analytics: add visitor country (server-side GeoIP) and full referrer URL

pulse.php now records GEOIP_COUNTRY_CODE/NAME (OVH mod_geoip, IP stays on the host) and the full external referrer URL. stats.php gains a Countries panel (with flag), a full-referrer-links panel, and country + clickable source link in recent visits. Schema migrates existing DBs via ALTER TABLE.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: MTSistemi

website/public/_sfstats.php

@@ -39,7 +39,14 @@ function sfstats_db() {
             ts INTEGER NOT NULL, day TEXT NOT NULL,
             path TEXT NOT NULL, ref TEXT NOT NULL DEFAULT "",
             vis TEXT NOT NULL, bot INTEGER NOT NULL DEFAULT 0,
-            browser TEXT NOT NULL DEFAULT "", os TEXT NOT NULL DEFAULT "")');
+            browser TEXT NOT NULL DEFAULT "", os TEXT NOT NULL DEFAULT "",
+            country TEXT NOT NULL DEFAULT "", cname TEXT NOT NULL DEFAULT "",
+            ref_full TEXT NOT NULL DEFAULT "")');
+        // migrate older databases that predate the new columns
+        foreach (array('country','cname','ref_full') as $col) {
+            try { $db->exec('ALTER TABLE hits ADD COLUMN ' . $col . ' TEXT NOT NULL DEFAULT ""'); }
+            catch (Throwable $e) { /* column already exists */ }
+        }
         $db->exec('CREATE INDEX IF NOT EXISTS idx_day ON hits(day)');
         $db->exec('CREATE INDEX IF NOT EXISTS idx_vis ON hits(vis)');
         return $db;
@@ -85,6 +92,28 @@ function sfstats_browser($ua) {
         return 'Altro';
     }
 
+    // Country from OVH/Apache mod_geoip (server-side, IP never leaves the host).
+    function sfstats_country() {
+        $code = strtoupper(substr((string)($_SERVER['GEOIP_COUNTRY_CODE'] ?? ''), 0, 2));
+        $name = (string)($_SERVER['GEOIP_COUNTRY_NAME'] ?? '');
+        if ($code && !$name) $name = $code;
+        return array($code, substr($name, 0, 60));
+    }
+
+    // Two-letter country code -> flag emoji (regional indicators), with fallback.
+    function sfstats_flag($code) {
+        $code = strtoupper((string)$code);
+        if (strlen($code) !== 2 || !ctype_alpha($code)) return '🏳️';
+        $a = function_exists('mb_chr') ? 'mb_chr' : null;
+        $f = '';
+        for ($i = 0; $i < 2; $i++) {
+            $cp = 0x1F1E6 + (ord($code[$i]) - 65);
+            $f .= $a ? mb_chr($cp, 'UTF-8')
+                     : html_entity_decode('&#' . $cp . ';', ENT_QUOTES, 'UTF-8');
+        }
+        return $f;
+    }
+
     function sfstats_os($ua) {
         if (preg_match('/Android/i', $ua)) return 'Android';
         if (preg_match('/iPhone|iPad|iOS/i', $ua)) return 'iOS';

website/public/pulse.php

@@ -17,17 +17,25 @@
 
 // Keep only the path part of whatever was sent; drop query strings.
 $path = parse_url($path, PHP_URL_PATH) ?: '/';
-// Referrer: store host only (privacy + tidy aggregation), and ignore self-refs.
+// Referrer: keep the host (for aggregation) and, for EXTERNAL referrers, the
+// full URL too. Self-referrals are ignored.
 $ref_host = '';
+$ref_full = '';
 if ($ref) {
     $h = parse_url($ref, PHP_URL_HOST) ?: '';
-    if ($h && !preg_match('/skillfishos\.com$/i', $h)) $ref_host = strtolower($h);
+    $scheme = strtolower((string)(parse_url($ref, PHP_URL_SCHEME) ?: ''));
+    if ($h && !preg_match('/skillfishos\.com$/i', $h)) {
+        $ref_host = strtolower($h);
+        if ($scheme === 'http' || $scheme === 'https') $ref_full = $ref; // already capped to 300
+    }
 }
 
+list($country, $cname) = sfstats_country();
+
 try {
     $db = sfstats_db();
-    $st = $db->prepare('INSERT INTO hits(ts,day,path,ref,vis,bot,browser,os)
-                        VALUES(:ts,:day,:path,:ref,:vis,:bot,:br,:os)');
+    $st = $db->prepare('INSERT INTO hits(ts,day,path,ref,vis,bot,browser,os,country,cname,ref_full)
+                        VALUES(:ts,:day,:path,:ref,:vis,:bot,:br,:os,:cc,:cn,:rf)');
     $st->execute(array(
         ':ts'   => time(),
         ':day'  => gmdate('Y-m-d'),
@@ -37,6 +45,9 @@
         ':bot'  => sfstats_is_bot($ua),
         ':br'   => sfstats_browser($ua),
         ':os'   => sfstats_os($ua),
+        ':cc'   => $country,
+        ':cn'   => $cname,
+        ':rf'   => $ref_full,
     ));
 } catch (Throwable $e) {
     // never break a page load because of analytics

