Automating a weekly Matomo report with n8n, without relying on Google

Every Monday, someone logs into Matomo, compares this week's visits against a rough memory of last week's, then copies three numbers into a Slack message. This manual ritual has one extra flaw compared to its Google Analytics equivalent: Matomo has no native node in n8n, so almost nobody automates it. Yet Matomo's Reporting API is one of the most complete on the market, and the HTTP Request node is more than enough to build the same weekly report, the same AI summary, and the same traffic-drop alert as for GA4 — without a single byte of visitor data ever leaving your own infrastructure.

Why automate Matomo instead of Google Analytics

Choosing Matomo is rarely a purely technical decision — it's a compliance and data-sovereignty one. Self-hosted on your own infrastructure, Matomo shares no browsing data with any third party, a point that matters increasingly to organizations subject to the GDPR. A study by Jannick Kirk Sørensen and Sokol Kosta, “Before and After GDPR: The Changes in Third Party Presence at Public and Private European Websites”, presented at the WWW 2019 conference, tracked 1,250 websites over eight months around the GDPR's entry into force and documents a reduction in third-party trackers on European sites over that period. A self-hosted analytics tool like Matomo pushes that logic to its conclusion: zero third parties in the audience-measurement pipeline, by construction rather than by after-the-fact configuration.

The trade-off is that, without automation, this compliance advantage costs you comfort: no native node, no reporting or AI summary out of the box. The workflow below fills that gap.

Querying Matomo's Reporting API with HTTP Request

The Matomo API responds on a single endpoint, https://your-matomo.example/index.php, where every call specifies a module=API, a method (the requested report), and a format=JSON. Three parameters drive the time period:

• idSite — the numeric ID of the tracked site, visible in the admin URL.
• period — day, week, month, or range for a custom window.
• date — a reference date (today, yesterday, 2026-08-03), or two bounds separated by a comma when period=range.

In n8n, an HTTP Request node using POST calls that endpoint. The token_auth — retrieved from Matomo under Administration > Personal > Security — goes in as a Body Parameter, never as a URL parameter: Matomo explicitly recommends this, since a token in a query string ends up in web server logs and in reverse-proxy history. The credential itself is stored encrypted on the n8n side, following the same principle described in our guide to securing API credentials in n8n.

{
  "module": "API",
  "method": "VisitsSummary.get",
  "idSite": "1",
  "period": "week",
  "date": "2026-08-03",
  "format": "JSON",
  "token_auth": "={{ $credentials.matomoApi.token }}"
}

For the week-over-week comparison, two separate calls beat a single fancy syntax: one with date set to the current week, a second on the previous week ({{ $now.minus({ weeks: 1 }).toFormat('yyyy-MM-dd') }}). Unlike GA4's Data API, Matomo does not let you pack two date ranges into a single call — two parallel HTTP Request nodes, merged afterward, do the job perfectly well. Our guide to pagination and HTTP Request best practices in n8n covers the shared settings (timeout, retry) worth applying to both calls.

Choosing the right API methods

A core set of three methods covers most of what a useful weekly report needs:

• VisitsSummary.get — visits, unique visitors, bounce rate, average visit duration: the totals that open the report.
• Referrers.getReferrerType — traffic split by type (direct, search engines, referrer websites, social networks, campaigns), the equivalent of GA4's sessionSource/sessionMedium pair.
• Actions.getPageUrls — the most-visited pages of the period, to spot what's pulling traffic in or losing it.

A fourth call, Goals.get, is worth adding if you track conversions (a guide download, a click toward a pack) — Matomo calls these "goals," configurable without code from the admin interface.

Comparing the two periods and keeping only what matters

A Code node merges the results of the two calls (current week, previous week) on their shared key — referrer type or page URL, depending on the report — then computes the absolute and percentage variation for each row. Three rules keep the report readable:

• Sort by absolute variation, not percentage: a page going from 3 to 15 visits shows +400%, an eye-catching but decision-useless number.
• Cap each report at a top 10 of gains and drops.
• Compute global totals (visits, unique visitors, bounce rate) that will headline the message and feed the daily alert.

