Bot filtering
Which requests Sift drops, and why your traffic looks lower than other tools.
Sift filters traffic in several places. Filtering is deliberate and lossy: it is better to miss a real visitor than to report a fake one.
Dropped at the browser
The tracking script exits before sending anything when:
| Condition | Why |
|---|---|
file: protocol | Local files are not a website. |
localhost or 127.0.0.1 | Development traffic is not real traffic. |
navigator.webdriver === true | Most headless and automated browsers set this. |
localStorage.sift_ignore === "true" | You opted this browser out. |
Dropped at ingestion
Before a pageview is stored, the server checks:
Empty user agent
A request with no user agent is treated as a bot. Real browsers always send one.
Known automation signatures
The user agent is matched against a blocklist:
bot, spider, crawl, slurp, googlebot, bingbot, yandex, baidu,
duckduckbot, curl, wget, python, postman, lighthouse, headless, phantomjsThis is a substring match, case-insensitive. Googlebot/2.1 matches. So does
python-requests/2.31.
Unknown domain
If data-domain does not match a site in Sift, the pageview is dropped. This
prevents a copied snippet from writing into someone else's stats.
Hostname mismatch
The page's hostname must equal the registered domain or end with it.
- Registered
example.com, page onapp.example.com→ accepted. - Registered
app.example.com, page onexample.com→ dropped. - Registered
example.com, page onnotexample.com→ dropped.
www. is stripped before comparison on both sides.
What gets through
Sophisticated bots that present a real browser user agent and execute JavaScript are not detected. Sift does not fingerprint, challenge, or score visitors, so a convincing fake is counted.
That is the trade-off. Detection strong enough to catch those bots requires the kind of tracking Sift is built to avoid.
Why numbers are lower than other tools
Plausible, Umami, and GA4 each filter differently. Expect Sift to report less
traffic than a tool that counts curl requests and headless browsers. The gap is
usually largest on developer-facing sites.
Testing on purpose
If you are testing and want to see a pageview from an automated browser, the
client-side checks will block it. Use a real browser, or temporarily clear
navigator.webdriver — but expect the ingestion-side user agent check to still
drop obvious automation.