How visitors are counted
The exact rules behind visitors, sessions, bounces, and durations.
Sift counts visitors without cookies and without storing an IP address. The mechanism is a hash that changes every day.
A visitor is a daily hash
When a pageview arrives, Sift computes:
SHA-256( siteId + IP address + user agent + daily salt )The result is a 64-bit number. That number is the visitor ID. The IP address and user agent are used for this one calculation and then discarded — they are never written to the database.
Because the salt changes every day, yesterday's hash and today's hash for the same person are unrelated. Nobody can be followed from one day to the next, even with full database access.
The midnight problem
If the salt changed at exactly midnight, a session that crosses midnight would look like two different visitors.
Sift solves this by keeping two salts — today's and yesterday's — and checking both. A pageview that continues a session started yesterday still matches, because the previous-day hash is also computed and looked up.
A session is 30 minutes
Sessions group pageviews into a visit.
- A new pageview with no activity in the last 30 minutes starts a new session.
- A pageview within 30 minutes extends the existing session and increments its pageview count.
- Sessions are serialized per visitor, so two tabs loading at the same moment cannot create duplicate sessions.
The 30-minute window is fixed. It is not configurable.
The five numbers
| Number | Definition |
|---|---|
| Unique visitors | Distinct daily visitor hashes in the range. |
| Pageviews | Pageviews on sessions that started in the range. |
| Views per visit | Pageviews divided by sessions. |
| Bounce rate | Sessions with exactly one pageview, divided by all sessions. |
| Visit duration | Average time between the first and last pageview of a session, excluding bounces. |
A "bounce" is a session where someone loaded one page and left. It is not a measure of interest.
Attribution is first-touch per session
The referrer, channel, and UTM parameters are captured when a session starts and kept for the whole session. If someone lands from a search result, then clicks an internal link, the second pageview is still credited to search.
A new session re-reads the referrer.
Why your numbers differ from Google Analytics
They are measuring different things. Expect differences, not agreement.
- No cross-day identity. Someone who visits every day counts once per day, not once per month. A monthly unique visitor number here is a sum of daily uniques, not a count of people.
- No cookie consent gap. Sift counts everyone, including visitors GA would drop when they decline cookies.
- Bots are filtered aggressively. See Bot filtering.
- Sessions end at 30 minutes. GA's default is also 30 minutes, but any configured difference changes bounce and duration.
- Timezone. Sift uses the site's timezone, not the viewer's.
If a number matters enough to reconcile, reconcile it against the raw pageview count first. That is the only number with no aggregation on top.