website/public/stats.php

@@ -164,7 +164,14 @@ function toprows($db, $col, $where, $limit = 8) {
 $top_refs  = toprows($db, 'ref',  "$botw AND day>='$d30' AND ref<>''");
 $browsers  = toprows($db, 'browser', "$botw AND day>='$d30'", 6);
 $oses      = toprows($db, 'os', "$botw AND day>='$d30'", 6);
-$recent    = $db->query("SELECT ts,path,ref,browser,os,bot FROM hits ORDER BY id DESC LIMIT 15")->fetchAll(PDO::FETCH_ASSOC);
+$countries = $db->query("SELECT country, MAX(cname) cname, COUNT(*) c FROM hits
+                         WHERE 1=1 $botw AND day>='$d30' AND country<>''
+                         GROUP BY country ORDER BY c DESC LIMIT 15")->fetchAll(PDO::FETCH_ASSOC);
+$top_links = $db->query("SELECT ref_full k, COUNT(*) c FROM hits
+                         WHERE 1=1 $botw AND day>='$d30' AND ref_full<>''
+                         GROUP BY ref_full ORDER BY c DESC LIMIT 12")->fetchAll(PDO::FETCH_ASSOC);
+$recent    = $db->query("SELECT ts,path,ref,ref_full,browser,os,bot,country,cname
+                         FROM hits ORDER BY id DESC LIMIT 20")->fetchAll(PDO::FETCH_ASSOC);
 
 page_head('SkillFishOS · Statistiche');
 echo '<div class="wrap">';
@@ -209,21 +216,52 @@ function tbl($title, $rows, $klabel, $linkpath = false) {
     }
     echo '</table></div>';
 }
+// countries
+echo '<div class="panel"><h3>Paesi di origine (30g)</h3><table><tr><th>Paese</th><th class="r">Visite</th></tr>';
+if (!$countries) echo '<tr><td class="muted" colspan="2">Nessun dato ancora.</td></tr>';
+$cmax = 1; foreach ($countries as $r) $cmax = max($cmax, (int)$r['c']);
+foreach ($countries as $r) {
+    $label = sfstats_flag($r['country']) . ' ' . h($r['cname'] ?: $r['country']);
+    $pct = round(100 * $r['c'] / $cmax);
+    echo '<tr><td>' . $label . '<div class="bar" style="width:' . $pct . '%;margin-top:4px"></div></td><td class="r">' . (int)$r['c'] . '</td></tr>';
+}
+echo '</table></div>';
+
 echo '<div class="grid2"><div>';
 tbl('Pagine più viste (30g)', $top_pages, 'Pagina', true);
-tbl('Provenienza (referrer, 30g)', $top_refs, 'Sito');
+tbl('Provenienza (domini, 30g)', $top_refs, 'Sito');
 echo '</div><div>';
 tbl('Browser (30g)', $browsers, 'Browser');
 tbl('Sistema operativo (30g)', $oses, 'OS');
 echo '</div></div>';
 
+// full referrer links
+echo '<div class="panel"><h3>Link di provenienza completi (30g)</h3><table><tr><th>URL referrer</th><th class="r">Visite</th></tr>';
+if (!$top_links) echo '<tr><td class="muted" colspan="2">Nessun link esterno registrato.</td></tr>';
+$lmax = 1; foreach ($top_links as $r) $lmax = max($lmax, (int)$r['c']);
+foreach ($top_links as $r) {
+    $u = $r['k'];
+    $pct = round(100 * $r['c'] / $lmax);
+    echo '<tr><td><a href="' . h($u) . '" target="_blank" rel="noreferrer noopener nofollow">' . h($u) . '</a>'
+       . '<div class="bar" style="width:' . $pct . '%;margin-top:4px"></div></td><td class="r">' . (int)$r['c'] . '</td></tr>';
+}
+echo '</table></div>';
+
 // recent
-echo '<div class="panel"><h3>Ultime visite</h3><table><tr><th>Quando (UTC)</th><th>Pagina</th><th>Da</th><th>Client</th></tr>';
-if (!$recent) echo '<tr><td class="muted" colspan="4">Nessuna visita registrata.</td></tr>';
+echo '<div class="panel"><h3>Ultime visite</h3><table><tr><th>Quando (UTC)</th><th>Paese</th><th>Pagina</th><th>Da</th><th>Client</th></tr>';
+if (!$recent) echo '<tr><td class="muted" colspan="5">Nessuna visita registrata.</td></tr>';
 foreach ($recent as $r) {
+    $cc = $r['country'] ?? '';
+    $country = $cc ? sfstats_flag($cc) . ' ' . h($cc) : '<span class="muted">—</span>';
+    if (!empty($r['ref_full'])) {
+        $da = '<a href="' . h($r['ref_full']) . '" target="_blank" rel="noreferrer noopener nofollow">' . h($r['ref'] ?: $r['ref_full']) . '</a>';
+    } else {
+        $da = '<span class="muted">' . h($r['ref'] ?: '—') . '</span>';
+    }
     echo '<tr><td class="muted">' . h(gmdate('d/m H:i', (int)$r['ts'])) . ($r['bot'] ? ' 🤖' : '') . '</td>'
+       . '<td>' . $country . '</td>'
        . '<td>' . h($r['path']) . '</td>'
-       . '<td class="muted">' . h($r['ref'] ?: '—') . '</td>'
+       . '<td>' . $da . '</td>'
        . '<td class="muted">' . h($r['browser'] . ' / ' . $r['os']) . '</td></tr>';
 }
 echo '</table></div>';