Skip to Content
FeaturesBot Filtering

Bot Filtering Available (v1)

Crawlers, scanners and automation tools are kept out of your data automatically — so recordings, heatmaps and statistics reflect real people, not machines.

Where in the dashboard

Settings → Tracking & bots — per website. Filtering runs automatically; the page also shows transparency (bots filtered vs. real visitors), the on/off toggle, IP rules and a log of the bots it caught.

Core concept

Bot detection is server-side and deterministic, running right at ingest — before a session enters your aggregates. It is on by default per website; you don’t have to set anything up. Sessions flagged as bots are kept out of recordings and statistics, and they do not count against your session quota.

Several signals are combined, in a fixed order:

  • Known bots (user agent) — a maintained list of common crawlers (Googlebot, Bingbot, AhrefsBot, SemrushBot, GPTBot and others). An empty user agent counts as a bot too.
  • Forward-confirmed rDNS (spoof protection) — for spoofable identifiers like Googlebot the IP is cross-checked via reverse DNS. A request that claims to be “Googlebot” without the matching reverse-confirmed hostname is not filtered.
  • Headless browsers — automation markers such as HeadlessChrome, Puppeteer or Playwright.
  • IP blocklist — CIDR ranges you maintain.
  • Behavioral patterns (after the fact) — a nightly pass flags sessions with suspiciously perfect timing or (desktop only) no mouse movement despite interaction. Conservative by design: it only flags on clear evidence, so real visitors are never dropped by mistake.

Control & transparency

  • On/off per website — admins and editors can turn filtering off.
  • IP rules — a whitelist (never treat as a bot, e.g. your office IP) wins over everything; a blacklist (always block) by IP or CIDR range.
  • “Not a bot” — if detection got it wrong, mark a session back as a real visitor and it flows back into recordings and statistics.

Last updated:

Last updated on