Matomo comes as software to run yourself (On-Premise) and as Matomo Cloud. In between there is a third way: a service provider runs your own Matomo instance for you. Which way fits depends less on technology than on two questions: where should the data be, and who takes care of it over time?
Three ways to run Matomo
| Own server | Matomo Cloud | Service provider | |
|---|---|---|---|
| Where the data is | where you decide | in Frankfurt, according to Matomo | in the provider’s data centre or on your servers |
| Who handles updates and security | your team | the cloud provider | the service provider, by contract |
| Plugins | all from the Marketplace plus your own | what the cloud offers | as on your own server |
| Effort for you | high, ongoing | low | low |
| Suits | teams with their own IT and time for operations | websites with standard needs | organisations that want control but no operations of their own |
What the server needs
Matomo runs on a common web server with PHP and MySQL or MariaDB, on Linux, Windows, macOS Server or FreeBSD.
- Matomo 5: PHP 7.2.5 or newer, PHP 8 recommended, and MySQL from 5.5 or MariaDB.
- Matomo 6: PHP 8.1 or newer and MySQL 8.0 or MariaDB 10.6 or newer. More on this in Matomo 6.
- PHP extensions such as GD for the graphs in reports and emails, plus a PHP that may run commands on the command line, for archiving.
How large the server needs to be cannot be read from a one-size-fits-all table; the rules of thumb going around are mostly outdated. How much power Matomo needs depends mainly on these factors:
- Requests per month: page views, events, downloads and orders are all requests to Matomo.
- Websites and segments: Matomo calculates separate reports for each website and each segment.
- Archiving: how often it runs and how much history it has to recalculate after changes.
- Database: it is usually the bottleneck and above all needs memory. Matomo data grows fast; how fast depends on the raw data and how long you keep it. With 8 or 16 GB RAM you will not get far if the database runs on the same server.
- Plugins: extensions such as heatmaps, session recordings or custom reports add load.
- Many distinct actions: every new URL, page title and event name becomes its own entry in Matomo’s action table. URLs with session or search parameters make it grow out of control, and archiving and reports with it. You exclude such parameters in the website settings.
- Peaks: campaigns or press coverage bring a multiple of the usual traffic in a short time.
It therefore makes sense to size the server to your actual traffic, your reports and your retention, and to plan for growth.
What keeps creating work in operations
Installation takes an afternoon. Operations last as long as Matomo runs:
- Updates and patches for Matomo, plugins, PHP, database and operating system. Security holes like PHP2Shell need a reaction within days, not at the next maintenance window.
- Archiving via cron job, tuned to traffic, websites and segments.
- Backups of the database, tested, and a plan for restoring them.
- Monitoring and intrusion detection: monitoring, so a tracking outage does not only come to light when numbers are missing, and intrusion detection that reports attacks on the server.
- Spam and bots, which distort reports and create load.
- Traffic peaks, for example during a campaign or after press coverage.
- Configuration and privacy: IP masking, retention periods, consent. More on this in Matomo and privacy.
Archiving decides the speed
Matomo first stores every visit individually. The reports you see are only calculated by archiving. Without a cron job this happens when someone opens a report, and that is exactly when it gets slow as traffic grows. With a regularly running cron job for core:archive, the reports are ready in advance. Whether reports load quickly therefore often depends less on the size of the server than on properly set up archiving.
Data location and contract
For many organisations this is the first question. With Matomo On-Premise you decide the location yourself. According to Matomo, Matomo Cloud stores the data in Frankfurt. Whoever runs Matomo for you, Matomo Cloud or a service provider, processes the data on your behalf; that requires a data processing agreement under Art. 28 GDPR. For Matomo Cloud, Matomo offers such an agreement. The legal assessment of your setup stays with your legal advisers.
Industries with special requirements
In banking, insurance and healthcare, a Matomo that simply runs is usually not enough. These industries add special requirements for security, documentation and audit readiness:
- Strict hardening of server, web server, PHP and database, not just of Matomo itself.
- Regular penetration tests, often required by information security or internal audit.
- Documentation and evidence: an operations concept, who checks what and when, and how security holes are handled.
If you run Matomo in these industries, plan for this from the start. More in Security and hardening and for banks and insurers and healthcare.
Running it yourself fits if
- your IT has time for itUpdates, patches and archiving are firmly planned.
- requirements demand itThe data must be on your own servers.
- you need your own pluginsFor example connections to internal systems.
Handing it over fits if
- Matomo runs on the sideNobody takes dedicated care of patches and security.
- reports are slowArchiving and server do not grow with the traffic.
- Matomo is business-criticalOutages should come to light before numbers are missing.
Sources
As of 12 November 2026