Exclude your own visits and bots

Your own visits count like anyone else’s until you exclude them. There are three ways to do it, and bots are handled for you.

Excluded paths and IP addresses

Open Site settings › Tracking › Exclusions. Both boxes take one entry per line.

• Excluded paths such as /admin/* or /preview. A * matches any suffix.
• Excluded IPs such as 203.0.113.5, or a range in CIDR form such as 198.51.100.0/24. Your office and VPN ranges go here.

Matching traffic is dropped at ingest. It never reaches a report, and it is never counted towards your monthly events.

Opting one browser out

An IP address that changes, such as a laptop on the move, is better handled in the browser. Set the local storage key statsy_optout to 1 and that browser stops sending anything.

localStorage.setItem('statsy_optout', '1');

The script also honours Do Not Track and Global Privacy Control by default, so browsers set up that way send nothing at all. See Tracking modes and cookieless.

Hostnames work the other way round

There is no hostname exclusion list, because hostnames are an allowlist instead: beacons are only accepted from your site’s domain, its subdomains, and any additional domains you added under Site settings › General. Everything else is dropped, which is why preview and staging hosts do not show up. See Subdomains and multiple domains.

Bots and AI crawlers

Requests identified as bots by their user agent are recorded separately and kept out of visitor numbers, with no setting to change. They are not lost: the bots report groups them by family (AI assistant, AI training crawler, search engine, other), by name such as GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, Google-Extended, CCBot, Bytespider and Amazonbot, and by the paths they crawl.

Tip. Local development is excluded by default in production: beacons from localhost come from a host that is not your domain and are dropped.