Bot Protection
10-layer detection. Zero noise.
Every request runs through 10 checks before it reaches your dashboard
Four checks run in the browser before any data is sent. Six more run server-side when the event arrives. If any single layer flags a request, it is blocked or tagged.
This is not a static blocklist. The system combines client-side signals like GPU rendering, browser languages, and execution timing with server-side checks like datacenter IP matching, fingerprint velocity, and interaction analysis.
- Headless browsers caught by WebDriver detection before they send a single event
- Distributed scrapers caught by fingerprint velocity: 100+ events from the same browser profile in 10 minutes
- AI crawlers identified by user agent pattern matching across 79+ known bot signatures
Know exactly which AI bots crawl your site
Clickport identifies and catalogs 57 AI bots across three categories: live retrieval (ChatGPT, Claude, Perplexity searching your site in real time), search indexing (AI-powered search engines building their index), and model training (bots scraping content for training data).
The AI Crawlers section in your Bot Center shows which bots visited, how many requests they made, and when they last crawled. Separate from regular bot filtering so you always have visibility into AI activity.
- See if GPTBot is training on your content, even if you blocked it in robots.txt
- Track which AI search engines are indexing your pages for live answers
- Monitor crawl frequency and volume per bot over time
A single score that tells you if your traffic is real
The Traffic Quality metric measures the percentage of sessions with zero engagement: no scroll, no clicks, minimal time on page. A low percentage means clean traffic. A high percentage means something is off.
Drill into the breakdown by device type and screen size. Bots that spoof mobile devices tend to cluster on specific resolutions. When you see 80% zero-engagement on one screen size but 12% on others, you have found the problem.
- Green (<25%): healthy traffic. Most visitors are real.
- Yellow (25-40%): worth investigating. Check sources and screen sizes.
- Red (>40%): significant bot activity. Time to dig into sessions.
Flag, delete, or block. You stay in control.
Automated detection catches the majority, but sometimes you spot something the system missed. Open any session, review the journey, and flag it as a bot with one click. Flagged sessions are permanently excluded from all dashboards and metrics, retroactively.
Need to remove a session entirely? One click deletes it from the database. No events, no session row, no noise.
- Flag a suspicious session: excluded everywhere, immediately, permanently
- Delete a session entirely: complete removal from your data
- Retroactive scope: flagged and deleted sessions disappear from historical numbers
Always up to date, always fast.
Curated and auto-refreshed
Datacenter IPs, spam referrers, and bot signatures are sourced from maintained community lists and updated automatically every week. VPN ranges are whitelisted separately so real users behind VPNs are never blocked.
10 checks, zero performance cost
All bot detection runs inside the existing tracker and API pipeline. No additional scripts, no third-party services, no network requests. Your visitors never notice it.
Explore more features