How to Track QR Code Scans for Free (Without a Subscription)

"How many people scanned my QR code?"

Fair question. You printed five hundred flyers, put up posters, stuck a code in your shop window. You want to know whether it worked.

And that is exactly where the paid services are waiting. Upgrade to dynamic QR codes, track your scans in real time, only $19 a month! Tracking is the number one selling point of every QR subscription on the market.

You don't need to pay for it. Genuinely. Here's how to count your scans for free, with tools you almost certainly already have.

The idea everything rests on

A static QR code — the free, permanent kind — encodes an address directly. The phone reads it and opens the page. There's nobody in the middle to count anything.

So how do you count?

The trick is simple: instead of counting scans, count visits to the page the code opens. And any web analytics tool on earth can do that.

The whole thing reduces to one sentence: if your QR code is the only way to reach a given page, every visit to that page is a scan. Count the visits, you've counted the scans.

Three ways to put that into practice, from simplest to most capable.

Method 1: a dedicated page

Create a page that only your QR code uses.

Instead of pointing the code at yoursite.com, point it at yoursite.com/menu or yoursite.com/summer-offer. An address you share nowhere else — not in emails, not on social, not in your newsletter. Only inside the QR code.

Result: every visit to that page came from a scan. Your normal analytics tool gives you the visit count. That's your scan count.

Simple, free, and entirely yours.

The upgrade that costs nothing: make one page per placement. /flyer for the flyers, /window for the shop window, /station-poster for the one at the train station. Each code points to its own page, and at a glance you can see which placement is actually working.

That is precisely the "campaign tracking" feature the paid services charge for. You've just rebuilt it for zero.

If you'd rather not have a dozen thin pages, make them redirect to the real destination instead — /flyer sends visitors to /menu, and the redirect still gets logged.

Method 2: UTM parameters

If you already use an analytics tool, UTM parameters are your friend.

A UTM parameter is a short label appended to a URL that tells your analytics where a visitor came from:

yoursite.com/offer?utm_source=qr&utm_medium=flyer&utm_campaign=summer2026

That trailing gibberish changes nothing for the visitor — they land on the same page. But your analytics reads the labels and files the visit correctly: source qr, medium flyer, campaign summer2026.

Now you can compare properly. How many scans from flyers versus posters? Which campaign performed best? Which of two poster designs pulled more? All answered in a dashboard you already have, for nothing.

One technical warning. UTM parameters lengthen the encoded URL, which makes the QR code's grid denser and every module smaller at the same printed size. A long tracking URL produces a pattern that's meaningfully harder to scan, especially on older phones and small print.

Keep them short. Or better: use a clean short path (/flyer) that redirects server-side to the full UTM-tagged URL. The code stays sparse, the tracking still works, and everybody wins.

Method 3: your own redirect

This is the method almost nobody mentions, and it gives you everything a paid dynamic QR does.

Point the code at a short path on your own domain — yoursite.com/q/1 — and have your server redirect that to wherever you want. The redirect is one line of configuration on most hosts, or a tiny route if you run your own app.

What this buys you:

• The printed code never changes, because the address never changes.
• The destination can change forever. New menu, new campaign, new site — you edit the redirect.
• Every hit is logged by definition, with timestamp, referrer and user agent.
• The URL stays short, so the code stays sparse and easy to scan.

That is the entire feature set of a "dynamic QR code", running on infrastructure you already pay for, with no third party in the middle and nothing to expire.

The difference between this and a commercial dynamic QR isn't capability. It's ownership. Their version stops working when the subscription does; yours stops working when you decide it should.

Which method to use

	Effort	What it gives you
Dedicated page	Minutes	Scan counts per placement
UTM parameters	Minutes	Detailed campaign attribution in existing analytics
Own redirect	An hour, once	All of the above, plus a changeable destination

Most people should start with the dedicated page. Add UTM parameters when you're running more than one campaign at a time. Set up your own redirect when you have printed material in the wild whose destination might need to change.

If you have no analytics tool at all

You still have numbers: your server access logs. Every host keeps them, and every request to your dedicated page or redirect path is a line in there with a timestamp.

Counting them is one command if you can reach the log file, and most hosting control panels expose a traffic view that does it for you without any command line.

Two caveats. Logs are noisier than a JavaScript-based analytics tool, because they record every crawler, security scanner and link-preview fetch alongside real people. And many hosts rotate or delete them after a few weeks, so a scan campaign you analyse two months later may have nothing left to analyse.

Fine for a rough count. Not what you want if the number matters.

What a paid service genuinely adds

Fairness requires admitting these aren't nothing:

• You don't need a domain or a host. If you have no website at all, a paid service gives you a working destination in two minutes. That's real convenience.
• Editing destinations without touching config. A dashboard is friendlier than a redirect rule for someone who doesn't want to think about hosting.
• Bulk management. Hundreds of codes across many locations, in one interface, is genuinely tedious to build yourself.
• Scan-level detail out of the box — device type, rough location, time of day — pre-aggregated, with no setup.

