Concepts

Visitor types

Every report splits traffic four ways:

Visitor type	Means
Human	A person in a normal browser
AI-referred human	A person who clicked through from ChatGPT, Perplexity, Claude, Gemini or Copilot
Agent	Software acting for someone: signed and declared AI agents, HTTP clients and scripts, headless or automated browsers, and impostors
Crawler	Search and AI crawlers indexing or collecting training data

Actor classes

Underneath the visitor types, each request gets one class:

Class	How it's recognized
signed_agent	A cryptographic Web Bot Auth signature from a known operator
declared_agent	Says it's a user-triggered fetcher (ChatGPT-User, Claude-User, …) and its IP matches the operator's published ranges
crawler	Says it's a known crawler (GPTBot, Googlebot, …) and its IP matches
fetcher	A non-browser HTTP client (curl, python-requests, …) or a client asking for plain text or llms.txt
suspected_agent	A headless browser, a browser on a cloud network, or a machine-like request rate
spoofed_bot (shown as impostor)	Claims a known agent's name, but its address doesn't match
human, ai_referred_human	Everyone else

Confidence tiers and the filter

Tier	Meaning
verified	Cryptographically signed
declared	Says who it is, and its IP checks out
inferred_high	Strong evidence: an impostor, a scripted client, a headless browser
inferred_low	Weaker patterns: a cloud network, a steady request rate

The Agent labels filter decides which tiers count as agents. Labels below the chosen level count as human: confirmed only trades recall for precision; everything does the opposite.

Every label shows its work

Classification is rules, not machine learning. Each request records which rules fired (R1–R13) and the evidence, for example "claims a known crawler name · address doesn't match · tier: inferred, high". Open any session to see it.

Sessions without cookies

Requests are grouped into sessions with a daily visitor hash: a one-way hash of a random salt, your site, the IP address and the user agent. The salt is replaced every day and the old one deleted, so hashes can't be linked across days or reversed. A session ends after 30 minutes of inactivity or at midnight UTC. Browsers that send Global Privacy Control get no hash at all.

Why agents fetch: live retrieval vs crawls

Purpose	Means
user_triggered	An assistant fetched the page because someone is asking right now (ChatGPT-User, Claude-User, Perplexity-User)
agent	An agent acting in a browser for someone
search	Indexing for search or answers (OAI-SearchBot, Claude-SearchBot, Googlebot, …)
training	Collecting training data (GPTBot, ClaudeBot, CCBot)
other_automation	Scripts and automated browsers with no declared identity
impostor	Claimed a known name; not counted as any of the above

Live retrieval (user-triggered + agent) is a real-time demand signal; crawls are slow-moving visibility. Reports keep them separate.

Channels

A channel is how a visit arrived: AI assistants (people sent by ChatGPT, Claude, Perplexity and others), organic search, paid, email, social, affiliate, other campaigns, referral or direct. Who made the visit (a person, an agent or a crawler) is a separate dimension, visitor_type, so agents aren't a channel: each agent visit has a channel like any other, and most arrive direct. Overview shows sessions by channel split into people, agents and crawlers.

Privacy thresholds

Outside your own dashboard (API, MCP, shared reports), any group containing fewer than 5 people's page views is withheld and counted in meta.suppressed_rows. Groups of only agents and crawlers are always shown.