How visits are scored
Five layers of evidence, one verdict per visit, and the reasons behind it.
Every visit gets a score from 0 to 100 and a verdict:
| Score | Verdict |
|---|---|
| under 25 | Human |
| 25 to 59 | Unsure |
| 60 and up | Automated |
Each point comes from a named piece of evidence, shown on the visit in the dashboard and in exports.
The layers
Request. What reaches your server: the user agent, whether the browser headers a real browser always sends are there, Web Bot Auth signatures, the published address ranges of OpenAI, Anthropic, Google, Perplexity, Microsoft and Apple, Meta's network, Tor exits, and whether the page script ever ran.
Browser. Automation flags, headless markers, software graphics, missing plugins, and whether the tracker's own code was tampered with or replaced.
Behaviour. How input arrives: real mouse movement carries extra samples between events that injected input does not; clicks without movement; keys released impossibly fast; forms filled with no keystrokes; perfectly straight paths through a store.
Location. Browser clock against the network's time zone, browser language against country, and cloud, data-centre and VPN networks.
Links. The same device across many visits, several customers buying from one device, and the same client software rotating across addresses.
Named agents
When a visit can be tied to a company, it is labelled with the company and product, for example OpenAI ChatGPT agent, and how that was verified: a signature, a published address range or the operator's network. A visitor that claims a name without that proof is labelled as impersonation.
Signed telemetry
The server kit signs a short-lived key for each visit, and the tracker includes it with every report. Reports with a missing, wrong or edited key are marked, so an agent cannot quietly send made-up "human" behaviour.