Bot detection explained

GreenOrb Statistics handles automated traffic in two layers, and almost every
question about bots comes down to knowing which layer you're looking at:

1. Blocked before counting — the request never becomes a visit at all.
2. Counted, but carrying signals — it's in your stats, with evidence attached
   so you can judge it.

The split is deliberate. Traffic that is provably not a person is removed.
Everything else is recorded honestly and labelled, because silently deleting
data you might disagree with is how analytics tools lose your trust.

▶ Watch the video: How GreenOrb Statistics filters bots (3:12)

Layer 1 — blocked before it's counted

These never reach your reports. Their only trace is the
Bot Filtering report (Audience → Bot Filtering), which
itemises every rejection by reason:

Not the same thing: your own exclusions

The report lists these separately, and they are never counted in the
"bot hits filtered" number:

• Do Not Track honoured, Global Privacy Control honoured and No tracking
  consent — privacy signals.
• Excluded roles, Excluded IPs, Excluded browsers (exclude-me cookie)
  — traffic you told GreenOrb to skip, usually your own team.
• Data-centre networks, and Excluded countries (Pro) — when you choose to
  leave those out.

Respecting a privacy choice isn't blocking a bot, so the two are never mixed.

Layer 2 — counted, but carrying signals

Some automation runs a real browser, executes JavaScript and passes every check
above. These are recorded like any other visit — and then measured.

The session input chip

Every session on a visitor's profile carries one of three chips:

Engaged time is gated

Time on page only accrues while the visitor is actually active — within about a
minute of their last interaction, or while media is playing. A parked tab, or an
automated browser holding a page open, stops accumulating time. This is why a
bot can't inflate your engagement figures even when it is counted.

The 🤖 Suspected bot badge

A daily behavioural scan catches the "polite impostors" — real Chrome on
rotating IPs. Across the last 30 days, a visitor is a candidate when all of
these are true:

• exactly one unique page,
• zero interaction events (no scrolls, clicks, downloads or plays),
• and no real input signal, ever.

They are then flagged if they fit one of three shapes:

• Repeat single-page sessions — 5 or more sessions, coming back to that
  same page time after time.
• Single-sitting burst — one session in which that page was loaded 10 or
  more times. A bot that hits once and leaves never builds up five sessions, so
  this catches what the first rule can’t.

• Bot wave — a crowd of brand-new visitors who each came once and did
  nothing. To count as a wave there must be 5 or more of them from the same
  country, on the same device, browser and operating system, each arriving
  within an hour of the one before, every one viewing a single page with no
  referrer, no time on page, no input and no interaction. Any one of them alone
  is just a bounce; it's the crowd that gives them away. They can each land on
  a different page.

  A post going viral is never flagged as a wave. Real readers always come with
  some who stay, scroll or tap, so if more than 1 in 5 of the visitors with the
  same profile in that time did anything at all, nobody in the group is
  flagged. Visitors with no known country are never grouped, and a wave
  visitor who later comes back and reads loses the flag on the next scan.

The badge can also come from Data-centre networks in Flag mode
(Settings → Bot Filtering): the visitor came from a cloud or hosting company's
network. That one is set when the visit arrives, not by the scan, and the scan
never clears it.

Hover the badge to see which rule fired. Both thresholds and the 30-day window
can be changed with the greenorb_statistics_bot_scan_min_sessions,
greenorb_statistics_bot_scan_burst_min_views and
greenorb_statistics_bot_scan_window_days filters. The wave rule has its own:
greenorb_statistics_bot_wave_min_size (default 5) and
greenorb_statistics_bot_wave_gap_minutes (default 60).

Flagging is a signal, not a filter: flagged visitors stay in your numbers.
The badge appears on the Visitors list, on the visitor's profile, and in the
Flagged visitors table on the Bot Filtering report.

Your verdict decides

On a flagged visitor's profile you have two controls:

• ✅ Not a bot — clears the badge permanently. The scan will never flag that
  visitor again, so a false positive stays fixed.
• 🗑 Delete this visitor's data — erases them and recalculates your totals so
  history reads as if they were never there, optionally blocking the identity
  from future tracking (which moves them to Layer 1).

Data-centre visitors usually arrive in dozens, each with a fresh identity, so
the Bot Filtering report has a 🗑 Delete all data-centre visitors button
above the Flagged visitors table (you need the Manage permission). It deletes
every visitor still flagged for a data-centre network and recalculates the
affected daily totals, the same as deleting them one by one. Up to 500 go per
click; if more are left, the notice tells you to press it again. Check the list
first: someone on a VPN can be flagged too, and pressing ✅ Not a bot on
their profile keeps them out of the clean-up.

Reading the combinations

Signals are most useful together:

• 🖱️ real input, several pages, some events — a person. Move on.
• ⌨️ no input, one page, many sessions — the classic automation signature;
  the scan will badge it once it crosses five sessions.
• ▶️ media played, no input, no other events — most likely a mobile listener
  who tapped straight into a player. Only suspicious as a cluster.
• ⌨️ no input, a single visit, never returns — genuinely ambiguous. Could be
  a bounce, could be a one-shot crawler. This is exactly why the wording is
  "no signal" and never "bot".
• 🖱️ real input but otherwise bot-shaped — sophisticated automation that
  simulates input. Rare, and the one case the chips can't settle; judge it on
  behaviour over time.

Sensitivity — and when to change it

Settings → Bot Filtering offers four presets:

Changing this affects future hits only — history is never recalculated.

How to decide: high "known bots" and "headless" counts mean the filter is doing
its job, not that something is wrong. If real visitors report missing visits,
try a lower sensitivity. If your counts still look inflated, try strict. The
optional daily hit cap is the tool for slow crawlers that stay under the
per-minute limit.

Where to see all of this

• Audience → Bot Filtering — the full report: totals, trend, every reason, and
  the flagged-visitor list.
• Visitor profiles — per-session chips, the 🤖 badge, and your verdict buttons.
• Overview, dashboard widget and email reports — the weekly filtered-traffic
  line, so the number is never out of sight.

For why this makes your totals look lower than tools that count bots, see
Why your numbers may look lower than other plugins.

Back to the documentation index.