Skip to main content

Bot Detection & Traffic Quality

SealMetrics employs multiple layers of protection to ensure your analytics data reflects real human visitors, not bots or spam traffic.

Multi-Layer Detection System​

Layer 1: IP Blocklist​

Known malicious IPs are blocked at the edge:

  • Global blocklist — Common bot IPs, data centers, VPN exit nodes
  • Per-account blocklist — Custom IPs you want to exclude
  • Real-time updates — Blocklist refreshed automatically

Layer 2: User-Agent Filtering​

Bot signatures in the User-Agent string are detected:

  • Known bot identifiers (Googlebot, Bingbot, etc.)
  • Automated tool signatures (curl, wget, python-requests)
  • Headless browser patterns (HeadlessChrome, PhantomJS)

Layer 3: Geographic Validation​

Traffic from unknown or suspicious locations:

  • Missing geo data indicates potential bots
  • Data center IP ranges flagged
  • Unusual geographic patterns monitored

Layer 4: Behavioral Analysis​

Click patterns and timing analysis:

  • Inhuman click speeds detected
  • Rapid repeated actions blocked
  • Session behavior scoring

Layer 5: HMAC Token Validation​

Each request includes a cryptographic token:

  • Prevents replay attacks
  • Validates request authenticity
  • Time-bound token expiration

Layer 6: Domain Authorization​

Only authorized domains can send data:

  • Configure allowed domains in Settings
  • Prevents data injection from unauthorized sources
  • Subdomain wildcard support

How Bot Traffic is Handled​

When bot traffic is detected:

  1. Blocked immediately — No data stored
  2. Logged for analysis — Helps improve detection
  3. Not counted — Never appears in reports

What Gets Filtered​

Traffic TypeFilteredNotes
Search engine crawlersYesGooglebot, Bingbot, etc.
SEO toolsYesAhrefs, Semrush, Moz
Uptime monitorsYesPingdom, UptimeRobot
Security scannersYesVulnerability scanners
Automated testingYesSelenium, Puppeteer
Data center trafficYesAWS, GCP, Azure IPs
Known bot networksYesSpam networks
Your own test trafficConfigurableOptional filtering

What Passes Through​

Traffic TypeTrackedNotes
Real browsersYesChrome, Firefox, Safari, etc.
Mobile appsYesIn-app browsers
VPN usersYesLegitimate users with VPNs
Tor exit nodesConfigurableCan be filtered if needed

Agent Detection (not available)​

Not live

Advanced agent detection — also referred to as Agent Analytics — is designed but not live, and cannot be enabled on any account, including on request. Nothing described in this section runs today, and no account collects behavioral signals. The layers above are the whole of what filters bot traffic.

If it ships, it would work like this:

  1. Initial classification — first hit analyzed
  2. Behavioral signals — mouse movements, scroll patterns, timing
  3. Final classification — human vs. suspected agent

Planned classification results:

ClassificationMeaning
humanConfirmed human behavior
agent_suspectedAutomated behavior detected

Classification would happen at session level: the entrance is classified and its pageviews inherit the result.

Custom Blocklists​

Adding IPs to Blocklist​

You can exclude specific IPs via the dashboard:

  1. Go to Settings → Security
  2. Select IP Blocklist
  3. Add IPs or CIDR ranges
192.168.1.100        # Single IP
10.0.0.0/8           # CIDR range

Common Use Cases​

  • Exclude your office IP
  • Block competitor scrapers
  • Filter internal testing traffic

User-Agent Blocklist​

Block traffic by User-Agent patterns:

  1. Go to Settings → Security
  2. Select UA Blocklist
  3. Add patterns (supports regex)
curl/*               # Block curl requests
python-requests/*    # Block Python scripts
custom-bot/*         # Block specific bot

Data Quality Indicators​

In your reports, look for:

  • Bounce rate — Extremely high rates may indicate bot traffic
  • Session duration — 0-second sessions could be bots
  • Geographic distribution — Unusual concentrations warrant investigation

Best Practices​

  1. Review traffic periodically — Check for anomalies
  2. Use content grouping — Helps identify targeted bot traffic
  3. Monitor conversion rates — Bots don't convert
  4. Check referrer sources — Unknown referrers may be spam

Comparison with Other Tools​

FeatureSealMetricsGoogle Analytics
Bot filteringMulti-layerSingle checkbox
Custom blocklistsYesLimited
Real-time blockingYesDelayed
Behavioral analysisYesLimited
Transparent filteringYesBlack box