Bot Protection
Eleven detection layers, AI crawlers named and catalogued, and numbers that only ever count people.
Everything the filters caught, on one board
The Bot Center shows what never reached your numbers: blocked requests per day, the top offenders by name, which detection method caught them, and the state of the blocklists. Not a black box: a report on the noise, kept separate from the signal.
Your bots get their own dashboard, not your dashboard.
- Blocked volume per day, with the worst bots named.
- Every catch attributed to the method that made it.
- Blocklists auto-refresh; the footer keeps the daily count.
You see exactly what you are not counting.
Bot Center docs →Eleven checks before anything counts
Four checks run in the browser before a single event is sent: WebDriver flags, software GPU rendering, empty language lists, impossible execution timing. Six more run server-side: 79+ bot user-agent signatures, 3,430 datacenter IP ranges, spam referrers, velocity limits, interaction analysis, behavioral scoring.
Client-side and server-side, in series.
- Headless browsers fail before they send anything.
- Datacenter traffic is matched against curated CIDR ranges.
- One flagged layer is enough: blocked or tagged, never counted.
Eleven locks on the front door.
How bot detection works →Know which AI bots read your site
57 AI bots are catalogued by intent: live retrieval (ChatGPT or Perplexity fetching your page for an answer, right now), search indexing, and model training. Each crawler is listed with its request volume, separate from your visitor numbers.
Visibility without contamination.
- GPTBot, ClaudeBot, PerplexityBot, and friends, by name.
- Live retrieval vs indexing vs training, told apart.
- Crawlers that ignore robots.txt are still visible here.
The AI reads your site. Now you can watch it read.
AI crawler tracking →One score that says if your traffic is real
Zero-engagement measures the share of sessions with no scroll, no clicks, and minimal time. Healthy sites sit under 25%. When the score spikes, the breakdown points at the culprit: bots that spoof mobile devices cluster on specific screen sizes, and an 89% zero-engagement bucket is not a coincidence.
A smoke detector for fake traffic.
- Zero-engagement share, overall and per device.
- Screen-size drill-down exposes spoofed-device clusters.
- Under 25% healthy, over 40% worth investigating.
When something is off, this number says so first.
Engagement Tracking →The last word is yours
Automation catches the crowd; you catch the stragglers. Open any session, judge the journey, and flag it as a bot in two clicks: it disappears from every metric, retroactively. Or delete it outright and it is gone from the database.
Flag, delete, done. Retroactive everywhere.
- Flag as Bot removes a session from all numbers, past included.
- Delete removes it entirely, events and all.
- Flagged bots stay visible in the Bot Center, so nothing hides.
Your data, curated by the person who knows the site best.
Session Tracking →Frequently asked questions
Having another question?
Reach out! We will be happy to help with any pre-sales questions.
Does bot filtering slow my site down?
No. The four client-side checks are simple property reads that take microseconds, and the six server-side layers run after the request leaves the browser. Visitors never wait on any of it.
How fresh are the blocklists?
Curated and auto-refreshed: 3,430 datacenter IP ranges, 2,322 spam referrer domains, and 79+ bot user-agent signatures, with 5,430 VPN ranges deliberately whitelisted so privacy-conscious real visitors are not punished.
Do bots show up in my reports at all?
Not in your visitor numbers. Blocked and flagged traffic is kept out of every KPI, panel, and realtime view, and appears only in the Bot Center, where you can audit what was caught and why.
Can I see AI bots I blocked in robots.txt?
Yes, when they come anyway. robots.txt is a request, not a wall: crawlers that ignore it still hit your server, and the AI Crawlers view lists them by name with volume. The polite ones that honor your robots.txt simply stop appearing.
What if the filters miss one, or catch a real visitor?
You have the last word both ways. Flag any session as a bot and it leaves every metric retroactively; sessions you flagged by mistake can be judged from their full journey before you commit. Deletion is permanent and complete.