Astrina — a website analytics & monitoring platform

01Project overview

Astrina is an all-in-one platform for everyone responsible for websites: owners, web studios, agencies, developers, and SEO specialists. Its essence fits into a single line — "every site you look after, in one dashboard". Web analytics, daily SEO monitoring, reviews and reputation, public catalogs and rankings, plus a set of service APIs — all of it lives behind one login and is fed by one script on the site. You can start for free: the Free plan covers three sites and asks for no credit card.

The product grew out of an observation familiar to anyone who looks after more than one site. Traffic lives in one tool, SEO in another, reviews in a third, and every site has its own login. Each service is fine on its own, but keeping them in sync is the work nobody scoped, nobody bills for, and somebody does anyway. Astrina replaces those four tools and four logins with one: one script, one dashboard, and an email the morning something slips.

We designed and built the product end to end — from the first-party counter architecture and the nightly crawler to the pricing model, the public catalogs, the documentation, and three language versions (EN/RU/UK). Below we walk through the problem Astrina solves, how it works inside, and the engineering decisions that keep its numbers honest — including why the counter survives ad blockers and why not even the site owner can delete a review.

A word on context. Astrina is a product of the studio's own ecosystem, not an outside commission: we built a tool we use ourselves. The ostohlo.com website is connected to the platform as site #6 and collects its statistics through its own subdomain, stats.ostohlo.com — that is, through exactly the first-party model sold to customers. Eating your own cooking disciplines a team better than any test plan: every rough edge of the dashboard is something we feel first.

02Context and the problem

Keeping an eye on a website is easy "technically" — the hard part is doing it constantly and across every site at once. As we broke the task down, a whole list of pains piled up that anyone responsible for several projects lives with:

• Analytics missing a third of the picture. Ad blockers strip out third-party counters — roughly a third of the audience simply vanishes from the reports. Decisions get made on incomplete numbers.
• A zoo of tools and logins. Traffic, SEO, and reviews sit in three different services, and every site has its own credentials. The overall picture exists only in someone's head, or in a spreadsheet nobody remembers to update.
• Silent SEO regressions. A theme update quietly drops a canonical — and nothing tells you. You find out weeks later, when the traffic has already moved and somebody else is asking why.
• Reviews nobody believes. A rating the owner can touch up is worth nothing. And external review platforms with honest scores live apart from the site and its metrics.
• Routine with no owner. The regular "is everything okay" sweep is work nobody estimated in hours. It either doesn't get done, or gets done at the expense of the real work.

The brief came down to this: build a platform where every site — your own and your clients' — is visible in one table with live traffic and an SEO score, and where the routine watching is automated to the point of "the email arrives by itself". And the numbers had to be trustworthy — for the owner, and for the agency's client who gets shown them.

A separate layer of the task was honesty as a product property. Analytics clipped by ad blockers lies by a third; a rating that can be edited means nothing. We decided from the start that trust in the numbers would be guaranteed by architecture, not promises: the counter loads from the customer's own domain, and reviews physically cannot be altered or removed.

Finally, there was the multi-tenant layer. The platform serves hundreds of other people's sites with different plans, quotas, and languages — which means limits must be checked by code, tenant data must be isolated, and every figure on the pricing page must match a number in the configuration, not a marketing rounding.

03Project goals

From the brief grew concrete product and engineering goals that we kept in mind at every stage:

• One script, one login. Connecting a site is one line before the closing body tag. No SDK, no tag manager, no build step — a tag under 2 KB that starts reporting on the first hit.
• First-party by construction. The counter loads from the customer's own domain, so the ad blockers that scrub third-party analytics leave it alone. No cross-site cookies, and the data is never sold.
• An email instead of a watch shift. A site under monitoring is re-checked every night; if the SEO score drops, the email is in the inbox by morning. The owner hears it first — not from the client.
• Honesty as a mechanism. Reviews on a 1–5 star scale cannot be edited or deleted by the owner — only answered in public. That is precisely why the score can be believed.
• API-first. Everything visible in the dashboard can be taken out: a JSON API, CSV export, and MCP for AI assistants.
• A low barrier to entry. A Free plan for 3 sites with no card, and 3 free SEO checks a day on every plan — you can try before you ever pay.
• Three languages. The product is fully trilingual (EN/RU/UK) — from the interface to the emails and the public catalogs.

