Skip to content
pisi.to
All guides

Couriers: how we detect bots

A courier rings the bell but isn't visiting. Search engines, AI crawlers, uptime monitors and link previews are discarded before they count, and the dashboard tells you how many there were.

What a courier is

We call couriers anything that loads your site without being a person: Google's bot, the OpenAI or Anthropic crawlers, uptime monitors, the preview WhatsApp or Slack generate when someone pastes a link, and command-line scripts.

None of them counts as a visit. They are discarded at ingest, before touching the database, and never show up in any breakdown.

How they are detected

The first sieve is the User-Agent. A real browser introduces itself with a long, recognisable string; couriers wear their name or nothing at all.

  • No User-Agent, or one shorter than ten characters: out.
  • A hand-maintained list of the most common search engines, AI crawlers, SEO tools, uptime monitors, social and messaging previews, feed readers and HTTP libraries. Reviewed monthly.
  • Automated browsers: HeadlessChrome, Puppeteer, Playwright, Selenium, Cypress and friends. Electron too, unless your product is an Electron app and you switch that off in the site settings.
  • The key itself sends nothing when the browser declares navigator.webdriver.
  • In-app browsers (Instagram, Facebook, X, Pinterest, Snapchat) are NOT couriers: they are people, counted with their browser labelled.

By behaviour

Some couriers dress up as browsers. Those are caught afterwards, every ten minutes, by how they behave:

  • More than a hundred pages in under a minute within the same visit.
  • More than fifteen hundred pages in a day from the same visitor without a single second of reading (no engagement at all).
  • When a visit is flagged as a courier, the affected hours of the dashboard are recalculated: the traffic disappears from that day's charts and from the history.

The dashboard counter

The dashboard footer says how many couriers were discarded today. It is informational only: they enter no metric and no aggregate, and the counter is kept per local day of the site.

What we don't filter

We don't filter by IP address or network provider. A whole office behind one NAT, a VPN or a corporate proxy are people, and a data-centre filter would mistake them for machines. We would rather keep the odd courier than discard real visits. If you see odd traffic getting through, write to hola@pisi.to with the date and the site.

You don't count either

Your own visits are excluded from the site settings: you open your site with a parameter the key understands and that browser stops counting. It is explained under Settings › This browser.