This period-over-period skeleton is identical to the one in our automated weekly GA4 report with n8n: if you manage sites on both tools, the two workflows share the same Code node structure — only the HTTP call changes.

AI summary, delivery and archiving

An AI node turns the variation table into three or four sentences: overall trend, sources on the rise, anomalies worth watching. Constrain the prompt to comment only on the supplied figures, never speculating on unverifiable external causes — the same discipline as in the AI-generated audit summary report from the Compliance & Audit pack. The message then goes out on Slack (see our Slack bot with n8n guide for block formatting) or by email.

For long-term history, archive every run before sending:

• Google Sheets, plenty for a simple record — see automating Google Sheets with n8n.
• Postgres, once you want moving averages or year-over-year comparisons across several sites — see the n8n Postgres node. If that database also serves as a GDPR audit trail, it can reuse the same schema as our guide to a GDPR audit trail with n8n and Supabase.

A daily alert for traffic drops

The weekly report isn't enough if traffic collapses on a Wednesday. A second, lighter workflow on a daily trigger:

1. Two VisitsSummary.get calls with period=day: the day before yesterday, and the same day the previous week.
2. An IF node: if the drop exceeds a threshold (30% is a reasonable starting point), the workflow continues; otherwise it stops quietly without notifying anyone.
3. An immediate Slack message with the figure and the referrers that explain most of the drop.

Always compare against the same day of the previous week, never the day before, so you don't mistake a real drop for a site's normal weekly seasonality. Align the cron with the timezone configured in Matomo for that site, as detailed in our guide to the n8n Schedule Trigger and timezones.

Matomo-specific pitfalls

• Archiving isn't automatic by default. Matomo can run in "browser triggers archiving" mode: reports are only computed the first time someone opens the interface. A workflow that queries the API before anyone has opened the dashboard can pull incomplete data. On an instance dedicated to automated reporting, disable that mode and schedule a regular archive.php cron on the server side.
• IP anonymization can reduce the unique-visitor count on low-traffic sites, since distinct visitors sharing a truncated IP can merge into one. This isn't a bug — it's the expected trade-off of a tool built for compliance.
• The Matomo site's timezone isn't necessarily the n8n server's. Check the per-site setting (Administration > Websites > Timezone) before computing your date bounds, or you'll silently shift the report by a day.
• Rate limiting exists but rarely bites for a weekly report or a daily alert — it only shows up with a loop querying the API at high frequency across many sites.

Scaling it with the Compliance & Audit pack

Building this Matomo reporting setup — HTTP calls, period comparison, AI summary, alerting — is a solid afternoon of work the first time, between archiving settings and API quirks. If your priority is GDPR compliance itself rather than reporting alone, the Compliance & Audit pack (€149) ships four ready-to-import workflows — a questionnaire bot, a Supabase audit trail, incomplete-file follow-ups, and an AI summary report — built on the same timestamped-traceability principle as a well-built Matomo dashboard. And for teams that also want a documentation assistant able to cite your internal procedures, the Complete FlowKit Bundle (€269) bundles that pack with the Inbox AI and RAG Assistant packs.

Key takeaways

• n8n has no native Matomo node: the HTTP Request node against module=API covers every Reporting API method.
• The token_auth goes in as a Body Parameter, never in the URL — Matomo's explicit recommendation.
• Three methods cover a useful report: VisitsSummary.get, Referrers.getReferrerType, Actions.getPageUrls.
• Compare week over week with a Code node, top 10 sorted by absolute variation, a constrained AI summary, delivered via Slack or email.
• Check Matomo-side archiving (an archive.php cron), the per-site timezone, and how IP anonymization affects low-traffic counts.
• A daily threshold alert complements the weekly report, on the same trigger pattern as GA4 reporting.