Tracking
Bots and filtering
How bots, spam referrers and floods are filtered before they reach a report, and how to exclude pages and hosts.
A live globe that lies is worse than none, so filtering happens at ingestion, before a hit reaches presence, reports or alerts. Bots are never drawn on the globe.
Filtering layers
| Layer | What it catches |
|---|---|
| Crawler list | Known crawlers, tools and fetchers (the maintained isbot pattern list), including AI crawlers. |
| User-agent parser | Bots recognised by ua-parser-js: AI crawlers, link previewers, Lighthouse and similar. |
| Headless and automation | Headless browsers, Playwright, Puppeteer, Selenium, uptime monitors, HTTP libraries (curl, Python, Go, Java…), and user agents that don’t look like a browser at all. |
| Referrer spam | A blocklist of known spam referrers, applied to pageview referrers. |
| Rate limit | Floods from one address on one site (see below). |
The filtered counter
Rejected hits aren’t thrown away silently: they are counted per day and per reason (bot, excluded, rate_limited, invalid). The site’s tracking health shows “Filtered today” with the breakdown, so you can see what didn’t make it into your numbers.
Exclude pages and hosts
- Excluded paths (site settings) drop hits on matching paths on the server, for example
/admin/**. In the browser,data-excludestops the tracker from sending anything at all on those paths. - Allowed hostnames: hits are accepted from the site’s domain and all its subdomains. Add other hostnames (a staging domain, a second brand) in the site settings. Anything else is rejected.
- Ignore localhost keeps development traffic out of production numbers.
- Exclude your own browser with
#globatics-ignore, see Quick start.
Rate limits
Each site and client address gets 30 hits per second with bursts up to 60, which no real visitor reaches. Change it with an environment variable on self-hosted servers:
GLOBATICS_RATE_LIMIT=30,60 # hits per second, burst