More honest traffic numbers: measuring past your plan limit, and counting the real visitor

Why this post exists

This is an operator-side transparency post about two changes to how we measure your traffic — both in a direction that makes the numbers more honest.

Analytics is only useful if you can trust it under the two conditions where it matters most: when your traffic is growing faster than expected, and when you are trying to tell a real visitor apart from automated traffic. Both of those depend on unglamorous properties — keep counting even past the plan limit, and attribute each visit to the actual visitor. We improved both. Neither is a flashy feature; both change what you can rely on when you look at your dashboard.

Your numbers don't go dark at the plan limit

Every plan includes a monthly allowance of verified visits. The question is what should happen when your traffic exceeds it.

The old answer was a hard stop: once you hit the limit, measurement stopped. The intent was reasonable — limits are how plans stay sustainable — but the side-effect was bad for exactly the customers doing well. The moment your traffic spiked past the allowance, your dashboard stopped reflecting reality. Worse, a measurement that simply stops can look indistinguishable from a traffic drop: you cannot tell from the chart whether interest fell off a cliff or whether you quietly hit a ceiling.

We changed this to a soft approach. When your traffic goes past the plan limit, we keep measuring it — up to a generous multiple of your allowance — rather than going dark at the line. Over-limit visits are still recorded and still shown to you. The result is that growth stays visible: you can watch your traffic climb past your current plan, see how far past it you are, and make an upgrade decision based on real numbers instead of a blackout.

Why a measurement blackout is worse than it sounds

It is tempting to treat a usage cap as a billing detail. In an analytics product it is more than that, because the cap sits directly on top of the thing the product exists to show you.

A blackout hides the exact signal you most need at the exact moment you need it. The growth spike that would justify moving up a plan is the same event a hard cap erases from view. And because a stopped counter and a real decline produce the same flat line, a blackout does not just remove information — it can actively mislead, prompting the wrong conclusion about your own audience.

Soft measurement removes that ambiguity. An analytics tool that silently stops counting at a threshold is, in a quiet way, telling you something untrue about your traffic. Keeping the meter running — and being transparent that there is still an upper ceiling protecting the service — is the more honest design, and it is the one that actually helps you decide what to do next.

Geography read from the real visitor, not the edge

The second change is about who a visit is attributed to.

Modern web traffic almost always passes through delivery infrastructure — a content-delivery layer that sits in front of a site to make it fast and resilient — before it reaches the origin service. If you are not careful about how you read a visitor's network address, you can end up measuring that delivery layer instead of the visitor: country, region, and network-level signals all collapse toward wherever the edge is, and every visitor starts to look like it came from the same place.

We corrected this so that the signals we derive from a visitor's network address are computed from the real visitor, not from the delivery edge in front of us. In practice that means your country and region breakdowns reflect where your audience actually is, and the network-level signals we use to separate genuine people from datacenter-origin automated traffic are based on the visitor's true address. Attribution gets more accurate, and the human-versus-automated picture gets sharper, because both are now reading the right input.

What this changes in your dashboard

Taken together, the two changes show up in concrete ways:

• Country and region breakdowns reflect your real audience, rather than concentrating on the location of the delivery layer.
• The human-versus-automated picture is sharper, because the network-origin signals that help flag datacenter-based automated traffic now read the visitor's real address.
• Growth past your plan limit stays visible, up to a generous ceiling, so an upgrade decision is grounded in numbers rather than a sudden flat line.

A note on privacy, because it always applies here: this is a change in what we measure and how accurately, not a change in what we keep. Visitor addresses remain minimised and are never stored in raw form — reading the right address to derive a country signal does not mean retaining that address. Measuring more honestly and retaining less are not in tension, and we hold both.

Why we're publishing this

EU buyers evaluating an analytics vendor are right to ask two questions that these changes answer directly: Can I trust the numbers when my traffic is under stress? and Are the numbers accurate at the source? A tool that goes blind at the plan limit fails the first; a tool that attributes every visitor to a delivery edge fails the second. Both are correctness properties, not features — and honest measurement is something a buyer should be able to verify, not just be promised.

What this is not

• Not unlimited measurement. Over-limit traffic is measured up to a generous ceiling, not forever — a soft cap still protects the service. The point is that you can see your growth and decide, instead of hitting a wall with no warning.
• Not a change to what we retain. We now measure more honestly; we do not keep more about your visitors. The data-minimisation posture is unchanged — accurate attribution and raw-address minimisation hold at the same time.
• Not a description of internals. We have kept this to the customer-visible behaviour. The exact ceiling and the mechanics of how we separate real people from automated traffic are not published, deliberately — the right transparency here is what changes for you, which is what this post is about.

Reference points

• See your current allowance and how plans scale on the pricing page.
• Our DPIA describes the categories of data we process and how visitor identifiers are minimised.

---

HumanKey is an EU-based, GDPR-native analytics platform for publishers and e-commerce sites. Operator transparency posts cover the engineering and compliance choices behind what your dashboard shows. This post reflects our operational practice and is not legal advice.

If you are evaluating HumanKey for your traffic intelligence stack, the free trial takes under two minutes to install, no credit card required.