Numbers with the fake traffic taken out.
Bots and referrer spam are filtered at ingest, before anything is stored and before anything is billed. You get the aggregate of what was caught, so the filter is checkable rather than a promise.
In short
How do you filter bot traffic from analytics?
Classify each hit before storing it, using signals a real browser produces and an automated client usually does not: the mandatory headers Chromium and Firefox attach to every beacon, the shape of the user agent, the network the request came from, and automation flags the page itself can see. mrkr does this at ingest, so a blocked hit never becomes a pageview.
Filtering after the fact does not work. Once a bot hit is a row in your analytics it is already in the totals, already in the conversion rate denominator, and already on the invoice. The only place this can be done cleanly is before the write.
Nine signals, cheapest first.
Automation flags from the page
The tracker reports a driven browser, a prerender, an empty language list, or a zero viewport. Each is a headless tell.
Header consistency
A user agent claiming modern Chrome must arrive with the headers Chrome sends. Safari and iOS are exempted.
User-agent shape and pattern
Every real browser shares a prefix. On top sits a list covering crawlers, scanners, SEO tools and HTTP libraries.
Network origin
Chrome from a cloud host is the headless-on-a-server pattern. Apple and Cloudflare are exempt, for Private Relay.
Cloudflare bot and threat scores
Used where the edge populates them, as one signal among several rather than the whole decision.
A per-IP rate limit
Sixty events a minute: well above any human, well below any scraper worth the name.
Referrer spam never reaches the list.
Referrer spam is not really traffic. It is a request crafted so a domain appears in your referrer report, in the hope that whoever reads the report is curious enough to click it. It has been going on for a decade and the same domains are still doing it.
mrkr checks the referrer host against a curated blocklist at ingest. The match is exact on the www-stripped hostname rather than a suffix match, because a single false positive here silently erases a legitimate referrer, and that is a worse failure than missing one spammer.
Compared
What happens to a blocked hit. Four kinds of traffic get handled differently, and the difference matters for both your numbers and your bill.
| Traffic | Stored? | Billed? | Where you see it |
|---|---|---|---|
| Real visitor | Yes | Yes | Every report |
| Bot caught at ingest | No, only an aggregate counter | No | Settings, bot filtering panel |
| Referrer spam | No | No | Nowhere, by design |
| AI or search crawler, reported server side | As a crawler hit | No | The AI traffic page |
Crawlers are the deliberate exception. They are not noise to be removed, they are a channel worth measuring, so they are counted separately rather than filtered into a human total.
Live demo
Numbers you can act on. The live demo runs on the same ingest path, with the same filter in front of it. No signup, no card.
Open the live demoWhere the filter stops.
A real browser, at human timing
From a residential address with a genuine user agent, nothing above tells it apart. Any filter sold as complete is being oversold.
Hidden, never deleted
Sessions that pass the gate but look wrong are hidden at read time. A hidden row can be reconsidered; a deleted one cannot.
Checkable, not taken on trust
The daily blocked count, the reason breakdown and the user-agent classes all sit in the settings panel.
FAQ
How much of my traffic is bots?
More than most dashboards admit. On one live site running mrkr, a 30-day window contained 12,146 hits classified as bots against 2,946 real human pageviews, about four times as much fake traffic as real traffic. The ratio varies enormously by site, but a small site is rarely under 2x.
How does mrkr filter bot traffic?
At ingest, before anything is stored, across nine layers: browser automation flags, headless-browser tells, header consistency checks, user-agent shape and pattern matching, datacenter and cloud-hosting networks, Cloudflare's own bot score and threat score, and a per-IP rate limit. A blocked hit produces no pageview, no session and no event.
Does bot traffic count towards my plan quota?
No. Anything the bot gate catches is dropped before any billable write, aside from a single aggregate counter so you can see what was filtered. Rate-limited requests and excluded-path pageviews are dropped the same way.
What is referrer spam and does mrkr block it?
Referrer spam is fake traffic whose only purpose is planting a domain in your referrer list so you click it. mrkr checks the referrer host against a curated blocklist at ingest, matched exactly on the www-stripped hostname so a legitimate domain with a similar name is never caught.
Can I see what was filtered out?
Yes. Settings carries a bot filtering panel with the daily blocked count, a breakdown by the reason each hit was blocked, and a breakdown by user-agent class. It is aggregate rather than per-hit, so you can verify the filter is working without storing rows for traffic you did not want.
Does filtering catch everything?
No, and no vendor's does. A headless browser driven from a residential IP address with a genuine user agent and normal timing is indistinguishable from a person at ingest. Filtering removes the overwhelming bulk of automated noise; it does not certify that every remaining number is human.
Start with one line of HTML.Your first visitors show up within a minute.