The panel speaks in words. The URL, the Solr document and anything you query yourself speak in identifiers. This page is the mapping, and it is the only place it exists.
An identifier is the right thing to store: it is stable, it is what a filter carries in a URL, it is what you grep a log for, and it is what a query you write yourself has to name. It is the wrong thing to show somebody who has never read the source. So the panel renders a label, and an identifier it does not recognise renders as itself — never as a wrong-but-plausible label, and never as blank.
These are the values a session’s reasons field can hold. Seventeen are weighted rules; the last three carry no weight and are not accusations at all. The scoring page explains how they combine.
| Identifier | Label | What it tests | Weight | Plane |
|---|---|---|---|---|
automation_marker | Automation marker | The page exposed a definitive driver artefact — the webdriver flag, a chromedriver global, Puppeteer, Playwright or Selenium hooks. Browsers do not have these; drivers do. | 100 | execution |
ua_declared_bot | Declared crawler | It said it was a bot and it was telling the truth. Verdict bot, threat none. | 100 | transport |
rdns_claim_failed | rDNS claim failed | It declared itself a major crawler and forward-confirmed reverse DNS did not back that up. Impersonating a crawler is not a mistake anyone makes by accident. | 95 | transport |
headless_renderer | Headless renderer | WebGL reported SwiftShader, llvmpipe, Mesa OffScreen or Microsoft Basic Render: software rasterisation, which is what you get when there is no screen. | 90 | execution |
beacon_forged | Forged beacon timing | The claimed dwell time is impossible against the issue time of its own token. The lie is recorded rather than discarded, because the lie is the evidence. | 90 | execution |
ua_claim_failed | UA claim failed | The User-Agent claimed a browser version whose engine features the page does not actually have. A spoofed User-Agent string cannot retrofit a JavaScript engine. | 85 | execution |
fp_cluster_proxy_fleet | Proxy fleet fingerprint | Five or more distinct addresses shared this exact header fingerprint within twenty-four hours on non-mobile networks. One client, many exits. | 80 | behaviour |
ua_secch_mismatch | Sec-CH-UA mismatch | A Chrome User-Agent arrived without the matching client hint, or with one that contradicts it. Chrome always sends its own client hints. | 75 | transport |
platform_mismatch | Platform mismatch | The platform client hint disagrees with the operating system the User-Agent claims. | 70 | transport |
no_js_on_html | No JS on HTML | An HTML page was served with a 200 and no beacon ever arrived, while the User-Agent claimed a real browser. Real browsers run scripts. | 70 | behaviour |
hosting_asn_browser_ua | Datacentre + browser UA | A consumer browser User-Agent arriving from a hosting network. Weak alone — VPNs and corporate egress look like this — meaningful when stacked. | 45 | transport |
periodic_timing | Periodic timing | The gaps between requests are too regular across four or more requests. People are not metronomes. | 45 | behaviour |
no_interaction | No interaction | The beacon ran, the session ended, and not one scroll, click or key press ever happened. | 40 | execution |
tz_mismatch | Timezone mismatch | The browser timezone disagrees with the timezone of the address geolocation. | 35 | transport |
no_304_on_repeat | No conditional requests | The same assets were fetched again with no conditional header. A browser cache would have asked. | 30 | behaviour |
no_assets | No sub-resources | HTML was fetched and not a single stylesheet, script, font or image followed it. | 25 | behaviour |
single_page_10s | Single page, under 10s | One page, gone in under ten seconds. Very weak on its own; a bounce looks the same. | 15 | behaviour |
provisional_session | Session still open | The session had not ended when it was scored, so the five signals that can only be read after it ends were not evaluated and the verdict is held at unknown. Nothing was detected. | 0 | — |
beacon_only_session | One plane only | This site has no access log in this installation, so the session was measured by the beacon alone and the five signals that read the request log were not evaluated. Nothing was detected — but the evidence that remains is the plane a determined client controls, so treat the verdict as weaker than the same verdict on a session with a log behind it. | 0 | — |
no_bot_signals | Nothing fired | Every rule was evaluated and none of them fired. This is the absence of evidence, not evidence that a person was driving. | 0 | — |
A session with nothing against it says so explicitly, so “no signals fired” and “the scorer did not run” are different states on the document rather than the same absence.
