Are you seeing a traffic spikes in your Google Analytics traffic overview, correlating with our scanner visiting your website? Then read this article, as there might be ways to avoid this.
We work tirelessly to be as agile, scalable, and automated as we possibly can. However, we can't guarantee that we'll be able support every implementation setup imaginable for analytics- and tracking platforms, while simultaneously safeguarding the veracity of the scan reports.
Scanner behavior
The scanner is designed to mimic real human behavior as closely as possible, navigating your website as a human visitor would, albeit at much greater speed and efficiency.
The scanner detects tracking technologies both with and without consent.
Traffic caused by the scanner
A scan can result in extra traffic in analytics tools like Google Analytics, in a volume that would equal around five visitors visiting every single page of your website.
This extra traffic from the scanner can manifest as massive spikes, especially if you have many website pages but not a lot of regular website visitors.
For larger providers of analytics tools, like Google Analytics, the scanner has been setup with infrastructure and behavior which automatically filters out scanner generated traffic. There are however still certain Google Analytics implementations where these measures aren't sufficient.
Server-side-tagging (SST)
Generally the scanner declares itself as a “bot” for server-side-tagging implementation of Google Analytics, if these follow the common pattern listed in Google’s server-side-tagging domain structure.
| Same origin | Subdomain | Default external domain | |
| Example URL | www.example.com/metrics | metrics.example.com | metrics.run.app |
| Server-set cookie access | Full access to security and durability benefits. | Full access to security and durability benefits. | None. Can only set Javascript cookies. |
| Setup complexity | Configure a CDN or load balancer to forward requests. May need to update DNS entries. |
Update DNS entries. | Comes pre-configured. |
Therefore, if you want to avoid having scanner traffic show up in your Google Analytics traffic dashboard, you should set up your domain structure to Same origin or Subdomain.