How a session is bounded
A session has no natural end — a person closing a tab tells you nothing — so every analytics tool defines one with rules. Three are near-universal:
- An inactivity timeout. Thirty minutes with no events ends the session. The next event starts a new one.
- A maximum length. Usually 24 hours, so a dashboard left open on a second monitor does not produce one session lasting a fortnight.
- A campaign change. Most tools start a fresh session when a visitor arrives with new UTM parameters, so a click from a different campaign gets its own visit to be credited with.
None of these describes human behaviour. Thirty minutes is a convention inherited across the industry, not a measurement of attention. This is worth knowing because it is one of the most common reasons two analytics tools disagree about the same traffic.
What sessions are used for
A surprising share of familiar metrics are session metrics rather than user metrics, and they inherit every boundary rule above:
- Bounce rate — the share of sessions containing a single pageview.
- Session duration — last event minus first, which means a session with one event has a duration of zero.
- Pages per session — an engagement proxy that moves whenever the timeout does.
- Entry and exit pages — the first and last page of the visit, which is how you find where journeys start and end.
Sessions versus people
A session answers “what happened during this visit”. A person answers “what has this human done over time”. Product questions — funnels spanning days, retention, lifetime value — need the second, and no amount of session analysis substitutes for it.
The useful corollary: because a session only requires knowing that two events arrived close together from the same visitor, it needs no durable identifier. That is why session metrics survive cookieless tracking completely intact while unique users and retention do not. If you are measuring privately, sessions are the part of the picture that stays exact.
Where session metrics go wrong
- Single-page apps. If route changes are not tracked as pageviews, a whole visit looks like one page. Pages per session collapses and bounce rate reads near 100%.
- Duration is systematically understated. Measuring first-to-last event means the time spent on the final page — often the page they actually came to read — counts as zero.
- Automated traffic sets a floor. A monitor loading one URL every minute contributes an endless supply of one-event sessions. See bot traffic.
- Timeouts split real visits. A person who reads for forty minutes and then clicks is two sessions, with the second attributed to no referrer at all.
How Pug handles sessions
Pug’s web SDK stitches sessions in the browser with a 30-minute idle timeout and a 24-hour maximum length, both configurable when you initialise it. Every event carries its session id, so session metrics are computed over the same raw event stream as everything else rather than a separate pre-aggregated table you cannot look inside.
One deliberate consequence: because a session is a unit, filters that judge a visit are applied to the whole session rather than to individual events. When automated activity is excluded, a session containing any of it is dropped entire — a hit-by-hit filter would leave the remaining events looking like a genuine short visit, complete with a bounce that never happened.