| Identifier | Label | Meaning |
|---|---|---|
human | Human | Scored low enough that we believe a person drove this session. |
likely_human | Likely human | Some weak automation signals, not enough to call it a bot. |
unknown | Unknown | Scored, and the evidence did not reach a verdict either way. Not a failure to measure. |
likely_bot | Likely bot | Enough signals to suspect automation, short of the bot threshold. |
bot | Bot | Automation, honest or not. Look at the class to tell which. |
| Identifier | Label | Meaning |
|---|---|---|
declared_crawler | Declared crawler | Said what it was in the User-Agent and was telling the truth. Honest traffic. |
ai_crawler | AI crawler | A declared crawler collecting for model training or inference. |
monitor | Monitor | A declared uptime or availability checker. |
spoofed_ua | Spoofed User-Agent | The headers contradict each other, or a crawler claim failed reverse DNS. |
proxy_fleet | Proxy fleet | One browser fingerprint arriving from many unrelated networks. |
headless | Headless browser | A driven or screenless browser: an automation marker, a software rasteriser, or a failed engine claim. |
scripted | Scripted client | Scored as automation without falling into any of the named classes. |
none | Not automation | Not classed as a bot of any kind. |
Classified from the network operator’s name. These seven are the whole set: the classifier can only return one of the six named types or unknown. The hosting value is the one that matters most, because a consumer browser User-Agent arriving from hosting address space is a scoring signal in its own right.
| Identifier | Label | Meaning |
|---|---|---|
hosting | Hosting / datacentre | Cloud, colocation, VPS or CDN address space. People do not browse from servers. |
isp | Consumer ISP | Residential or business broadband. |
mobile | Mobile carrier | Cellular address space, where many subscribers share few addresses. Excluded from the proxy fleet rule for exactly that reason. |
vpn | VPN / anonymiser | A commercial VPN, a private relay or a Tor exit. |
edu | Education | A university, school or research network. |
gov | Government | A public-sector or military network. |
unknown | Unclassified | The operator name did not match any known pattern. |
| Identifier | Label | Meaning |
|---|---|---|
direct | Direct | No referrer was sent: a bookmark, a typed address, or a client that strips it. |
internal | Same site | Referred from this site, or from a host configured as internal. |
ad | Paid ad | Carried an ad-network click id or a paid campaign medium. Tested before search, so a paid search click is never counted as organic. |
ai | AI assistant | Referred from an AI assistant or chat product. |
search | Search engine | Organic: referred from a search engine with no paid click id. |
social | Social network | Referred from a social platform. |
link | Another site | Referred from a site that is none of the above. |
| Identifier | Label | Meaning |
|---|---|---|
search | Search crawler | Indexes pages for a search engine. |
ai | AI crawler | Collects pages for model training or for answering in an assistant. |
seo | SEO tool | A commercial backlink or audit crawler. |
social | Social preview | Fetches a page to build a link preview. |
monitor | Uptime monitor | Checks that the site is answering. |
other | Other declared bot | Declared itself a bot and does not fall into the named categories. |
| Identifier | Label | Meaning |
|---|---|---|
log_only | Server log only | Seen in the web server log and never by the beacon: no script ran, or the visitor left before it reported. |
log_beacon | Log and beacon | Seen on both planes, so the log counts and the measured timings describe the same visit. |
beacon_only | Beacon only | Reported by the beacon with no matching log line — a site on another server, or one whose log has not been read yet. |
This field has no schema default, so every session indexed before it existed carries none of the three — and that absence means “this installation had not started recording which planes it had”, not “log only”. So the honest way to ask for sessions that have a transport plane is to exclude the beacon-only value, which keeps all of that history; asking for log-only instead would silently drop every older session and the count would look like a fact. The None of operator is what spells it, and the panel offers the remainder as its own row labelled “Not reported”.
The same three-state discipline applies to the signed-in dimension, whose two stored values are true (Signed in) and false (Anonymous), with absent meaning not reported — see identity.
Dimensions that already hold words a person uses — a browser name, an operating system, a city, a network operator, a netname, a virtual host, a path, a TLS version — have no mapping at all. There is nothing to translate, and a half-populated map over real-world values would mean some rows got a label and some did not.
For the field names themselves and what each one is indexed, stored or faceted for, see the Solr schema.