Alerts
Be told when traffic moves, a goal fires, money arrives or tracking stops, by email, Slack, Discord or your own webhook.
Alerts watch the dashboard so you do not have to. Set them up under Alerts; each one can be paused without deleting it, and the list shows when each last fired.
In a hurry? Set up alerts is the short version.
The six kinds
| Kind | Fires when | You configure |
|---|---|---|
| Goal completed | A visitor completes a goal you name. | The goal name |
| Revenue received | A payment arrives. | Optionally a minimum amount |
| Traffic spike | Visitors jump above the recent baseline. | A percentage, and a 1 hour or 24 hour window |
| Traffic drop | Visitors fall below it. | The same |
| Conversion drop | Conversion rate falls below its baseline. | The same |
| Tracking lost | No events arrive for half an hour when traffic was expected. | Nothing |
Thresholds are a percentage between 1 and 1000. The defaults are sensible starting points — 50% for a drop, 100% for a spike, 30% for a conversion drop — and worth tuning after the first week of your own noise.
What "baseline" means
A percentage alert compares the window against the same window a week earlier, not against yesterday, so Tuesday is compared with Tuesday and a normal weekend is not an emergency. It also needs something to compare against: at least 20 visitors, or 5 conversions, in the baseline. A site with a handful of visitors an hour is not paged for statistical noise.
Delivery channels
- Email — between 1 and 10 addresses.
- Slack and Discord — an incoming webhook URL, or the connection already saved under Integrations. Stored URLs are masked when read back, because an incoming webhook URL is a credential.
- Your own webhook — any HTTPS URL. Statsy signs the request, so you can verify it really came from Statsy.
An alert needs at least one channel and can have several. Every alert has a Send test button which skips the throttle, so you can check a channel works before you need it to.
Verifying a signed webhook
Statsy sends two headers: X-Statsy-Signature, of the form sha256=<hex> over the exact request body, and X-Statsy-Timestamp. Supply your own signing secret of at least 16 characters, or let Statsy generate one.
import { createHmac, timingSafeEqual } from 'node:crypto';
const expected = 'sha256=' + createHmac('sha256', SECRET).update(rawBody).digest('hex');
const given = req.headers['x-statsy-signature'];
const ok = expected.length === given.length && timingSafeEqual(Buffer.from(expected), Buffer.from(given));The body also carries a timestamp, so you can reject anything replayed from long ago.
The throttle
Each alert kind fires at most once per hour per site. A traffic drop that lasts all day is one message. Alerts are evaluated every few minutes, so the delay between something happening and hearing about it is small.
For the regular read rather than the surprise, use an email report instead.
Last updated · Markdown version