As in our other products, these goals were framed as constraints, not wishes: each one ruled out unsuitable options at the design stage. The first-party requirement immediately dictated the scheme of serving the counter through customers' domains; the honesty requirement banned any "admin" edits of reviews at the data-model level; and the "email instead of a watch shift" requirement turned the nightly recrawl scheduler from a feature into a load-bearing structure of the product.

04What we built

Astrina packages site watching into four modules that run off one script and one dashboard:

On top of the modules sit public catalogs and rankings (a website traffic rating, exchanger and hosting catalogs, and other App Store-style showcases), a pricing model from Free to Business Plus, and a trilingual dashboard. All of it is deployed as a single product on dedicated infrastructure.

Crucially, the modules aren't disjointed — they form one data loop: the script on the site feeds the analytics, the crawler feeds the SEO score, the reviews feed the reputation, and the public catalogs are built from the same measurements the owner sees in the dashboard. The same traffic figure appears in the private dashboard and in the public ranking — there is nowhere for it to "diverge". That cohesion is what separates a platform from a set of services under a shared logo.

05Solution architecture

At the core of Astrina is a multi-tenant kernel with the modules assembled around it. The central entity is the site: analytics events, SEO checks and their history, reviews, catalog positions, and plan quotas all hang off it. A user account is a collection of sites, and it makes no difference whether they are your own or your clients': an agency sees a hundred projects in the same table where an owner sees three.

Logically the system consists of five blocks: event intake (the counter endpoints that hits from every connected site pour into), the crawler (on-demand checks and the nightly recrawl with score history), the showcases (public catalogs and rankings built from the same data), the API layer (JSON, CSV, MCP), and notifications (the morning emails when a score drops). Each block owns its slice of the watching lifecycle and talks to the others across clear boundaries.

One architectural consequence follows directly from the first-party model: the counter must load from the customer's own domain, not from astrina.io. That means the infrastructure has to serve other people's domains — accept traffic on customer subdomains, deliver the script from them, and receive events on them. Tag delivery and hit intake were designed for this from the start rather than bolted on later: it is the busiest and most public part of the system, and it is separated from the dashboard and the crawler.

Under the hood is a server stack on PHP 8.3 with MySQL, behind Cloudflare (DNS, TLS, perimeter protection). Plan quotas — the number of sites, the depth of history, the daily limits on checks and API calls — are checked by code on every action: every figure on the pricing page corresponds to a number the system actually enforces. That is honesty towards the user, but also the platform's own protection against being overrun by a single tenant.

06The first-party counter

Astrina's central engineering decision answers an unpleasant industry fact: ad blockers scrub third-party counters, and roughly a third of the audience never makes it into the reports of conventional analytics. The owner looks at a chart and believes they are seeing their traffic — when they are seeing two thirds of it.

The answer is loading the counter from the customer's own domain. Ad blockers cut requests to known analytics domains; a request to a subdomain of the site itself is indistinguishable to them from loading an ordinary asset. So the Astrina tag is served not from astrina.io but from the owner's domain, and the statistics cover the whole audience — not just the part that never installed a blocker.

The tag itself is extremely light and extremely boring — and that is a compliment: under 2 KB, one line before the closing body tag. No SDK, no tag manager, no build step; the counter starts reporting on the first hit. For visitors with JavaScript disabled there is a noscript pixel, so even that tail of the audience isn't lost. And first-party does not mean surveillance: the counter uses no cross-site cookies, builds no cross-site profiles, and the owner's data is never sold.

The model is battle-tested on the studio's own website: ostohlo.com is connected to Astrina as site #6 and loads the counter from the stats.ostohlo.com subdomain — the light a.js tag plus r.js for session recording. That is production proof of the scheme: the same CNAME approach, the same delivery from a customer domain, the same numbers in the same dashboard as for any user of the platform.

07Key capabilities

Let's look at what makes Astrina not "yet another counter" but a platform that covers watching a website end to end.

Live analytics

A live view of visitors, traffic sources, and goals — the essential set, but built on first-party numbers. The dashboard shows what is happening on the site right now, where people come from, and whether they reach the target actions. Higher plans add a live visitor feed and session replay — you can watch a real visit back instead of guessing from the numbers.

