Filter traffic

Rybbit provides server-side traffic filtering to keep unwanted data out of your analytics. You can exclude your own traffic, staging and preview environments, internal tools, monitoring checks, or entire countries.

Filters are configured from Site Settings → Exclusions.

Available Filters

When a request matches an exclusion, Rybbit returns a successful response but does not write the event to analytics storage.

IP Exclusions

Block traffic from specific IP addresses or ranges at the server level. This is usually the best way to hide your own traffic.

Supported formats:

• Single IPv4: 192.168.1.1
• Single IPv6: 2001:db8::1
• CIDR notation: 192.168.1.0/24, 2001:db8::/32
• IPv4 ranges: 192.168.1.1-192.168.1.10

IP exclusions are checked against every client IP the request reports in its headers (CF-Connecting-IP, X-Real-IP, and each X-Forwarded-For entry), not only the IP Rybbit resolves as the visitor's. The address of the direct network connection is not checked when forwarding headers are present. That keeps "exclude my own IP" working behind proxies, at the cost of also excluding anyone whose request passes through an excluded address.

For setup instructions and best practices, see Hiding Your Own Traffic.

ASN Exclusions

Exclude every request from a network, identified by its autonomous system number. Enter AS13335 or 13335. Like IP exclusions, ASN exclusions match if any of those client IPs belongs to an excluded network.

Use this for networks that don't have a stable IP range you can list, such as a corporate VPN or a hosting provider that sends you unwanted traffic. Excluding a large consumer ISP or mobile carrier removes real visitors too.

Country Exclusions

Block all traffic geolocated to specific countries. Rybbit resolves the visitor IP address with the MaxMind GeoLite2 database, then compares the resulting country code to your exclusion list.

Use two-letter ISO country codes:

• US for United States
• GB for United Kingdom
• CN for China
• DE for Germany

Country codes are stored as uppercase values in the dashboard and API.

Path Exclusions

Exclude traffic to specific page paths. Path exclusions match the pathname only, not the query string.

Examples:

/admin/*
/preview
/internal/*

Matching is case-insensitive. A * wildcard matches any sequence of characters, so /admin/* matches /admin/users and /admin/settings.

Use path exclusions for pages that should not appear in analytics at all, such as admin dashboards, internal previews, or test routes.

Query Param Exclusions

Exclude page URLs that carry a specific query parameter.

Examples:

preview
utm_source=internal
ref=test-*

• A name on its own (preview) matches whenever the parameter is present, whatever its value.
• name=value matches only that value. The value supports * wildcards.
• Parameter names and values match case-insensitively.

Hostname Exclusions

Exclude traffic from specific hostnames. This is useful when the same site ID is used across production, staging, preview, and local environments.

Examples:

localhost
staging.example.com
*.vercel.app
*.netlify.app

Matching is case-insensitive. A * wildcard matches any sequence of characters, so *.vercel.app matches my-preview.vercel.app but not vercel.app.

User Agent Exclusions

Exclude traffic from requests whose user agent contains a configured substring.

Examples:

HeadlessChrome
MyMonitor
Pingdom

Matching is case-insensitive and uses substring matching, so HeadlessChrome matches Mozilla/5.0 HeadlessChrome/120.

Use user-agent exclusions for uptime monitors, synthetic checks, internal crawlers, or other tools with predictable user-agent strings.

What Filters Apply To

Traffic filters run before normal analytics data is stored. They apply to:

• Pageviews
• Custom events
• Performance and Web Vitals events
• Error events
• Autocapture events
• Session replay batches

How Filters Are Evaluated

Rybbit checks exclusions in this order:

1. IP address
2. ASN
3. Country
4. Path
5. Query parameter
6. Hostname
7. User agent

If any filter matches, the event is accepted with a 200 response but is not tracked. Changes usually take effect within 60 seconds because site configuration is cached briefly on the server.

Testing Filters Locally

To test country filtering locally, send a public IP through the X-Real-IP header:

curl -X POST http://localhost:3001/api/track \
  -H "Content-Type: application/json" \
  -H "X-Real-IP: 8.8.8.8" \
  -d '{
    "type": "pageview",
    "site_id": "your-site-id",
    "hostname": "example.com",
    "pathname": "/test"
  }'

For path and hostname filters, set pathname and hostname in the event payload to values that should match your configured exclusions.