PAJ Statistics handles automated traffic in two layers, and almost every question about bots comes down to knowing which layer you’re looking at:
- Blocked before counting — the request never becomes a visit at all.
- Counted, but carrying signals — it’s in your stats, with evidence attached so you can judge it.
The split is deliberate. Traffic that is provably not a person is removed. Everything else is recorded honestly and labelled, because silently deleting data you might disagree with is how analytics tools lose your trust.
Layer 1 — blocked before it’s counted
These never reach your reports. Their only trace is the Bot Filtering report (Audience → Bot Filtering), which itemises every rejection by reason:
| Reason | What it catches |
|---|---|
| 🤖 Known bots (signature list) | Declared crawlers — search engines, SEO tools, uptime monitors, AI scrapers — matched against a continuously updated signature list. |
| 👻 Headless browsers | Automated browsers such as HeadlessChrome, Puppeteer, Playwright and Selenium, which run JavaScript exactly like a real browser. |
| ⬜ Empty user agent | Requests that identify as nothing at all. |
| ⚠️ Suspicious user agent | Malformed or contradictory identities — including clients that fake their identity in JavaScript while the underlying request says otherwise. |
| ⚙️ No browser engine | Identities missing the engine markers every real browser sends. |
| 🔎 Missing client hints | Modern browsers advertise themselves via client hints; absence is suspicious only when your server is known to forward them. |
| 📡 Headless JS signals | Automation markers the page itself can see, chiefly navigator.webdriver. |
| ⏱ Rate limited | Bursts of hits far faster than a person can read. |
| 📅 Daily hit cap | Slow crawlers that stay under the per-minute limit but grind all day (optional; off by default). |
| 🚷 Blocked visitor | An identity you chose to block after reviewing it. |
Not the same thing: your own exclusions
The report lists these separately, and they are never counted in the “bot hits filtered” number:
- Do Not Track honoured and No tracking consent — privacy signals.
- Excluded roles, Excluded IPs, Excluded browsers (exclude-me cookie) — traffic you told PAJ to skip, usually your own team.
Respecting a privacy choice isn’t blocking a bot, so the two are never mixed.
Layer 2 — counted, but carrying signals
Some automation runs a real browser, executes JavaScript and passes every check above. These are recorded like any other visit — and then measured.
The session input chip
Every session on a visitor’s profile carries one of three chips:
| Chip | Meaning | How to read it |
|---|---|---|
| 🖱 Real input | A mouse move, key press, scroll wheel or touch was recorded. | Almost certainly a person. An input-device event can’t happen by accident — only deliberate event simulation fakes it. |
| ▶️ Media played | No input device, but embedded media played. | Usually a real listener: a tap inside a YouTube or SoundCloud player is invisible to the page. Weaker than real input, because playback can be started by a script. |
| ⌨️ No input signal | Neither was seen for the whole session. | Typical of automation. |
Engaged time is gated
Time on page only accrues while the visitor is actually active — within about a minute of their last interaction, or while media is playing. A parked tab, or an automated browser holding a page open, stops accumulating time. This is why a bot can’t inflate your engagement figures even when it is counted.
The 🤖 Suspected bot badge
A daily behavioural scan catches the “polite impostors” — real Chrome on rotating IPs. A visitor is flagged when all of these are true across the last 30 days:
- 5 or more sessions,
- exactly one unique page,
- zero interaction events (no scrolls, clicks, downloads or plays),
- and no real input signal, ever.
Flagging is a signal, not a filter: flagged visitors stay in your numbers. The badge appears on the Visitors list, on the visitor’s profile, and in the Flagged visitors table on the Bot Filtering report.
Your verdict decides
On a flagged visitor’s profile you have two controls:
- ✅ Not a bot — clears the badge permanently. The scan will never flag that visitor again, so a false positive stays fixed.
- 🗑 Delete this visitor’s data — erases them and recalculates your totals so history reads as if they were never there, optionally blocking the identity from future tracking (which moves them to Layer 1).
Reading the combinations
Signals are most useful together:
- 🖱 real input, several pages, some events — a person. Move on.
- ⌨️ no input, one page, many sessions — the classic automation signature; the scan will badge it once it crosses five sessions.
- ▶️ media played, no input, no other events — most likely a mobile listener who tapped straight into a player. Only suspicious as a cluster.
- ⌨️ no input, a single visit, never returns — genuinely ambiguous. Could be a bounce, could be a one-shot crawler. This is exactly why the wording is “no signal” and never “bot”.
- 🖱 real input but otherwise bot-shaped — sophisticated automation that simulates input. Rare, and the one case the chips can’t settle; judge it on behaviour over time.
Sensitivity — and when to change it
Settings → Bot Filtering offers four presets:
| Preset | UA signatures | Headless detection | Rate limit |
|---|---|---|---|
| Off | ✕ | ✕ | none |
| Lenient | ✕ | ✕ | 100/min |
| Standard (recommended) | ✓ | ✓ | 30/min |
| Strict | ✓ | ✓ | 10/min |
Changing this affects future hits only — history is never recalculated.
How to decide: high “known bots” and “headless” counts mean the filter is doing its job, not that something is wrong. If real visitors report missing visits, try a lower sensitivity. If your counts still look inflated, try strict. The optional daily hit cap is the tool for slow crawlers that stay under the per-minute limit.
Where to see all of this
- Audience → Bot Filtering — the full report: totals, trend, every reason, and the flagged-visitor list.
- Visitor profiles — per-session chips, the 🤖 badge, and your verdict buttons.
- Overview, dashboard widget and email reports — the weekly filtered-traffic line, so the number is never out of sight.
For why this makes your totals look lower than tools that count bots, see Why your numbers may look lower than other plugins.
Back to the documentation index.