An SEO check in under a minute

A full technical audit of a site takes less than a minute — up to 25 pages per pass. Three checks a day are free on every plan, including Free: the product lets you feel its core without paying. Every issue found comes with a ready-made prompt for an AI assistant — the bug description can be copied straight into your favourite tool, which will propose a fix.

Reviews, the widget, and the SVG badge

The reputation module collects 1–5 star reviews that the owner can reply to in public but cannot edit or delete. The rating embeds on a site as a widget, and the SVG badge fits a README, a footer, or a signature. Why immutability is a feature is covered in its own section below.

Catalogs and rankings

Astrina runs public showcases built from its own measurements: a traffic rating of sites running the counter, exchanger and hosting catalogs with rates and reviews, and an App Store-style catalog. The showcases are open without an account — anyone can check how the platform counts, and that is part of the trust model.

Service APIs

Beyond the core modules, the platform exposes practical utilities: a phone intelligence API for checking phone numbers and a password check against leak databases. It is the same data that feeds the catalogs — available programmatically.

Login with Astrina and support desks

"Login with Astrina" is a ready social login configured once, taking password storage off the site owner's plate. And hosted support desks give every project a ready support page at astrina.io/support/<domain> — with no ticket system of your own to deploy.

MCP for AI assistants

The platform's data is available to AI assistants over MCP: an assistant can fetch statistics or check results itself and work with them in conversation. An API designed for people and scripts turned out to be ready for agents too.

08Inside SEO monitoring

A one-off site check is useful, but the real value of monitoring is regularity. A broken canonical does not announce itself; it just sits quietly in the code until the rankings slide. So the heart of the module is not the audit itself but the nightly scheduler.

It works like this. A one-off check is available to everyone: a full technical pass over up to 25 pages in under a minute, three free runs a day on every plan. But a site placed under monitoring is re-checked by the platform every night, on its own — no request, no button, no reminders. Each night's result lands in the history: the SEO score turns from a snapshot into a curve, and the curve shows exactly when something broke and what things looked like before.

The third element is the morning email. If the nightly pass records a score drop, the email arrives the morning of that same day. The point of this decision runs deeper than it looks: the inbox becomes the monitoring interface. The owner doesn't need to open the dashboard "just in case" — the dashboard comes to them, and precisely when there is something to say. Silence in the inbox is information too: it means all is well.

The number of sites on the nightly recrawl is one axis of the pricing grid: 3 sites on Pro, 25 on Business, 100 on Business Plus. That is an honest reflection of cost: nightly crawling is the most resource-hungry part of the platform, and its quotas, like all the others, are enforced by code.

09Immutable reviews

The reputation module is built around one hard rule: the site owner can neither edit nor delete a review. Not for money, not via support, not "as an exception". The only tool available to them is a public reply next to the review.

The decision is counterintuitive as product design — surely a paying customer deserves control. But a rating the owner can groom means nothing: it is a score they gave themselves. Immutability is the only reason the number next to the stars can be believed at all. We deliberately built this into the data model rather than into policy: the system simply has no "edit someone else's review" operation, and no role is ever granted one.

Honesty cuts both ways, though. The public reply lets the owner work through a disputed situation in full view — and a thoughtful reply to a critical review often persuades more than a five-star one. The 1–5 star scale is simple and familiar, and the collected rating can be carried onto the owner's own site as an embeddable widget or a light SVG badge — the score stops living only on a catalog page and starts working where decisions are made.

10Privacy and security

An analytics platform by definition handles sensitive data — other people's traffic. So privacy in Astrina is not a section of the terms of service but a set of architectural decisions. The counter sets no cross-site cookies and builds no cross-site profiles: the first-party model means each site's data lives in that site's context. And the platform's principled promise is that owners' data is never sold: Astrina's business model is subscription, not trading in audiences.

The second layer is API security. The key is accepted only in an HTTP header and never in a URL. That is a deliberate decision: URL parameters settle into server logs, proxies, and browser history, and a key once passed in a query string should be considered compromised. Headers don't end up in logs — so one line of the spec closes off an entire class of leaks. For users, the same discipline turns into a service: a password check against leak databases is built into the platform.

