Attack mode

Sometimes a site gets flooded: a script hammering the collect endpoint, referrer spam, or someone replaying beacons with made-up visitor ids. Attack mode holds every beacon to stricter rules so that traffic is dropped before it is counted. It is off by default and meant to be switched on for the duration of an attack.

What it checks

• A real browser. Empty or very short user agents and the defaults of HTTP libraries (curl, python-requests, Go, Java, axios and the like) are dropped.
• Your own pages. The request's Origin (or Referer) must be your domain, one of its extra domains, or your proxy host.
• Browser fetch metadata. Every current browser sends Sec-Fetch-Mode with fetch and beacon requests; scripts rarely bother.
• A human rate. One address may send at most 60 beacons a minute and use at most 25 different visitor ids an hour.

Turn it on

Open Site settings › Tracking › Attack mode and flip the switch. The card then shows how many hits were blocked in the last hour and day, and why. Blocked hits are never billed and never appear in any report.

What you lose while it is on

A sliver of honest traffic: very old browsers without fetch metadata, privacy tools that strip the Origin header, and offices where many people share one address and browse quickly. That is why it is a switch and not the default. Turn it off once the flood stops.

Ordinary bot filtering (search crawlers, monitoring services, headless browsers) is always on and does not need attack mode.