How a visit is scored

Every visit gets a bot score from 0 to 100. Loghound has 26 weighted rules; each one that fires adds its points and leaves a reason code, so every verdict can say why it was reached.

The rules are on two pages: 11 rules decisive alone (80 points or more, enough for a bot verdict on their own) and 15 rules that stack (below 80, meant to add up).

1. Every rule that fires adds its weight. Three weak rules can reach a bot verdict together: no sub-resources 25 + no conditional requests 30 + got a 403 40 = 95.
2. Arriving from somewhere real takes points off: 25 for a search engine, 20 for a social network or a link on another site. Only when something already fired, and never below 0. Arriving with no referrer earns nothing either way.
3. The total, capped at 100, picks the band in the figure above.
4. Checks that can only hold a verdict back are applied next. They are listed below.
5. Two protections for real people come last, and then the findings that are always a bot.

• No page requested: a visit that fetched only images, scripts or /robots.txt is at most likely human.
• Too short to call human: under 30 seconds on the best clock available, at most likely human.
• Under 30 seconds and no beacon: this one convicts. A visit that short with no beacon at all is called a bot. On a site that does not carry the beacon, every short visit lands here, which is why installing it matters.
• Nothing measured a duration: one request and no beacon, at most unknown.
• Visit still open: at most unknown until it ends. Visits still open.
• Nothing testable: no beacon, no client hints logged, no sub-resource fetched. Nothing could clear the visit, so it is at most unknown. This is the usual shape of a request your site refused.

• Signed in: when your own site names the visitor through the beacon, the verdict is human, whatever else fired. Except for a driver artefact, a forged beacon clock, a failed reverse DNS check, a User-Agent its own client hints contradict, a client that says it is a bot, or one that is not a browser. Identity & signed-in.
• Measured as a person: when the beacon recorded at least 20 interactions plus two minutes of engaged time (or a signed-in visitor), a single accusation cannot make the verdict worse than unknown. The findings stay listed for you to judge. Deliberate acts are exempt: the same list as above, plus a software renderer and a failed browser claim.
• Always a bot: a declared crawler, a client that is not a browser, a failed reverse DNS check, and a User-Agent contradicted by its own client hints. These make the verdict bot no matter the score.

Each visit also gets a class: declared crawler, AI crawler, monitor, spoofed User-Agent, proxy fleet, headless browser, undeclared client, scripted client, or not automation. Verdicts and bot classes says what each one means, and Honest crawlers why search engines are kept apart from evasive traffic.