Methodology
quietstats counts without cookies, so some numbers are worked out differently from cookie-based tools. This page explains each one, with its limits, so you know exactly what you are looking at. All the rules below come straight from the code that runs the collector and the dashboard.
Pageviews
One pageview is recorded each time a page loads, and each time a single-page app changes route with history.pushState or the back/forward buttons. The #fragment is removed first, and the same address twice in a row is only counted once. Only the path is kept: every query parameter except the UTM campaign tags (and ?ref=) is dropped.
Visitors
There is no cookie to recognise a returning browser, so each pageview gets a daily visitor ID:
The salt is a random value made fresh each day (UTC) and deleted the next day, so IDs from different days cannot be linked, even by us. The IP address and user agent are used in memory for this sum and are never stored. A visitor is one distinct daily ID on one day.
Limits, honestly
- Over a range of several days, Visitors is the sum of each day’s unique visitors. Someone who comes back on three different days counts three times. Cookie-based tools can de-duplicate across days; we deliberately can’t.
- One person on a phone and a laptop counts as two visitors.
- If a phone switches from mobile data to Wi-Fi, its IP address changes, so it can count as two visitors that day.
- People who share an IP address and an identical browser version (for example in one office) can be merged into one visitor.
Visits
A visit is a run of pageviews with the same daily ID where each pageview comes no more than 30 minutes after the one before. A gap of more than 30 minutes starts a new visit.
Limits, honestly
- Because the ID resets at midnight UTC, a visit that runs over midnight UTC is split in two.
- Views per visit = pageviews ÷ visits.
Bounce rate
There is no engagement ping or scroll tracking, so a bounce simply means the visit had a single pageview.
Limits, honestly
- Someone who reads one long article for ten minutes and leaves counts as a bounce.
- Bounce rate in Google Analytics 4 means something different (sessions that were not “engaged”), so the two numbers are not comparable.
Visit duration
The average is taken over all visits, including single-page visits, which have a duration of 0 seconds.
Limits, honestly
- Time spent on the last page of a visit is not measured, because the script sends nothing when someone leaves. Durations are therefore a lower bound.
- Single-page visits pull the average down. Sites with lots of one-page visits (blogs, landing pages) will show short averages even when people read carefully.
Live visitors
Live visitors = distinct daily IDs with at least one pageview in the last 5 minutes. The live feed shows recent pageviews (page, country, referrer host, device, browser, time ago) with no IDs, IPs or user agents.
Sources and channels
The referrer is reduced to its host name (for example news.ycombinator.com), and referrers from your own domain are dropped. Each pageview is then put into one channel, checked in this order:
| Channel | Rule |
|---|---|
| Paid | utm_medium contains cpc, ppc or paid |
| utm_medium contains email or newsletter, or the referrer is a webmail host | |
| Direct | no referrer and no utm_medium |
| Campaign | no referrer, but a utm_medium is set |
| AI | referrer is an AI assistant such as ChatGPT, Perplexity, Gemini, Grok, Claude or Copilot |
| Search | referrer is a search engine such as Google, Bing, DuckDuckGo or Ecosia |
| Social | referrer is a social site such as X, Reddit, LinkedIn, Facebook or YouTube |
| Referral | any other website |
Limits, honestly
- Many apps and some browsers send no referrer, so those visits show as Direct.
- Google AI Overviews arrive as google.com and Grok inside X arrives as x.com, so they are counted as Search and Social, not AI.
- UTM tags are only read from the landing page address. They are trimmed, lower-cased and cut to 80 characters.
Countries and devices
Country comes from the two-letter country code that Cloudflare’s network adds to each request. We never look up or keep the IP address. Device (desktop, tablet, mobile), browser and operating system families are read from the user agent together with the screen width, then the user agent is thrown away. Screen size is stored as width × height.
Limits, honestly
- Visitors using a VPN or private relay appear in the VPN’s country.
- Browser and OS are families (Chrome, Safari, iOS, Windows…), not versions.
What is not counted
- Do Not Track and Global Privacy Control. With
data-dnt="true"(in every snippet we give out) the script sends nothing when either is switched on. The server also ignores any request that carries aDNT: 1orSec-GPC: 1header. - Bots and automated tools, picked out by their user agent (see Bot filtering below).
- Pages on other domains. The page address (and the browser’s Origin, when sent) must match the site’s registered domain or one of its subdomains.
- Local testing on localhost or 127.x addresses.
- Pageviews over 120% of your monthly plan: recording pauses until the next month or an upgrade.
- Browsers with JavaScript off, and some content blockers. quietstats does not try to get around blockers, so these visits are missed.
Bot filtering
Before anything is written, the collector drops a request if it has no user agent, or if its user agent contains any of these words (upper or lower case):
botcrawlspiderslurpheadlesslighthousepingdomuptimemonitorpreviewfacebookexternalhitcurlwgetpythonhttpclientgo-httpjava/phantomseleniumpuppeteerplaywright
That covers search crawlers (Googlebot, Bingbot), social link previews, uptime monitors, page-speed tools such as Lighthouse, command-line tools (curl, wget, Python scripts) and headless browsers. On top of that, a pageview is only accepted when the page address belongs to the site’s registered domain, which stops most fake hits sent from elsewhere.
Limits, honestly
- Filtering is by user agent only. A bot that pretends to be an ordinary browser and runs JavaScript can still be counted.
- We do not use IP reputation lists, fingerprinting or challenges, because those would mean looking up or keeping data about visitors.
- Dropped requests are not stored, so we cannot show how many bots were filtered.
- This list is published as it is in the code. If you see obvious bot traffic, tell us and we will add the pattern.
Time zones and imported history
Every pageview is stored with a UTC timestamp, and days are UTC days. The hour-of-day heatmap is shown in each site’s own time zone (UK time by default, adjusted for the clocks changing). The Stats API returns dates and hours in UTC.
Sites that moved from another tool can have imported history: daily totals only, shown for days before the site’s first live quietstats pageview, so nothing is counted twice. Imported days have no page, source or device detail.
Carbon estimate
The dashboard’s Carbon estimate card, and the script comparison on the home page, use the Sustainable Web Design model (version 3, simplified):
- Page weight (dashboard card): the HTML of the page plus the reported size (Content-Length) of up to 14 of its scripts, stylesheets and images, measured when you press Measure, never on page load.
- Script comparison (home page): the download size of each analytics script as we measured it, from the size comparison.
- Assumptions: a first visit with nothing cached, the global average grid intensity, and no allowance for the visitor’s device or the data centre. Real emissions depend on all of these.
These are rough estimates to compare pages and tools, not measurements of real emissions.
Related: How it works & privacy · FAQ · Stats API