nginx log analyzer for multiple sites
The nginx log analyzer that knows a real Googlebot from a fake one.
Trafficsort reads your nginx access logs and labels every request as human, search engine, AI crawler, scanner or fake bot. One dashboard for up to 20 sites. No JavaScript snippet, no CDN needed.
Open-source agent. Visitor IPs hashed on your server. Hosted in the EU.
66.249.66.1 GET /pricing Googlebot verified (Google's IP list)203.0.113.50 GET /pricing Googlebot FAKE: IP not in Google's list198.51.100.70 GET /blog/postgres GPTBot AI training, verified192.0.2.14 GET /blog/postgres Chrome 129 browser203.0.113.200 GET /.env Chrome 129 scannerThe problem
Your analytics can't see bots.
Google Analytics and Plausible only count visitors that run JavaScript. Crawlers, scrapers and scanners skip it, so they never show up, yet they still use your bandwidth and CPU. Imperva's 2025 Bad Bot Report found automated traffic made up 51% of all web traffic in 2024.
User agents lie.
Anyone can send "Googlebot" or "GPTBot" in a request. If you allow-list Googlebot, scrapers wear its name to get in. Your logs can't tell you which ones are real.
Log tools stop at one server.
GoAccess is great on one box. With ten sites on three servers you SSH into each one, rebuild reports by hand, and still miss the crawler that started hammering a client site on Tuesday.
How it works
- 1
Install the agent.
One command on each server. It is open source, reads your nginx access logs, and hashes visitor IPs with a secret key before anything leaves the machine.
- 2
Every request gets a label.
Human, search engine, AI crawler (training, search or user fetch), scanner or fake bot. Every bot's claim is checked against the operator's published IP list or reverse DNS.
- 3
You get the answers without logging in.
A weekly digest, alerts for new bots and crawl spikes, and one dashboard for all your sites.
Features
Sorts every request
Humans, search engines, AI training crawlers, AI search crawlers, scanners and fake bots, per site. Works from logs, so it sees what JavaScript analytics miss.
Catches fake bots
Checks every Googlebot, GPTBot and ClaudeBot claim against the official IP lists. See which ones are scrapers in disguise.
Shows what bots cost
Bandwidth and requests per bot, in euros, and what each block saved you.
Blocks safely
Pick a preset like "block AI training, allow AI search". See what it would have blocked first. Every change runs nginx -t before reload, and a kill switch turns blocking off within a minute.
Keeps you informed
A weekly digest plus alerts for new crawlers, crawl spikes and fake-bot surges.
Fails safe
If Trafficsort is down or you stop paying, your current nginx policy stays exactly as it was.
nginx today. Apache, Caddy and Traefik come next, in the order the waitlist asks for them.
Check your own logs in a minute
sudo tail -n 20000 /var/log/nginx/access.logTrafficsort and GoAccess
| GoAccess | Trafficsort | |
|---|---|---|
| Price | Free, open source | €29/month for up to 20 sites (planned) |
| Where it runs | Entirely on your server | Open-source agent on your server, dashboard hosted in the EU |
| Multiple servers | One report per log or server | One dashboard across all servers and sites |
| Bot detection | By user agent, with an AI crawler category since v1.12 | User agent plus official IP lists and reverse DNS |
| Fake bots | Not detected | Flagged per bot and per IP |
| Alerts | None built in | Weekly digest, new-bot and spike alerts |
| Blocking | Not included | nginx presets with dry run and kill switch |
| Bot cost | Bandwidth per panel | Bandwidth and euros per bot, savings per change |
| Real-time terminal view | Yes, excellent | No |
Running one site and happy in the terminal? GoAccess is a great choice. Trafficsort is for when you have several sites and want the bot questions answered for you.
Full comparison: Trafficsort vs GoAccessPricing
One plan. €29/month for up to 20 sites.
What's included
- Up to 20 sites
- All features
- Hosted in the EU
Your logs stay yours
Open-source agent
The agent is open source, so you can read exactly what it sends.
Hashed visitor IPs
Visitor IPs are hashed with a secret key on your server. Raw IPs never leave it.
Hosted in the EU
Everything is hosted in the EU.
No query strings
Request paths keep no query strings unless you turn them on.
FAQ
01Do I need Cloudflare?
No. Trafficsort reads the logs nginx already writes. If you do use Cloudflare, set real_ip so your logs show visitor IPs.
02Does it replace Google Analytics or Plausible?
No. Keep them for human behaviour and conversions. Trafficsort covers everything they can't see.
03What happens if Trafficsort goes down?
Nothing on your servers. Your blocking policy stays as it was, and the agent resumes from where it stopped.
04Do you support Apache or Caddy?
Not yet. Tell us your stack on the waitlist form. The most requested one gets built next.
05Can I try it before the beta?
Yes. The free log checker runs the same classification in your browser on any log lines you paste.
Join the waitlist
Two questions, then you're in. They decide which server we support next.