Browsing site with VPN gets events dropped

[raulrpearson]

Past Issues Searched

• [X] I have searched open and closed issues to make sure that the bug has not yet been reported

Issue is a Bug Report

• [X] This is a bug report and not a feature request, nor asking for self-hosted support

Using official Plausible Cloud hosting or self-hosting?

Plausible Cloud from plausible.io

Describe the bug

My visits are not counted when using a commercial VPN (Mullvad in my case). I checked the event POST and it runs correctly but returns with an x-plausible-dropped header value of 1. If I disconnect from the VPN, my visit appears.

Expected behavior

Events from real users behind VPNs should not be dropped.

Screenshots

No response

Environment

- OS: N/A
- Browser: N/A
- Browser Version: N/A

[Le0Developer]

See the Bot Filtering section in the README: https://github.com/plausible/analytics?tab=readme-ov-file#can-plausible-analytics-be-self-hosted

Advanced bot filtering for more accurate stats. Our algorithm detects and excludes non-human traffic patterns. We also exclude known bots by the User-Agent header and filter out traffic from data centers and referrer spam domains.

Since VPNs use data centers for their proxying, you get dropped as bot.

[raulrpearson]

Thanks, @Le0Developer, my point is that real users sometimes use VPNs and categorizing those as bots leads to less accurate stats, specially as VPNs become more popular. Maybe better heuristics can be developed.

[ukutaht]

Thanks for the report @raulrpearson. I agree that VPN users should be counted and this is being worked on: https://github.com/plausible/analytics/pull/3766

We'll create a special country entry for VPN users since the actual location of the visitor is unknown.

[metmarkosaric]

this is now done! visitors that use VPNs are now grouped under the "Anonymous VPN Service" entry in the Countries report

[antoinemacia]

Hello @metmarkosaric @ukutaht

Just checking, would all the custom scripts be updated to catch VPN users?

We're using the combination https://plausible.io/js/script.manual.local.js which we proxy, but we seem to drop them as well, unless there's something we'd need to do when doing the manual scripting?

Thanks!

[metmarkosaric]

@antoinemacia hey! yes, all of our script extensions are covered by this.

If you have a proxy, you should make sure to set the value of X-Forwarded-For header with the actual user's IP address. See the events API page for more information on header requirements and for debugging https://plausible.io/docs/events-api#request-headers

[antoinemacia]

OK great, re header we're just following this so we should be good, it must be something else..