Two questions separate these tools
“Filters bots” is on every one of these marketing pages and it settles almost nothing. Two questions do:
- What signal does it use? A user-agent list catches only automation that identifies itself. Datacenter IP ranges catch automation that hides its identity but runs in the cloud. Neither catches a stock browser on a residential address, and nothing free does.
- Does it drop or tag? A drop is gone: no count, no audit, no way to check whether the detection was right. A tag keeps the event with a marker and leaves it out of your reports, so the decision is reversible and the excluded set is measurable.
The second question is the one that separates tools with similar-sounding descriptions, and it is the one that matters when detection is wrong — which it will be, because every signal here has false positives with a known shape: people behind VPNs and corporate proxies, employees on cloud-hosted desktops, and any site routing its analytics through its own backend to get past blockers.
Google Analytics 4
Signal: the IAB/ABC International Spiders & Bots List plus Google’s own bot research, matched on user agent. Behaviour: drops, before data reaches your reports.
The filter is enabled on every property, cannot be disabled, and produces no report of what it removed. That makes it the most opaque option in this list on all three axes: you cannot tune it, audit it, or reverse it. It also targets declared crawlers, which are largely the ones that never execute a JavaScript tag in the first place — so the traffic it removes overlaps only partially with the traffic distorting your reports. Everything else you can do in GA4 (internal-traffic filters, unwanted referrals, engagement segments) is a workaround built on dimensions you set yourself.
Plausible
Signal: layered — user-agent blocking, roughly 32,000 datacenter IP ranges excluded by default, known referrer-spam domains, and detection of unnatural traffic patterns. Behaviour: excludes, with no user-facing view of what was removed.
This is among the most aggressive default filtering of any tool here, and the datacenter IP layer is the reason: it catches automation that never identifies itself, which a user-agent list structurally cannot. Plausible has published its own testing showing traffic that GA4 recorded as real being rejected outright. The trade is the one that comes with every network-based signal — visitors on cloud-hosted VPN exits and corporate proxies are in those ranges too, and there is no toggle to inspect what fell into them. If your numbers look low against another tool, this is usually why. See also our Plausible comparison.
Fathom
Signal: an extensive bot and crawler user-agent list plus known datacenter and hosting-provider IP ranges (AWS, Azure, Google Cloud, DigitalOcean and others). Behaviour: classified at ingestion and separated before the dashboard; never enters pageviews, visitor counts or events.
Structurally close to Plausible: two signals, always on, nothing to configure, continuously updated lists. The design philosophy is explicit — the dashboard shows humans, and the machinery is not your problem. That is a coherent position for a web-analytics tool, and it means the same thing as everywhere else on this list: the excluded traffic is not recoverable, so a false positive is invisible.
Matomo
Signal: DeviceDetector’s bot detection, thousands of user-agent regular expressions evaluated per tracking request, plus an optional global user-agent exclusion list you maintain. Behaviour: excluded by default, but recordable on request.
Matomo is the only tool here with a documented switch that lets bot traffic in: a tracking parameter tells it to record requests identified as bots instead of discarding them, and a marketplace plugin exists for tracking bots as a distinct report. That is closer to tagging than anything else in the drop camp, though the decision is made when the data is collected rather than when you report on it — you choose before the data exists, not after. Self-hosting means the detection runs on your server, so you can inspect exactly what it did. See our Matomo comparison.
Umami
Signal: the isbot library, matched against the user agent at the ingest endpoint.
Behaviour: the request is rejected outright and nothing is recorded.
The simplest implementation in this list and, being open source, the easiest to verify — the check is a handful of lines in the collection route. One user-agent library, no network signal, no pattern analysis. Self-hosters can disable it with an environment variable, which is a genuinely useful escape hatch if the library is misclassifying something specific to your traffic, and something none of the hosted tools offer. What you give up is everything a user-agent list cannot see: headless browsers with a stock user agent are recorded as visitors. Our Umami comparison covers the rest.
PostHog
Signal: both sides — the JavaScript SDK blocks known bots before they send anything, and the server classifies traffic by user agent and source IP against maintained bot and bot-IP definition lists. Behaviour: tags. Events are kept and left out of reports instead, with a property you can filter or break down by.
This is the fullest treatment of the group: client-side blocking to save ingest, server-side classification for everything that gets past it, and query-time filtering so nothing is lost. A configuration option turns the client-side filter off and labels the browser type instead, if you would rather capture the traffic than block it, and the transformation pipeline can drop bot events entirely for teams that prefer that. The cost of tagging is storage and, in a usage-priced product, the events you keep are events you pay for. Our PostHog comparison covers the broader trade-offs.
Pug
Signal: a maintained list of around 1,500 crawler, monitor and automation user-agent patterns, applied server-side to web SDK traffic. Behaviour: tags, never drops; excluded from every metric by default.
Two properties are written on the event as it arrives: one marking it automated, one recording which pattern matched —
HeadlessChrome, Googlebot, a named synthetic-monitoring service. Both are server-only, so
a client cannot set or clear them either way. Every insight then excludes tagged traffic by default, session
metrics judge whole sessions rather than individual hits, and profiles derived entirely from tagged activity stop
listing as people. On the raw event surfaces — live feed, event list, profiles — one control puts the traffic back
in view, and the recorded reason is something you can break down by, so the size and shape of the excluded set is a
question with an answer rather than a guess.
The limitation is the same one everyone has, stated plainly: a stock user agent from a residential address is not detectable, and Pug does not currently apply a datacenter-network signal the way Plausible and Fathom do, so automation that hides its identity but runs in the cloud will be counted as human. Deletion requests still reach tagged traffic, which matters for GDPR purposes: something classified as a bot is not thereby exempt from a data subject request.
How to choose
- If you want the cleanest default numbers with no thinking: Plausible or Fathom. Two signals, always on, aggressive. You are trusting them, and the trust is mostly warranted.
- If you need to audit or reverse the decision: PostHog or Pug. Tagging is the only approach that lets you ask how much was removed and whether it should have been.
- If you want to inspect the mechanism yourself: Umami or Matomo, self-hosted. The detection runs on your server and the code is readable.
- If you are on GA4: assume the automation reaching your reports is not being filtered, and build an engagement-based segment as your real denominator.
One last note worth more than any of the above: bot filtering is one of the largest sources of disagreement between two analytics tools running on the same site. Before you go looking for a tracking bug to explain a gap, check whether the two tools simply disagree about who counts as a visitor — and about which of your metrics that changes.