Green Orb Web Design

GreenOrb Statistics handles automated traffic in two layers, and almost every
question about bots comes down to knowing which layer you're looking at:

1. Blocked before counting — the request never becomes a visit at all.
2. Counted, but carrying signals — it's in your stats, with evidence attached
   so you can judge it.

The split is deliberate. Traffic that is provably not a person is removed.
Everything else is recorded honestly and labelled, because silently deleting
data you might disagree with is how analytics tools lose your trust.

Layer 1 — blocked before it's counted

These never reach your reports. Their only trace is the
Bot Filtering report (Audience → Bot Filtering), which
itemises every rejection by reason:

Not the same thing: your own exclusions

The report lists these separately, and they are never counted in the
"bot hits filtered" number:

• Do Not Track honoured and No tracking consent — privacy signals.
• Excluded roles, Excluded IPs, Excluded browsers (exclude-me cookie)
  — traffic you told GreenOrb to skip, usually your own team.

Respecting a privacy choice isn't blocking a bot, so the two are never mixed.

Layer 2 — counted, but carrying signals

Some automation runs a real browser, executes JavaScript and passes every check
above. These are recorded like any other visit — and then measured.

The session input chip

Every session on a visitor's profile carries one of three chips:

Engaged time is gated

Time on page only accrues while the visitor is actually active — within about a
minute of their last interaction, or while media is playing. A parked tab, or an
automated browser holding a page open, stops accumulating time. This is why a
bot can't inflate your engagement figures even when it is counted.

The 🤖 Suspected bot badge

A daily behavioural scan catches the "polite impostors" — real Chrome on
rotating IPs. Across the last 30 days, a visitor is a candidate when all of
these are true:

• exactly one unique page,
• zero interaction events (no scrolls, clicks, downloads or plays),
• and no real input signal, ever.

They are then flagged if they fit either of two shapes:

• Repeat single-page sessions — 5 or more sessions, coming back to that
  same page time after time.
• Single-sitting burst — one session in which that page was loaded 10 or
  more times. A bot that hits once and leaves never builds up five sessions, so
  this catches what the first rule can’t.

Hover the badge to see which rule fired. Both thresholds and the 30-day window
can be changed with the greenorb_statistics_bot_scan_min_sessions,
greenorb_statistics_bot_scan_burst_min_views and
greenorb_statistics_bot_scan_window_days filters.

Flagging is a signal, not a filter: flagged visitors stay in your numbers.
The badge appears on the Visitors list, on the visitor's profile, and in the
Flagged visitors table on the Bot Filtering report.

Your verdict decides

On a flagged visitor's profile you have two controls:

• ✅ Not a bot — clears the badge permanently. The scan will never flag that
  visitor again, so a false positive stays fixed.
• 🗑 Delete this visitor's data — erases them and recalculates your totals so
  history reads as if they were never there, optionally blocking the identity
  from future tracking (which moves them to Layer 1).

Reading the combinations

Signals are most useful together:

• 🖱️ real input, several pages, some events — a person. Move on.
• ⌨️ no input, one page, many sessions — the classic automation signature;
  the scan will badge it once it crosses five sessions.
• ▶️ media played, no input, no other events — most likely a mobile listener
  who tapped straight into a player. Only suspicious as a cluster.
• ⌨️ no input, a single visit, never returns — genuinely ambiguous. Could be
  a bounce, could be a one-shot crawler. This is exactly why the wording is
  "no signal" and never "bot".
• 🖱️ real input but otherwise bot-shaped — sophisticated automation that
  simulates input. Rare, and the one case the chips can't settle; judge it on
  behaviour over time.

Sensitivity — and when to change it

Settings → Bot Filtering offers four presets:

Changing this affects future hits only — history is never recalculated.

How to decide: high "known bots" and "headless" counts mean the filter is doing
its job, not that something is wrong. If real visitors report missing visits,
try a lower sensitivity. If your counts still look inflated, try strict. The
optional daily hit cap is the tool for slow crawlers that stay under the
per-minute limit.

Where to see all of this

• Audience → Bot Filtering — the full report: totals, trend, every reason, and
  the flagged-visitor list.
• Visitor profiles — per-session chips, the 🤖 badge, and your verdict buttons.
• Overview, dashboard widget and email reports — the weekly filtered-traffic
  line, so the number is never out of sight.

For why this makes your totals look lower than tools that count bots, see
Why your numbers may look lower than other plugins.

Back to the documentation index.