Bot detection
Bots vs. your analytics
In additional real-world testing, we run our own bots against pages with Telltale Bot and six other analytics tools: Google Analytics 4, Plausible, Matomo, Mixpanel, Amplitude and PostHog, each with its own bot filtering. Here are the latest results.
Share of our bots each tool identified
0% identified100%
| Tool | Level 1Declared crawler | Level 2Headless Browsers | Level 3Disguised, on servers | Level 4Residential proxies | Level 5Stealthed, home computer |
|---|---|---|---|---|---|
| Telltale Botflags, doesn't drop | 100% | 100% | 100% | 87% | 100% |
| Plausible | 100% | 100% | 65% | 16% | 0% |
| Matomo | 78% | 80% | 55% | 2% | 0% |
| GA4 | 90% | 92% | 0% | 0% | 0% |
| Amplitude | 100% | 67% | 0% | 0% | 0% |
| PostHog | 78% | 33% | 0% | 0% | 0% |
| Mixpanel | 33% | 20% | 0% | 3% | 0% |
Last run . Each cell is the percentage of that bot's visits the tool excluded or identified as a bot via its own reporting API.
- 1Declared crawler. A browser capable of JS that says it's a crawler (e.g., Googlebot, bingbot, GPTBot, Screaming Frog, Scrapy, etc.).
- 2Headless automation. Headless Chrome as automation frameworks leave it (e.g., Puppeteer, Playwright, Selenium), or with a testing or monitoring tool's name in its user agent (e.g., Lighthouse, WebPageTest, Datadog Synthetics).
- 3Disguised browsers on servers. Browsers on servers that claim to be a person's Chrome or Edge, from datacenter IPs (e.g., playwright-stealth through a datacenter proxy or a commercial scraping API that renders the page in its own browser).
- 4Residential proxies. Bots that come through residential proxies: people's home and mobile internet connections, rented from proxy services (e.g., an anti-detect browser with a made-up Windows or Mac profile whose time zone matches the exit, loading one page with no input; a scraping platform's crawler for feeding LLMs; playwright-stealth through a commercial residential proxy network).
- 5Stealth tools on a home computer. Tools built to pass for a person's browser, driving a real computer on an ordinary home internet connection, with mouse paths, scrolling and clicks.
How we test
Each visit is a new browser with a new profile. Most load the page, scroll, move the mouse, click and leave; the anti-detect profiles load one page and leave with no input, as the farms we see in real traffic do. Each analytics tool runs as its vendor installs it, with its default settings.
Flagged vs. kept out
Telltale Bot doesn't drop anything: it labels every visit human, AI agent or bot, so you choose what to filter. Most analytics tools drop the bots they recognize, either in the browser before a hit is sent or when they receive it.
What this doesn't show
We wrote these bots, and real ones vary: a determined operator tuning against any particular tool will likely get through. It also says nothing about the other mistake, calling a person a bot.
Visits left out
A tool is only scored on visits it could see: one whose script didn't load, or that sent nothing for some reason other than its own bot check, isn't counted for that tool. It's also possible some platforms drop hits for reasons other than bots, we assume if they don't register our test bot hits it was because of bot filtering.