If you're managing QR codes at industrial scale, those add up to a reasonable purchase.

For everyone else — a shop, a restaurant, a freelancer, an event, a small campaign — you are paying monthly for a redirect and a chart. And you're accepting the one risk that never appears in the sales page: your printed codes stop working when you stop paying. Print is permanent. Subscriptions are not. That asymmetry is the whole argument.

What the numbers actually tell you

Now some honesty, because this is where I part ways with the subscription vendors.

Scan statistics are useful. They're also more limited than the marketing suggests.

What they tell you well:

• how many times the code was scanned, and when;
• which placement or campaign generates the most scans;
• the shape over time — the spike after a mailing, the decay afterwards.

What they don't tell you:

• Whether the scan achieved anything. A hundred scans that bounce immediately are worth less than one scan that ends in a purchase. Raw scan count is a vanity metric unless it's tied to an outcome.
• Who scanned. You have a number, not faces. For a local business, watching customers scan in the room usually teaches you more than a dashboard does.
• Whether the code was the reason. Someone who was going to visit your site anyway, and happened to use the code because it was closer than typing, isn't incremental.

My advice: don't look at scan count alone. Look at what happens after. How many scans led to a form submitted, a menu read to the end, an item added to a basket? That chain is what matters, and it's measured with the same free tool.

Two things that quietly corrupt your numbers

Your own testing. If you scan your own code twenty times to check it works, those twenty scans land in your statistics. Same for reloading the page from your desk to proofread it. Your first week's numbers are inflated by you, and you'll believe in a success that hasn't happened yet.

Two habits fix it: do your testing before you turn tracking on, and exclude your own device or IP from analytics — nearly every tool supports this. Turn it on from day one, not after you've noticed the problem.

It sounds obvious written down. But in week one, refreshing the dashboard hourly, everyone forgets that half the traffic is themselves.

Bots and link previews. Some messaging apps, security scanners and crawlers fetch a URL to generate a preview or check for malware. If someone photographs your poster and sends it in a group chat, the resulting fetches can appear as visits. Some scanner apps also pre-fetch the destination before showing the user a confirmation.

You can't eliminate this, but you can reduce the noise: use an analytics tool that filters known bots, and treat any single sharp spike with suspicion before celebrating it. Server logs are especially noisy here — a JavaScript-based analytics tool naturally filters most non-browser traffic, because bots generally don't run the script.

Measuring without tracking people

Worth separating two things that get conflated: measuring is not surveilling.

Big dynamic QR services often collect far more than a scan count — precise location, device fingerprint, sometimes enough to correlate the same person across separate campaigns. In Europe that level of collection takes you straight into GDPR consent, cookie banners, and the paperwork that follows. And it applies to your EU visitors regardless of where your business is.

The good news: the free methods above avoid all of it, provided you pick the right analytics tool.

Count visits to your dedicated page with a privacy-respecting analytics tool — several measure traffic without setting a cookie or storing an IP address. You get your scan numbers, aggregated and anonymous, with no consent banner to display and no profiling of your visitors.

It's a virtuous circle: the less personal data you collect, the fewer legal obligations you carry, and the more your visitors trust you. To count scans you need nothing beyond an anonymous total. Leave personal data where it belongs — which is to say, uncollected.

Should you track at all?

Slightly taboo question, but let's ask it.

For a lot of small uses, the answer is no. A WiFi code in your waiting room, a vCard on your business card, a restaurant menu: what would you do differently knowing it was scanned 47 times last month? Nothing. That's curiosity, not management.

Tracking becomes worthwhile when there's a real decision to inform. You're testing two designs and want to keep the better one. You're choosing between two poster locations. You need to justify a marketing budget with numbers. Then yes, measure — and the free methods above are entirely sufficient.

But tracking for its own sake, paying monthly for a dashboard you'll check twice and then forget? That's the most reliable way to spend money on data that will never change a decision.

In summary

1. Point your code at a dedicated page that nothing else uses.
2. Count visits to it with the analytics you already have.
3. Add UTM parameters — kept short — to separate placements and campaigns.
4. Set up your own redirect when the destination might need to change later.
5. Watch what happens after the scan, not the raw count.
6. Exclude your own testing, and be sceptical of spikes.

You end up with essentially everything a $19-a-month subscription would sell you: without the subscription, without the dependency, and with a static code that will never expire.

You can generate a free QR code here, point it at your dedicated page, and start measuring today. The numbers are yours, the tool is yours, and nobody switches anything off the day you stop paying.

Because there was never anything to pay.