Bot filtering rules

Every hit, browser or server, goes through the same bot checks before it's counted. Bots are counted in aggregate (reason, country) with no IP stored, and don't count toward your usage.

Checks, in order#

1. Empty User-Agent → bot_empty_user_agent.
2. Known crawlers (Googlebot, Bingbot, GPTBot and the rest of our UA list) → bot_known_bot.
3. Automation and HTTP libraries → bot_automation. User-Agents containing any of: headless, phantomjs, puppeteer, playwright, selenium, webdriver, electron, slimerjs, lighthouse, pagespeed, gtmetrix, pingdom, uptimerobot, monitage, prerender, python, curl, wget, httpclient, okhttp, go-http, java/, axios, node-fetch, scrapy.
4. Data-center networks (major cloud and hosting providers, by ASN) → bot_datacenter. VPN and relay networks such as iCloud Private Relay aren't on the list, so real people behind them count.
5. Referrer spam domains → bot_referrer_spam.

What this means for server-side events#

• Always send the visitor's user_agent. If you leave it out, or your HTTP library's default (python-requests/2.x, node-fetch, curl/8, Go-http-client…) ends up in user_agent, the event is dropped.
• Send the visitor's ip, or none at all. Your server's IP is often a cloud IP and would be filtered as a data center.
• The request's own headers don't matter: the checks use the user_agent and ip fields in the body.

Visits with no input seen#

Some bots run a real browser with an ordinary User-Agent, so the checks above let them through. They tend to load one page and leave without touching it. To help you spot them, the tracker reports whether it saw any real input during a visit: a pointer press or move, a key press, a touch or a wheel turn. It sends a yes or no only, never what the input was (see What the tracker sends).

Every visit then has one of three values in the interaction dimension:

These visits are not dropped, and they count toward your usage like any other. A person who opens a page and closes it without touching it also shows as none, so read it as a signal, not as proof.

• Overview → Technology → Interaction breaks visits down by the three values. Click a row to filter the dashboard by it.
• To leave them out of a report or an API call, filter with ["interaction", "is_not", "none"]. Save it as a segment to reuse it.
• Site settings → Bots shows how many visits in the last 30 days had no input seen, with links to both views.

Turning filtering off#

Site settings → Bots lets you switch bot filtering off for a site, for diagnostics. Everything is then counted, including crawlers. Turn it back on when you're done.

The bot summary on the same tab shows the last 30 days by reason and country, and the Overview's footer shows how many hits were filtered. For AI crawler visibility (which never runs JavaScript), use the AI crawler logs.