Share of sessions where your own domain shows up as the referrer — a sign of broken cross-domain or UTM tracking.
Total sessions vs prev 7d — a large drop can signal broken tracking or real traffic loss; a large spike may indicate bot traffic.
Sessions where source or medium is (not set) — indicates missing UTM parameters or broken tracking.
Change in (direct)/(none) traffic share vs prev 7d — spikes often signal missing UTMs, email/app dark traffic, or HTTPS stripping.
Change in Organic Search (medium=organic) traffic share vs prev 7d — drops may indicate a Google penalty or indexing issues.
Change in Google Ads (google/cpc) traffic share vs prev 7d.
Change in Direct (medium=none) traffic share vs prev 7d — spikes often signal missing UTM parameters or dark traffic.
Largest single-channel share change vs prev 7d — flags unusual shifts in the attribution mix.
Flags any hostname with 100+ sessions vs prev 7d that wasn’t seen in the previous period — a sign of a hijacked/cloned tag, a staging/dev domain going live, or a broken cross-domain setup.
Change in bounce rate vs prev 7d — a spike may indicate a broken page or misconfigured engagement events.
Share of sessions lasting 10+ seconds or triggering a conversion — below 20% suggests bot traffic or broken tracking.
Change in pages per session vs prev 7d — a drop may indicate broken navigation or redirect loops.
Change in average session duration vs prev 7d — drops can indicate bot traffic or UX degradation.
Change in session conversion rate vs prev 7d.
Share of sessions with a missing or blank page title.
New countries pulling more than 3% of total sessions vs prev 7d.
Sessions without an assigned country — elevated values may indicate VPN traffic or bot activity.
Flags any country whose session share jumped 15+ pp vs the previous period — a strong bot signal.
Share of sessions outside the dominant country and "(not set)" — flags composition drift even among countries that were already present.
Combines 4 signals (new-user ratio, engagement rate, session length, direct share) into a risk score.
Change in night-time (0–5h) traffic share vs prev 7d — a common bot signal.