The third layer is tenant isolation. Each account's sites, keys, reviews, and quotas are separated from everyone else's; an agency with a hundred client projects can neither see another tenant's data nor exhaust another tenant's limits. Quotas enforced by code on every action protect not only pricing honesty but the platform's stability: one runaway script won't take the crawler down for everyone.

11The multi-site dashboard

Astrina's main screen is a table of all the account's sites: visitors over 30 days, the trend, the SEO score, live status. That entry point is a deliberate choice: a product for people who look after many sites should open with the answer to "am I okay — across all of them at once". One glance at the table replaces the morning round of five services.

The pricing grid is built around the real axes of cost — the number of sites, the depth of history, and the amount of automation. Free ($0) — 3 sites, the live view, sources and goals, 3 SEO checks a day, reviews and the rating widget, 33 days of history. Pro ($19 / 30 days) — 25 sites, 180 days of history, 3 sites on the nightly recrawl with alerts, CSV export and the live visitor feed, 5,000 API calls a day. Business ($59) — 100 sites, a year of history, 25 sites on the recrawl, session replay, and 25,000 calls. Business Plus ($99) — unlimited sites, 730 days of history, 100 sites on the recrawl, a hosted support desk for your own users, and 100,000 calls a day.

Payment is handled in a grown-up, ecosystem way: plans are paid from an account balance topped up by card or crypto through Payora — another product of our ecosystem, with a case study of its own. Automatic renewal is off by default: nothing charges you by surprise; renewal is switched on by the user themselves. For SaaS this is rare, almost demonstrative honesty — and it belongs to the same family as the undeletable reviews.

Every figure in this section is not marketing copy but a value from the configuration that the code checks: creating the 26th site on Pro isn't "discouraged" — it doesn't execute. We hold to the rule that "the pricing page is the documentation of the limits", and it makes life dramatically simpler for support and users alike.

12Developer API and integrations

Everything the platform shows in the dashboard, it can also hand over. The Developer API is JSON with predictable responses, and its design carries two decisions we consider exemplary for any API.

The first is the key in a header only. The API does not accept a key in the query string at all: a URL with a key ends up in web server logs, proxies, browser history, and referrers, and leaks from there. A header does not. The correct behaviour here isn't "recommended by the documentation" — it is the only one possible. The second is the remaining quota echoed in every response. The client needs neither a separate endpoint nor its own bookkeeping: every response says how many calls are left. A script can slow itself down before the limit instead of discovering it through a 429.

Beyond JSON, data exports to CSV — for reports, spreadsheets, and everything that lives outside code. Over MCP the same data is available to AI assistants: an agent requests statistics or check results right in the conversation. "Login with Astrina" covers social login for sites on the platform, and hosted support desks (astrina.io/support/<domain>) cover user support without a ticket system of your own. The platform is friendly to the outside world too: Google Search Console, Google Analytics 4, Bing Webmaster, and IndexNow are on the list of supported integrations.

Finally, the public catalogs are an integration of a kind as well — with the open internet. The traffic rating is built from the same 30-day counter measurements the owner sees in the dashboard; the exchanger and hosting catalogs from the same data and reviews. The platform counts in plain sight, and anyone can verify its work without an account.

13Technology stack and infrastructure

For Astrina we assembled a dedicated, isolated environment with its own domains, policies, and scheduler. For a platform that serves other people's websites, tidiness of the environment is part of the product.

• Backend — PHP 8.3: counter event intake, the multi-tenant kernel, the dashboard, the API layer, and the quota logic.
• Data — MySQL: analytics events, SEO score history, reviews, catalogs, and plan limits in one consistent model.
• Crawler — the checks module: on-demand audits of up to 25 pages and the nightly recrawl of monitored sites with history accumulation.
• Counter delivery — first-party serving of the tag from customers' domains (the CNAME model), with a noscript pixel as fallback.
• Notifications — email alerts: the message arrives the morning of the day the score drops.
• Infrastructure — Cloudflare (DNS, TLS, perimeter protection) and an isolated environment with valid certificates.

The choice of PHP 8.3 and MySQL is pragmatic: a mature, fast, predictable stack on which the high-frequency hit intake, the crawler, the dashboard, and the API all live in one environment. First-party delivery adds an unusual requirement to the stack — serving other people's domains as its own — and it is exactly what shaped the perimeter configuration. Cloudflare covers DNS and TLS, and the whole environment is designed so that the busiest part (event intake) doesn't compete for resources with the heaviest part (nightly crawling): they have different load profiles and different peak hours.

