> For the complete documentation index, see [llms.txt](https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/setup/visitor-analytics.md).
# Visitor Analytics
### What Is the Analytics Page?
The Analytics page gives you a detailed picture of who is visiting your store, where they come from, what risk level they carry, and which protection rules are firing. It is your main tool for understanding threats and investigating suspicious activity.
Go to **Analytics** in the left sidebar to open it.
***
### Selecting a Date Range
At the top of the Analytics page is a **date range picker**. The default range is the last 7 days.
Click the date range to open a calendar and choose a custom start and end date. All charts and tables on the page update to show data for your selected period.
***
### The Overview Tab
The Overview tab is the default view. It contains several sections.
#### Traffic Summary
A row of summary numbers at the very top:
| Metric | Description |
| ------------------ | -------------------------------------------------- |
| Total Visitors | All sessions in the selected period |
| Blocked | Sessions stopped by a rule or security check |
| Allowed | Sessions that passed all checks |
| Redirected | Sessions sent to a redirect URL instead of blocked |
| Suspicious | Sessions with a risk score of 40 or above |
| Average Risk Score | The mean risk score across all sessions |
#### Traffic Analytics
**Traffic Trend Chart** — a line graph showing daily visitor counts (allowed vs. blocked) over your selected date range. Use this to spot unusual spikes in blocked traffic.
**Visit Pattern Heatmap** — a grid showing traffic volume by hour of the day and day of the week. Darker squares mean more traffic at that time. Use this to identify unusual off-hours activity that may indicate automated bots.
#### Protection Analytics
**Visitor Risk Distribution** — a donut chart showing how many sessions fell into each risk band (Trusted, Suspicious, Risky). See Article 4 for what these scores mean.
**Block Reason Distribution** — a donut chart showing which protection feature triggered each block (e.g., IP rule, country rule, VPN detection, bot detection).
**Protection Summary** — a compact scorecard showing:
| Stat | What it counts |
| --------------------- | ---------------------------------------------------- |
| Blocked Bots / VPN | Sessions blocked specifically as bot or VPN traffic |
| Blocked VPN & Proxy | Sessions where a VPN/proxy was detected and acted on |
| Suspicious Visitors | Sessions with a risk score of 40 or above |
| Total Rules Triggered | Sessions where at least one fraud rule matched |
#### Rules & Technology Analytics
**Top Triggered Rules** — the fraud rules that fired most often during the selected period. If a rule appears here frequently, it is working hard to protect you.
**Technology Analytics** — a breakdown of the browsers, devices, and operating systems your visitors use. Unusual concentrations (e.g., 90% of traffic from a single browser with no OS info) can indicate bot traffic.
**Global Visitor Distribution** — a world map showing where your traffic originates.
**Top Countries** — a ranked list of countries by visitor count, with blocked vs. allowed split shown for each.
**Top IPs** — the IP addresses that sent the most traffic in the selected period.
***
### The Visitors Tab
The Visitors tab shows a paginated log of individual visitor sessions. It has three sub-tabs:
| Sub-tab | Shows |
| ------------------- | -------------------------------------------- |
| Allowed visitors | Sessions that passed all checks |
| Blocked visitors | Sessions stopped by a rule or security check |
| Redirected visitors | Sessions sent to a redirect URL |
#### Reading a Visitor Row
Each row in the visitor log shows:
* **IP address** — with a copy button
* **Country flag** — the visitor's detected country
* **Risk score badge** — Trusted (green), Suspicious (yellow), or Risky (red)
* **Outcome** — Allowed, Blocked, or Redirected
* **Timestamp** — date and time of the visit
#### Quick-Block and Quick-Allow
Next to each IP address in the visitor log you will see two action buttons:
* **Block** — instantly creates a Blacklist rule for that IP
* **Allow** — instantly creates a Whitelist rule for that IP
These are shortcuts so you do not have to leave the Analytics page to act on a suspicious visitor.
> **Important:** Quick-block and quick-allow create **permanent rules** in your Fraud Rules list. If you want to remove them later, go to Fraud Rules and delete the rule that was created automatically (it will be named "Block IP x.x.x.x" or "Allow IP x.x.x.x" with the note "Created from visitor log").
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/setup/visitor-analytics.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.