Bot detection

MetriXs uses multiple layers to filter out bot traffic from your analytics.

Server-side checks

• User-agent filtering — the isbot library covers 1500+ known bots
• Automation patterns — blocks Puppeteer, Playwright, Selenium, python-requests, curl, Scrapy, and more
• Rate limiting — max 30 events per IP per minute, plus a per-/24-subnet cap (200 events / 5 min) to catch distributed botnets (Redis-backed)
• Domain verification — the Origin header must match the registered domain
• Accept-Language check — requests without a valid Accept-Language header are dropped
• Browser fingerprint token — the tracker encodes real browser signals (screen size, timezone, hardware concurrency, etc.) into a token that raw HTTP bots cannot produce

Client-side checks

The tracker script also detects bots before sending events:

• navigator.webdriver === true — Selenium/CDP
• window._phantom, window.__nightmare — PhantomJS, Nightmare.js
• window.Cypress — Cypress test runners
• screen.width === 0 — headless Chrome
• navigator.languages.length === 0 — many headless environments

Datacenter / cloud IP detection

MetriXs uses the MaxMind ASN database to identify traffic from known cloud and datacenter providers. Events from these networks are dropped automatically, as they are almost always automated:

• AWS, Google Cloud, Azure, DigitalOcean, Hetzner, OVH, Linode
• Alibaba Cloud, Tencent Cloud, Huawei Cloud, ByteDance, Cloudflare Workers
• And many more

Self-exclusion

Add localStorage.setItem('metrixs_ignore', 'true') in your browser console to exclude your own visits.