurisdiction requires it. In the EU and UK, storing an ID in the visitor's browser can require consent under ePrivacy/PECR rules even without cookies. If that applies to you, only load the tracker script after the visitor consents, for example through your consent tool's script blocking.

Common problems

• Count stuck at 0 or 1, or never updating: the snippet is almost always set to front end only. Switch it to run everywhere. In the Network tab, a response of 0 with status 400 means the AJAX handler is not registered.
• Requests return 403 or -1: the nonce check failed. This usually happens when a cached page carries an old nonce. WordPress nonces stay valid for 12 to 24 hours, so purge the page cache and keep the cache lifetime under 12 hours. A security plugin that blocks admin-ajax.php for guests causes the same symptom.
• "ajaxurl is not defined" in the console: that error comes from other code that assumes the admin-only ajaxurl variable. This snippet uses its own bmcVT.ajaxUrl, so check for an older copy of the tracker or another script.
• Button never appears: confirm your account has the administrator role and look for JavaScript errors earlier on the page. Optimization plugins that delay or combine inline scripts can also stop it from running. Exclude bmc-visitor-tracker from them.
• Count resets at random: the transient was dropped early, or the object cache was flushed. This is expected behavior. The count recovers on the next poll.
• Multisite: set_transient() stores data per site, so each site has its own count. For one network-wide count, switch the two transient calls (get_transient() and set_transient() in bmc_vt_ping) to get_site_transient() and set_site_transient().
• Fatal error on save: the snippet was pasted twice, or another snippet already declares a bmc_vt_ function. Keep only one copy.

When to use a plugin instead

Use WP-UserOnline if you want a ready-made public counter on the front end. If you need visitor locations, devices or traffic sources, use the GA4 real-time report or MonsterInsights, as covered in WPBeginner's overview. The snippet is the right choice when you only want a quick admin-side "who's here now" signal without loading an analytics stack. If you track Crocoblock profiles, our guide to tracking JetEngine Profile Builder profile views with a shortcode follows the same no-plugin approach. For the pop-up styling, see our JetFormBuilder custom message popup.

How to remove it

Deactivate or delete the snippet. The visitor list expires with its 60-second transient. On sites without a persistent object cache, WordPress's daily cleanup of expired transients then removes the two leftover rows (_transient_bmc_vt_visitors and _transient_timeout_bmc_vt_visitors) from the options table. To remove them at once, run wp transient delete bmc_vt_visitors. The random ID left in visitors' browsers is harmless and is not read once the snippet is gone.

That gives you a working live visitor counter for admins in a single snippet, with clear limits on what it can tell you. If you want it extended, for example with a public counter, per-page counts or a dashboard widget, and would rather have someone build it for you, post a request on BoostMyCroco.