More in Website analytics
- Bots and AI crawlers
- Traffic sources, UTM and ad click IDs
- Are bots and AI crawlers counted in my visitors?
- How do I read the AI crawler ledger?
- A real visitor is marked as a bot — how do I fix it?
- How does TapCub decide a visit’s channel?
- How should I name my UTM parameters?
- Does TapCub track ad click IDs like gclid?
- Why do my organic search terms look empty?
- How do I add annotations to my charts?
- How do I get alerted when traffic drops or spikes?
- How do I schedule email reports?
- How do I share a dashboard or report?
- How do I check Core Web Vitals for real visitors?
- How do I find JavaScript errors on my site?
- How do I see website visitors in real time?
- How do I compare date ranges?
- How do I import server logs?
- How do I check crawl health and crawler errors?
- How do I find the pages where visitors leave my website?
- All guides in this category
Still have a question?
Could not find it? A person reads every message, usually within a few hours on business days.
Chat with usShort answer
Every hit is checked before it is stored across five layers — user agent, request headers, client signals, network (ASN) and frequency — using 197+ rules that are maintained centrally. A hit is marked as a bot when enough layers agree.
Five layers, 197+ rules
Detection runs on every hit before it is stored. A hit is marked as a bot when enough layers agree:
- User agent. Known crawler strings for search engines, AI companies, monitoring services and SEO tools — the largest share of the rule set.
- Request headers. Missing or inconsistent headers that real browsers always send.
- Client signals. Whether the script could run, plus screen and timing signals that headless browsers get wrong.
- Network (ASN). Ranges that belong to cloud providers and known crawler operators.
- Frequency. Request rates no person produces, such as hundreds of pages a minute from one source.
The rule set is maintained centrally and currently holds 197+ rules, so you do not update anything.
The trust level on each row
Each bot row shows which layers matched and a trust level — verified, suspected or unknown. Unknown means the operator could not be confirmed, not that the traffic is fake. If a row looks wrong, you can report it — see report a false positive.
Only bots that execute JavaScript appear when you use the page script alone. Crawlers that fetch raw HTML without running scripts need the server-side SDK or a log import.
See also
Did this answer your question?
We use your answers to fix and expand this page.
Couldn’t send. Please try again in a minute.
Thanks for the feedback. We’ll use it to improve this page.You’ve already sent feedback on this page. Thanks.