Access logs and data dashboard
What access logs show, how to read block reasons, what each dashboard chart means, and how to use samples.
Access logs are the only place to answer “who reached the landing page, who was blocked, and why.” This guide explains the log fields by group, the dashboard, and the block-sample board.
1. The access log list
The “Access logs” page shows all visits under your account, with filters:
| Filter | What it does |
|---|---|
| Search | Fuzzy search by IP, path, parameters, etc. |
| Log type | Show only a certain visit type (see below) |
| Ad | Show only records of one ad |
| Platform | Show only traffic from a platform (TikTok / Facebook, etc.) |
| Status | Show only allowed / blocked |
| Log type | Meaning |
|---|---|
| Page view | Visitor hits the ad entry (both allowed and blocked) |
| Outgoing | Redirect / outgoing action from the landing page (e.g. to checkout) |
| Incoming | Return from the outgoing address / related revisit |
2. What a single log entry shows
Each entry presents the visitor profile in groups:
Visit overview
| Field | Meaning |
|---|---|
| Time | When it happened |
| Ad | Which ad was hit |
| Domain / path | The entry |
| Referer | Which site the visitor came from |
| Page | The page ultimately shown |
Visitor identity
| Field | Meaning |
|---|---|
| IP | Visitor IP |
| Country / city | IP location |
| Timezone | IP location timezone |
Device environment
| Field | Meaning |
|---|---|
| OS / version | Operating system (e.g. Android 13) |
| Browser / version | Browser (e.g. Chrome 120) |
| Language | Browser primary language |
| Device type | Phone / desktop / tablet |
| Brand | Device brand (Apple, Samsung, etc.) |
| Visitor client type | Browser / in-app, etc. |
| Mobile app | Whether opened inside an app |
Network environment
Each entry flags its network type; whichever applies is shown: proxy, anonymous, datacenter, VPN, Tor, CDN, school, satellite, iCloud proxy.
These flags map 1:1 to the “Network” switches in rules: a flag on = this visitor belongs to that network type, and enabling the matching switch blocks them.
Tracking and source parameters
| Field | Meaning |
|---|---|
| click_id | The click ID assigned by the system |
| sub1 – sub5 | Operator parameters carried by the tracking link (see Conversion tracking) |
| UTM (5) | Source / medium / campaign / term / content |
| Platform params | Detected ad platform and parameter value |
Decision result
| Field | Meaning |
|---|---|
| Status | Allowed (landing) / blocked (safe) |
| Block reason | Dimension · mode · matched value (see next section) |
| Crawler flag | Whether detected as automated, and its name |
3. How to read block reasons
Block reasons are a “dimension · mode · matched value” triple, e.g.:
Country · not in allowlist · US→ visitor’s country isn’t US, caught by the country allowlistNetwork · datacenter · datacenter→ visitor IP is a datacenter network and the “Datacenter” switch is onCrawler · blocklist hit · Googlebot→ matched the crawler blocklistAd Verification · list hit · geoedge→ matched Ad Verification (independent of crawler)
| Mode | Meaning |
|---|---|
| Blocklist hit | Matched the blocklist of this dimension |
| Not in allowlist | An allowlist is set but the visitor isn’t in it |
| Empty value | The dimension requires a list but the visitor has no value (e.g. direct visit with empty Referer) |
Once you see the reason: go to the rules page, adjust the matching dimension’s list or switch, then re-verify with Rule Preview.
4. Re-testing a log in Rule Preview
A log entry can “run Rule Preview with this log”: the system imports the visitor profile as-is and replays the decision once.
- Use: verify “will this traffic pass / be blocked after my rule change” before editing rules
- Boundary: analysis only; never changes live rules
5. The data dashboard
The dashboard aggregates by time range (today / 3 / 7 / 15 days) and compares with the previous period:
KPI cards (with change %)
| Metric | Meaning |
|---|---|
| Total clicks | Visit clicks, change % vs previous period |
| CTR | Click-through rate = clicks / impressions |
| Block rate | Blocked / total requests |
| Suspicious rate | Share classified as proxy / VPN / datacenter / crawler, etc. |
Detailed stats
- Page views / impressions / blocked / suspicious / total requests
- Clicks by landing mode (HTML mode / short-link mode)
Conversion funnel (HTML mode)
Page view → impression → click, with load rate, CTR, and overall conversion rate. A big drop at one stage means the problem is at that stage.
24-hour trend
Hourly clicks / impressions / page views / blocked — see traffic rhythm and abnormal hours.
Traffic quality distribution
Bucketed by type: normal / proxy / VPN / datacenter / crawler / blocked. A sudden rise in proxy and datacenter share usually means rules need tightening.
Country distribution
Clicks, blocked count, and block rate per country — spot “target market collateral damage” or “where abnormal traffic comes from.”
Block-sample board
Typical samples aggregated by block reason, with 7 / 14 / 30-day windows. Each sample can open directly in Rule Preview — the shortcut for batch-diagnosing similar traffic.
6. Recommended troubleshooting path
- Check the dashboard block rate and quality distribution for overall anomalies
- Find the top reason on the block-sample board
- Open a sample in Rule Preview and confirm the cause
- Adjust the matching dimension in rules, save, re-test
- Spot-check regularly after scaling instead of only watching conversion numbers
To check a specific IP’s context on demand, use console IP Lookup (requires ops enablement).