14Design and UX

A tool for daily routine sells calm, so we made Astrina's interfaces dense and quiet. The main screen — the table of sites with trend and SEO score — answers the user's main question in a second. No welcome banners, no "insights of the week": a person with a hundred client sites comes to check, not to browse.

The first five minutes got special care. The path from sign-up to the first visitor on screen is deliberately short: paste the tag line — see a live hit. Instant feedback works as onboarding here: not interface tours, but your own traffic appearing before your eyes. The same principle drives the SEO module: the first check is free, takes under a minute, and ends with a concrete list of issues — each with a ready AI prompt attached.

The public side of the platform — the catalogs and rankings — is designed as a showcase in its own right: open, indexable, working without an account. It is both a marketing surface and a demonstration of method: the platform isn't afraid to show how it counts. Finally, the whole product is trilingual — EN, RU, and UK are equals, from the interface and the emails to the public pages, with correct hreflang and localized URLs. For a product living in several language environments at once this is a matter of content architecture, not translation — and it was designed in from day one rather than "localized" afterwards.

15How we worked

We ran the project in sequential stages, demonstrating a result at every step:

• Research. We mapped the scenarios of owners, studios, and agencies, weighed the pains of the "four tools", and fixed the model of "one script → one dashboard → an email in the morning".
• Architecture. We designed the multi-tenant kernel, the first-party counter delivery scheme, the quota model, and the API contract — the header-only key and the quota echo were in the spec before the first line of code.
• Module development. We built event intake and analytics, the crawler with the nightly scheduler and history, the reviews module with immutability at the model level, the catalogs, and the dashboard.
• Run-in on ourselves. We connected our own projects — ostohlo.com lives on the platform as site #6 with the counter on stats.ostohlo.com — and used the product for months before inviting anyone else.
• Launch. Pricing with payment through Payora, three languages, the public catalogs, documentation, and MCP.

The order isn't accidental: first we fixed the contracts — the quota scheme, the API format, the review-immutability rule — and only then built the implementation around them. That let the modules move almost in parallel: analytics, the crawler, and reviews share a kernel but have independent lifecycles. And the "use it ourselves first" rule worked as continuous acceptance testing: a rough edge you notice every morning in your own dashboard gets fixed faster than any ticket.

16The result

What we got is not "yet another counter" but a platform that replaces a webmaster's set of daily tools — and one we use ourselves.

• A site connects in five minutes: one tag line — and the first visitor is already on screen.
• Analytics sees the whole audience, not two thirds: the first-party counter isn't clipped by ad blockers.
• SEO regressions stopped being silent: the nightly recrawl, the score history, and the email the morning of the drop.
• The rating can be trusted: reviews physically cannot be edited or deleted — only answered in public.
• The data isn't locked in: a JSON API with header-only keys and the quota in every response, CSV, and MCP for AI assistants.
• The product runs in three languages and is production-proven on the sites of our own ecosystem.

But the main result isn't in individual numbers — it's in the shift of model. Watching over websites used to be a set of tabs, logins, and "must remember to check"; now it is one table and an inbox the platform writes to by itself — precisely when there is something to say. The routine nobody ever estimated in hours has ceased to exist as manual work.

17Takeaways

Astrina is an example of trust being engineered rather than declared. The most valuable thing here isn't the list of modules but the three decisions everything rests on: a counter that loads from the customer's domain and therefore sees the whole audience; reviews that cannot be deleted and therefore mean something; an API in which the key physically cannot end up in a log. Each was made once, at the architecture level — and from then on the product's honesty doesn't depend on anyone's discipline.

For us this was a project at the intersection of analytics, crawling, and multi-tenant SaaS — the kind of work where product thinking and engineering discipline are needed at the same time. If you need a platform with a dashboard, pricing plans, and an API, an analytics service, or a product serving many customers on shared infrastructure — we know how to carry that through to launch.

And one more, more methodological, takeaway. The best test of a product is your own dependence on it: we connected our own sites to Astrina before anyone else's, and every morning we look at the same emails and the same tables as our users. A product the team lives on cannot be quietly abandoned — and that is perhaps the most honest quality guarantee there is.