Numbers with the fake traffic taken out.
Bots and referrer spam are filtered at ingest, before anything is stored and before anything is billed. You get the aggregate of what was caught, so the filter is checkable rather than a promise.
How do you filter bot traffic from analytics?
Classify each hit before storing it, using signals a real browser produces and an automated client usually does not: the mandatory headers Chromium and Firefox attach to every beacon, the shape of the user agent, the network the request came from, and automation flags the page itself can see. Mrkr does this at ingest, so a blocked hit never becomes a pageview.
Filtering after the fact does not work. Once a bot hit is a row in your analytics it is already in the totals, already in the conversion rate denominator, and already on the invoice. The only place this can be done cleanly is before the write.
- bot hits filtered out in 30 days
- 12,146bot hits filtered out in 30 days
- real human pageviews on the same site
- 2,946real human pageviews on the same site
- more bot traffic than human traffic
- 4.1xmore bot traffic than human traffic
- of it billed, stored as a session, or shown in a report
- 0of it billed, stored as a session, or shown in a report
Measured on a live site running Mrkr over 30 days. This is a single site, not an industry average: the ratio varies enormously with how much attention a domain gets. It is also separate from the AI and search crawler traffic, which is counted deliberately rather than filtered.
Nine signals, cheapest first.
Automation flags from the page
The tracker reports a driven browser, a prerender, an empty language list, or a zero viewport. Each is a headless tell.
Header consistency
A user agent claiming modern Chrome must arrive with the headers Chrome sends. Safari and iOS are exempted.
User-agent shape and pattern
Every real browser shares a prefix. On top sits a list covering crawlers, scanners, SEO tools and HTTP libraries.
Network origin
Chrome from a cloud host is the headless-on-a-server pattern. Apple and Cloudflare are exempt, for Private Relay.
Cloudflare bot and threat scores
Used where the edge populates them, as one signal among several rather than the whole decision.
A per-IP rate limit
Sixty events a minute: well above any human, well below any scraper worth the name.
Referrer spam never reaches the list.
Referrer spam is not really traffic. It is a request crafted so a domain appears in your referrer report, in the hope that whoever reads the report is curious enough to click it. It has been going on for a decade and the same domains are still doing it.
Mrkr checks the referrer host against a curated blocklist at ingest. The match is exact on the www-stripped hostname rather than a suffix match, because a single false positive here silently erases a legitimate referrer, and that is a worse failure than missing one spammer.
What happens to a blocked hit.
Four kinds of traffic get handled differently, and the difference matters for both your numbers and your bill.
| Traffic | Stored? | Billed? | Where you see it |
|---|---|---|---|
| Real visitor | Yes | Yes | Every report |
| Bot caught at ingest | No, only an aggregate counter | No | Settings, bot filtering panel |
| Referrer spam | No | No | Nowhere, by design |
| AI or search crawler, reported server side | Yes, as a crawler hit | No | The AI traffic page |
Crawlers are the deliberate exception. They are not noise to be removed, they are a channel worth measuring, so they are counted separately rather than filtered into a human total.
Numbers you can act on
The live demo runs on the same ingest path, with the same filter in front of it. No signup, no card.
Open the live demo
Where the filter stops.
A real browser, at human timing
From a residential address with a genuine user agent, nothing above tells it apart. Any filter sold as complete is being oversold.
Hidden, never deleted
Sessions that pass the gate but look wrong are hidden at read time. A hidden row can be reconsidered; a deleted one cannot.
Checkable, not taken on trust
The daily blocked count, the reason breakdown and the user-agent classes all sit in the settings panel.
Questions, answered.
Keep reading
- Bots and spam documentation
Every signal, every block reason, and what a blocked hit produces.
- AI traffic and AI crawler tracking
The crawlers Mrkr counts on purpose instead of filtering out.
- What counts as an event
The exact billable list, verified against the ingest code.
- Excluding your own traffic
Excluded paths and internal traffic, on top of the bot gate.
- Website visitor tracking
What is left once the fake traffic is gone: real journeys.
- Every Mrkr feature
The full index of what the product measures.
Your first visitor is already here.
Drop in the script and watch them land. It takes about a minute.