> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pivolio.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pivolio.com/_mcp/server.

# Traffic quality

Not every conversion is a person. Bots, datacenter traffic, headless browsers
and click farms all produce events that look real — and feeding them to an ad
platform is worse than useless, because the platform optimizes toward finding
more of them.

Every event is scored during enrichment, and the score can withhold delivery.

## Scoring

Scoring is **additive**: each detected signal adds its weight, and the total is
**capped at 100**. Several weak signals together can reach the same band as one
strong signal, which is the intent — a datacenter IP alone is suspicious, a
datacenter IP plus a header anomaly is not a coincidence.

| Score    | Band       |
| -------- | ---------- |
| **≥ 70** | Flagged    |
| **≥ 35** | Suspicious |
| below 35 | Clean      |

### Weights

| Weight | Signals                                                  |
| ------ | -------------------------------------------------------- |
| 60     | `headless`                                               |
| 50     | `tor`, `ip_reputation`, `known_bot`, `no_click`, `bogon` |
| 40     | `datacenter`, `geo_velocity`                             |
| 35     | `proxy_vpn`, `proxy`, `header_anomaly`                   |
| 30     | `click_velocity`, `duplicate_clickid`                    |
| 25     | `fast_click`, `time_to_convert`                          |

A headless browser is the single strongest signal at 60 — real customers don't
run Puppeteer. Note that no single signal reaches the flagged band alone;
flagging always takes corroboration.

### Thresholds

Several detectors need a threshold, and these are the ones worth knowing because
they explain false positives:

* **Duplicate click ID** — the same click ID appearing across **3 or more
  persons**. Two is plausible (a shared device, a forwarded link); three is a
  pattern.
* **Time to convert** — a conversion less than **10 seconds** after the click.
* **Geo velocity** — location changes within a **1 hour** window that no
  physical travel explains.
* **Fast click** — a click under **800 ms** after page load, faster than a human
  can read and decide.

## Actions

A detection category maps to one of three actions:

* **`ignore`** — score it, do nothing.
* **`flag`** — deliver normally, but mark the event so it's visible in reports.
* **`suppress`** — **withhold delivery entirely**. The event is never offered to
  the platform and records a `suppressed` [delivery status](/documentation/core-concepts/delivery-statuses).

The default preset:

| Category                                  | Default action |
| ----------------------------------------- | -------------- |
| Datacenter, proxy, reputation, bot, abuse | **suppress**   |
| Headless, velocity, behavior              | **flag**       |

The split reflects confidence. Infrastructure signals — an IP that belongs to
AWS, a known bot, a bad-reputation range — are close to unambiguous, so they're
withheld. Behavioral signals are inference about a human, so they're surfaced
for you to judge rather than acted on.

**Strongest action wins.** When several categories fire on one event, the
harshest applies: any suppress makes the event suppressed, regardless of how
many categories only wanted to flag.

## Categories in the dashboard

Datacenter IPs · Proxy/VPN/Tor · Bad IP reputation · Known bots ·
Headless/header anomalies · Click velocity/fast clicks · Behavioral fraud ·
Click-ID abuse

> **Note**
>
> **Disabling detection does not stop scoring.** It sets every action to `ignore`,
> so nothing is suppressed or flagged — but events are still scored and labelled,
> and the reports still populate.

That's deliberate, and it makes turning detection off a safe diagnostic step. If
you suspect legitimate conversions are being suppressed, disable it, confirm
delivery recovers, and then read the scores that *would* have applied to see
which category was responsible — instead of flying blind.

> **Warning**
>
> Suppressed conversions are never delivered and are not retried. If a
> misconfigured rule suppresses real traffic, those conversions do not reach your
> ad platforms and cannot be replayed later. Check the suppressed counts after
> changing any action.