Traffic Analytics

Traffic Analytics shows how many real people visit, how many are new, and how risky each traffic source is, counted by identity instead of cookies. It lives on the dashboard Overview tab and answers the question cookie analytics gets wrong: how many real humans visited, and how much of that traffic is masked? Every number here is computed server-side and read-only. The dashboard renders results. It never blocks, challenges, or decides anything. Your own code owns the allow / challenge / review / block decision using the Risk Score and signals you receive over webhooks and the Management API. Traffic Analytics has three parts:

• Visitors and New Visitors - real and new headcounts, counted by a durable identity, not a cookie.
• Traffic Sources - every channel, referrer, and campaign ranked by the risk it delivers.
• Traffic Risk and the Data table - the average risk gauge and the per-request records behind it.

​

Visitors and New Visitors

Two metrics sit at the top of the Visitor Insights card. These are the exact product tooltips:

​

Why the count is more accurate

ShieldLabs does not count by a single cookie. It counts by the durable DeviceID, an identity derived from dozens of stable browser and device characteristics, not stored. Because nothing is stored, there is nothing to clear. A returning person on the same browser reproduces the same environment, so the server derives the same DeviceID and keeps them recognized as returning. Cookie-based tools count differently, and that decides whether the same person is counted once or many times: The pattern: GA and Vercel count by a first-party cookie, so cleared cookies, incognito, and IP rotation each mint a brand-new user and inflate new-visitor counts. A loyal user who clears cookies weekly looks like dozens of new people a year. ShieldLabs counts by the durable DeviceID, so that same person stays one identity and is not miscounted as new. The card also breaks the same visitors down by top countries, browsers, operating systems, device types, and connection types. The connection-types list classifies each visit as Direct, Mobile, VPN, Proxy, Tor, Privacy Relay, or Unknown, which is an early read on how anonymous your audience is.

​

Traffic Sources

Traffic Sources ranks every acquisition channel, referrer, and campaign by the risk it delivers, not the volume it sends. Two channels with identical request counts are not equal if one runs Clean and the other runs High. That delta is the difference between paying for real visitors and paying for masked traffic. The card holds two tables side by side: Channels on the left, Source details on the right.

​

Channels

The Channels table groups every request into one acquisition channel and scores the channel as a whole. Each row shows the channel name, its Requests / Share, and a Risk Badge. The channel set is fixed and exact: The Risk Badge renders the source’s risk as a score plus its band: <score> <level>, for example 71 High or 8 Clean. The number is the average Risk Score of the requests attributed to that source, on the same 0–100 scale used everywhere. The word is the band:

​

Source details

Where Channels answers “which channel?”, Source details answers “which specific source inside it?”. A toggle switches between two views, each row carrying its own Requests / Share and Risk Badge:

• Referrers - each row is a referring host (for example news.ycombinator.com). This is how you find the one inbound link, partner site, or affiliate sending masked traffic while the channel-level number still looks fine.
• UTM Parameters - a select picks which campaign tag to break down by.

This is the resolution that drives spend decisions. Channel says Google Ads runs 42 Medium. UTM Campaign shows the medium score is one clean campaign averaged with one running 81 High. UTM Content narrows it to a single creative. Now you know exactly what to pause, ranked by risk instead of guesswork.

​

Traffic Risk and the Data table

The Traffic Risk gauge on the Overview tab shows the average Risk Score across requests in the period. A half-circle gauge maps the average to a band, with a short subtitle under the needle: The Traffic Risk gauge is the summary. The Data table is the evidence behind it. It lists per-request records, one row per identification call, joinable by RequestID:

• Filterable by project, score range (for example 60–100 to isolate the High band), date range, and abuse pattern.
• Searchable by a single identifier: request_id, visitor_id, device_id, user_hid, or ip.
• Sortable by date, score, and every signal column, so you can group every request that tripped a given signal.
• Exportable to JSON or CSV, free of charge. Exports do not consume request balance.

Each request ships an explainable Risk Score: a Details array naming the signals that fired and the points each added. So when a source reads High, filter the Data table to it, set the Score range to the High band, and read the exact signals (VPN, Anti-detect Browser, Tor, Datacenter IP, and the rest) that pushed the average up. The dashboard surfaced the masked source. The decision and the action are yours, in your own tools.

​

Next steps