Matomo 5.13.0 lands with a sparkline overhaul and native AI traffic tracking
The open-source analytics platform dropped its August release on the 16th, bringing a redesigned dashboard card system, a new AI provider configuration plugin, and targeted security hardening. No database migrations required.
Matomo has been tracking over a million websites since the early 2010s, currently claiming roughly six percent of the top 10k global sites. The team has been chasing Google Analytics for years, and this month's update leans heavily into visual polish and AI-era reporting.
Visual polish and the AI traffic shift
The headline change is the redesigned sparkline summary cards. Each metric now sits in its own clearly labeled container with a dynamically scaled number. The layout uses CSS Grid for consistent alignment across screen sizes. Comparisons between dates or segments sit side by side with better spacing and cleaner typography.
It's the third visual refresh in two months. After 5.12.0 updated evolution graphs and chart legends, this release extends that overhaul to KPI-style displays. If you've ever squinted at a cluster of tiny sparklines on a dashboard, the new layout should feel noticeably cleaner. The metric selector spacing on bar and pie charts got corrected along the way.
On the AI front, 5.13.0 ships with a new AIProviders plugin that builds on last month's chatbot tracking reports. Matomo now treats AI crawlers as a first-class traffic source instead of noise to block. You can see which pages chatbots are reading, compare AI-favored content against human-favored content, and monitor live request volumes. The new plugin just opens the door for connecting multiple AI model backends directly to the dashboard.
Head here to read the full technical breakdown of the AI chatbot tracking implementation. Matomo is treating non-human traffic with the same rigor as human visits. It's a philosophical shift that traditional web analytics simply ignored until now.
Security hardening and the monthly cadence
Security got a noticeable bump this cycle. User-configured URL fetches now require an opt-in flag to prevent server-side request forgery. Granting the admin role demands password confirmation to stop accidental privilege escalations. Ecommerce money values get capped to prevent overflow and injection issues. The team is clearly treating enterprise configuration mistakes as actual attack vectors.
The release cadence has been exactly monthly since May. 5.14.0 alpha builds dropped as recently as August 14. Matomo 6 is already simmering somewhere in the background alongside the ongoing 5.x maintenance releases. Keep in mind that the team also took the time to differentiate MariaDB Community versus Enterprise Server end-of-life dates. Small detail. The kind of thing that saves you an unexpected upgrade cycle later. The geolocation module got a refresh for better CNIL detection in France too. Privacy teams will notice the difference.
It's a solid maintenance release, not a paradigm shift. The sparkline redesign is mostly welcome UI cleanup. The AI chatbot tracking is the most forward-looking piece, though measuring non-human traffic accurately is still fairly experimental. However, at the same time, treating AI crawlers as a measurable traffic source instead of blocking them at the gateway is exactly the direction privacy-first analytics needs to take.
You can grab the release directly from the Matomo download page or pull it via Composer. The full changelog lists every ticket, and the alpha build is already available if you want to test the next cycle. The platform remains licensed under GNU GPL v3 and continues to run on PHP with MySQL or MariaDB.
