How VisitAnalytics detects bots and counts only real visits
No tool can identify every robot, but several independent checks together remove the large majority. This page explains them so you can tune the filter with confidence.
Layer 1: known robots
The user agent (the name a client announces) is compared with lists of hundreds of known crawlers, AI bots, SEO tools, monitors, scripts and scanners. Anything that calls itself a "bot", "crawler" or "spider", or contains a web address in its name, is a robot too. These requests are removed immediately.
Layer 2: spam and attacks
- Referrer spam – visits that claim to come from known spam domains.
- Vulnerability scanners – requests for addresses only attackers use (
/wp-login.php,/.env,/phpmyadmin, path traversal...).
Layer 3: does it behave like a browser?
Real browsers send a typical set of headers. Scripts that merely pretend to be Chrome usually forget some of them. VisitAnalytics gives suspicious signs points:
| Sign | Why it matters |
|---|---|
No Accept-Language | Every normal browser sends the language settings. |
Accept: */* instead of HTML | A browser opening a page asks for text/html; scripts ask for anything. |
| No compression header, very short browser name | Typical for hand-written clients. |
Modern Chrome/Firefox without Sec-Fetch-* headers (HTTPS only) | Chrome 80+ and Firefox 90+ always announce what kind of request it is. |
| Request is not a page navigation | Scripts that fetch pages in the background. |
| Chrome without client hints | Current Chrome sends them on HTTPS. |
| Outdated browser or system (Internet Explorer, Windows XP, very old Chrome) | Bots often copy an old user agent. |
| Too many page loads per minute, or a second page within 3 seconds | Humans do not open 40 pages a minute, or two pages in two seconds. |
| Chrome on desktop Linux | Servers and scrapers run Linux; real visitors on Linux desktops are rare. |
| A "mobile" browser on desktop Linux | Does not exist: a scraper copied a phone name. |
The points are added up. If the total reaches the sensitivity threshold (default 60, see Tracking settings: bot sensitivity, ignored pages, sessions and more) the request is treated as a robot and appears as "Suspicious" in the The Bot filter: see which robots were kept out of your statistics. A single odd header never removes a visitor; several together do.
Layer 4: only real page views
Only normal page loads are counted: GET requests for HTML pages with status 200 (or 404 for the broken link list). Ajax calls, images, iframes, downloads, redirects, link prefetching and quick reloads are ignored. See How visitors, visits and page views are counted.
Layer 5: human verification (the strongest)
Header checks cannot catch bots that copy a real browser perfectly and connect through home or mobile addresses (residential proxies). So a page view counts only after the visitor moves the mouse, scrolls, clicks, touches the screen or types. The proof is sent by a small script with a token bound to the page view, the IP address and a 2 hour limit. The script also exposes faked browser names, faked systems, remote-controlled and headless browsers and software graphics. Read the details in Human verification.
You stay in control
- Every filtered request is listed with its reasons in the Bot filter.
- Your own IP addresses can be ignored: How to exclude your own IP address and private pages from statistics.
- The lists are plain PHP arrays that you can edit: Customizing VisitAnalytics: edit bot lists, colors and add reports.
Bot detection is a race: new robots appear constantly. VisitAnalytics is built to be effective, transparent and adjustable – but treat very small numbers with common sense.
Last updated