How we tell a real visitor from a bot
This is the actual method, not a pitch. Every request to a site you connect is scored across the signal layers below. Here is what each one looks at, how a genuine visitor is given the benefit of the doubt, and the limits we are honest about.
Reviewed against the live implementation on 2026-07-22.
When we say detection runs across dozens of signals, this is where the number comes from. The list on this page is the definition of record, kept in step with the code.
Network & IP reputation
Every event is resolved to the visitor’s real IP and network before anything else. These checks run at the edge on the request itself, so a stripped or relayed request cannot hide its origin.
Known-crawler user agents
At the edgeThe user agent is matched against a maintained list of 650+ verified-crawler signatures (search engines, AI harvesters, SEO tools, monitors). The dashboard names 78 of them individually so you can see exactly who called.
Datacenter ASNs
At the edgeThe network operator (ASN) is checked against a datacenter list. A real buyer does not arrive from a hosting provider on a server-to-server hop.
Spamhaus DROP ranges
At the edgeThe IP is checked against the Spamhaus DROP list of hijacked and abuse-only address space.
Repeat-abuser fleet list
At the edgeIPs already caught abusing sites in our own fleet are carried forward so they are flagged on first contact everywhere.
No edge country
At the edgeA genuine visitor reaches us through the Cloudflare edge, which stamps a country on every request. An event with no country never came in like a real visitor.
Cloudflare bot score
At the edgeWhere available, Cloudflare’s own bot-management score is stored alongside our verdict for context.
User agent & client hints
The user agent alone is trivial to fake, so it is cross-checked against client hints the browser sends automatically. A mismatch is a spoof.
Non-browser clients
Server-sideRequests from scripting and scanning tools, curl, wget, Python requests/httpx, Go http-client, Scrapy, Selenium, Puppeteer, Playwright, sqlmap, nmap and 20+ more, are identified by their own signature (29 fingerprints in all).
Empty user agent
Server-sideA request that sends no user agent at all is not a real browser.
Headless brand in client hints
At the edgeA "HeadlessChrome" brand in the Sec-CH-UA header is a headless automation browser regardless of what the user agent claims.
Client hints on a non-Chromium UA
At the edgeChromium sends Sec-CH-UA; Firefox and Safari never do. Client hints present on a request claiming Firefox or Safari is a forged profile.
Platform contradiction
At the edgeThe client-hints platform (e.g. Windows) is compared to the OS the user agent claims. A contradiction is a spoof.
Device profile consistency
A real browser reports a consistent picture of itself. Gaps and contradictions in that picture are how stripped and proxied traffic gives itself away.
Insufficient profile
Server-sideA genuine visitor sends at least two of browser, OS and device type. Fewer than two is a stripped, server-shaped event.
Timezone / country mismatch
In the pageThe browser’s own timezone reflects the device’s real location. A China timezone reported from a non-China IP is a proxy exit.
Automation detection
Headless and automated browsers can spoof a full, consistent profile. These checks look for the automation itself, in the page.
WebDriver flag
In the pagenavigator.webdriver is set by Selenium, Puppeteer, Playwright and agentic browsers. We read it directly.
Automation fingerprint (BotD)
In the pageA self-hosted open-source automation detector runs in the page and reports headless/automation frameworks even when the profile is otherwise clean. Its verdict rides the pageview and never delays it.
Request path
Vulnerability scanners look for the same files on every site. Those paths never belong to a real visit.
Scanner probe paths
At the edgeRequests for wp-login.php, xmlrpc.php, /.env, /.git/, wp-config, phpMyAdmin, /adminer, /.aws/, /.ssh/ and other probe targets (12 in all) are flagged as scanners.
Behavioural & session checks
The hardest bots, residential-proxy floods, look clean on a single request. They are caught by how a whole session behaves over time.
Session IP rotation
Server-sideA single session whose IP hops between addresses is a residential-proxy rotation.
Burst session
Server-sideMultiple pages in under ten seconds with no genuine interaction is machine paging, not reading.
Cold transit with no follow-through
Server-sideA proxy drip that touches a link but never renders or engages with the destination.
Session-mate of a caught bot
Server-sideEvents sharing a session with an already-flagged bot event inherit the verdict.
Idle without interaction
Server-sideA session that accrues dwell time but never records a trusted user input is flipped to bot by a periodic sweep.
Cold cloaked-link hit
Server-sideA cloaked affiliate button is only ever an on-page link. A click with no prior human pageview for that visitor never came from a real button press.
Owner rules
Two checks exist only when a site owner turns them on. Country is not a bot signal by default, the owner knows their own audience.
Country block list
At the edgeTraffic from a country the owner blocks counts as bot at ingest, with no benefit of the doubt.
Country watch list
At the edgeA softer setting: traffic is still counted, but gets no session rescue and a server hop with no in-page proof counts as bot.
How a real visitor is protected
Aggressive detection is only useful if it does not throw out real people. These rules exist to keep genuine visitors in your numbers.
- A visitor whose earlier pageview already proved human rescues their later profile-less events (e.g. a real cloaked-link click).
- A datacenter or VPN IP alone is NOT treated as a bot, a real person on a VPN is a real person. It only counts against a server-to-server hop that carries no in-page proof.
- Absence of client hints is never a signal on its own (Brave strips them; non-Chromium browsers never send them).
What this does not do
No bot detection is perfect, and a tool that pretends otherwise is not one you should trust with your numbers.
- No bot detection is perfect. We optimise to keep real people in your numbers and to err toward flagging on ambiguous automated-looking traffic, and we tell you the split rather than hiding it.
- If a visitor blocks the tracker (an aggressive ad blocker) and then clicks a cloaked affiliate link, that click has no prior pageview to vouch for it and can be counted as bot. This is a deliberate trade to keep forged clicks out.
- Cookieless-by-default measurement uses a server-derived daily identifier, so a visitor returning on a later day is counted as new. This is the privacy trade behind cookieless mode.
- Verified-crawler lists and datacenter/proxy feeds change constantly. We update them, but a brand-new crawler can be seen before it is named.
See it on your own traffic
The free plan is a real plan and needs no card, or read the product page first.