In this guide
- Bot Detection has two modes: Header adds
X-Bot-Detection: trueorfalseto every request, and Block sends bots a 403. - Start with Header. It lets your container decide, and a mistake costs you one filtered event instead of an unreachable site.
- Never block the crawlers that review your ads and landing pages, and keep search engines able to read your
gtm.js.
Bot traffic is a real nuisance. It inflates sessions, skews conversion rates and can fill GA4 with spam. Filtering it feels like an easy win, and then a campaign gets disapproved or a landing page check fails, and the cause turns out to be the filter. This page explains how to filter bots without cutting off the visitors and crawlers you need. See also filtering spam in GA4 with Bot Detection.
How the power-up decides
Open Tracked's Bot Detection recognises requests from software by the browser name it sends, such as search engines, crawlers and scripts. It does not run a challenge, and it cannot recognise a bot that pretends to be a normal browser. You choose what happens when it recognises one:
| Mode | What happens | When to use it |
|---|---|---|
| Header | Adds X-Bot-Detection: true or false to every request in the server container | Default choice. You decide in Tag Manager which tags should skip bots. |
| Block | Bots get a 403 and the request never reaches your server container | When you are sure those bots never need your tagging server. |
Bot Detection is on every plan, including Free. The rule is applied to the tagging server within a few seconds of saving.
3 things to remember
Scroll and the points stack up.
Bot Detection has two modes: Header adds X-Bot-Detection: true or false to every request, and Block sends bots a 403.
Start with Header. It lets your container decide, and a mistake costs you one filtered event instead of an unreachable site.
Never block the crawlers that review your ads and landing pages, and keep search engines able to read your gtm.js.
What goes wrong with Block mode
gtm.js is blocked for bots by default, and a Block rule adds to it.gtm.js, and use Header mode for the rest.A safe way to use Header mode
Turn on Bot Detection in Header mode
Save. The rule is applied within a few seconds.
Create a variable for the header
In the server container, a request header variable named X-Bot-Detection.
Add a trigger exception
Do not fire analytics and ad tags when the header equals true.
Test with Preview
Send an event with a normal browser (header false) and with a bot user agent (header true).
Runs on your domain, anywhere
Your tracking runs on your own domain, so a visit from any country is handled the same way.
How to test Block mode safely
- Use a test container or a quiet hour.
- Open your tagging address with a search-engine browser name: it must answer 403, and a normal browser must answer 200.
- Look at your ad accounts and Search Console for the next two days.
- Switch back to Header if anything looks off.
Which bots can you safely filter?
| Visitor type | Seen as | Safe to block? |
|---|---|---|
| Search engine crawlers | Googlebot, Bingbot and similar | Do not block your site. Keep them able to read pages and, if you want, gtm.js. |
| Ad review crawlers | Bots that check landing pages for ad networks | No. Blocking can disapprove ads. |
| Link preview bots | Chat and social apps that fetch a preview | Harmless. Skip analytics for them with the header. |
| SEO and uptime tools | Audit crawlers and monitors | Usually safe to skip in analytics. Allow your own monitor. |
| Scrapers and scripts | Generic HTTP libraries | Safe to filter in Header mode. |
Terms you will see
- User agent
- The browser name a request announces. Bot Detection reads it.
- 403
- The "forbidden" answer a blocked request gets.
- Crawler
- Software that reads web pages automatically.
- Header
- Extra information attached to a request, here
X-Bot-Detection. - Spam traffic
- Fake visits that fill analytics reports.
Ask Ari instead of digging through reports
Ari reads your tracking and ad data and answers in plain words.
Frequently asked questions
Does Bot Detection stop all bots?
No. It recognises bots that identify themselves by browser name. Bots that pretend to be normal browsers are not caught.
Should I use Header or Block?
Start with Header. It lets your container decide and does not risk blocking crawlers you need.
Will it block Googlebot?
In Block mode a search-engine browser name is answered with 403. Use Header mode and the Open Container for Bot Index power-up if search engines need to read your container.
Is it on the free plan?
Yes. Bot Detection is available on every Open Tracked plan.
How do I block one IP address?
Use Block Request by IP, available from the Business plan. It refuses the listed addresses with a 403.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Guides · 6 min read
