Everyone measures how much traffic their filtering blocked. Almost nobody measures how many real customers it turned away, because that number is invisible—blocked buyers do not send a complaint, they just go elsewhere. This is how to find and manage the number you cannot see.
The cost asymmetry nobody models
Filtering decisions produce two kinds of error, and they are not equally expensive.
A false negative lets a bot through. You lose the cost of one click, plus a little analytics pollution. It is a real cost and it is bounded.
A false positive blocks a real customer. You lose the click you already paid for, the order they would have placed, their lifetime value, and whatever they tell other people about a site that would not load for them. It is unbounded, and it never appears in a report.
Because only one of these is visible in the dashboard, teams systematically over-tune toward blocking. The metric that improves is the one they can see.
If your average order is worth 60× a click, then blocking one genuine buyer costs more than letting sixty bots through. Filtering that is too aggressive can destroy more value than the fraud it prevents.
Where false positives come from
The same populations get caught over and over:
- Corporate networks. Enterprise egress can look like datacenter traffic, TLS-inspecting proxies rewrite handshakes, and hundreds of employees share an address.
- Privacy-conscious users. VPNs, tracker blockers, and anti-fingerprinting browsers deliberately produce the anomalies your rules look for.
- Mobile users behind carrier NAT. Thousands of subscribers share one address, so per-IP rate limits fire on ordinary usage.
- Older or unusual devices. Ageing hardware and niche browsers render in ways that do not match current fingerprint expectations.
- Accessibility tooling. Screen readers and automation-assisted input can resemble scripted interaction.
- Travellers. Geography, timezone, and language legitimately disagree while someone is abroad.
Measuring a rate you cannot observe directly
You have no ground truth—blocked visitors never convert, so you cannot know what they would have done. Several techniques get you a usable estimate anyway.
- Holdout sampling. Allow a small random percentage of traffic that your rules would have blocked, and track it through to conversion. If that cohort converts at anywhere near your normal rate, your rules are catching customers. This is the single most valuable measurement available and costs only the fraud in the holdout.
- Block-reason analysis. Break blocks down by triggering rule. A rule accounting for a large share of blocks deserves scrutiny; broad rules catch broadly.
- Segment comparison. Compare block rates across geographies, devices, and campaigns. A block rate that is dramatically higher on mobile, or in one country, usually indicates a rule interacting badly with that segment rather than concentrated fraud.
- Support signal mining. Search tickets for “page won’t load”, “blank page”, or “access denied”. Every such ticket represents many people who did not bother writing in.
- Repeat-customer checks. Track whether anyone with prior successful orders is now being blocked. That should be approximately never, and it is easy to alert on.
Stop choosing between allow and block
Most false positive pain comes from treating filtering as binary. A graduated response preserves revenue from ambiguous visitors:
- Allow and log. For mild anomalies. You gather evidence without cost.
- Allow with reduced privilege. Serve the page, but require additional verification for the risky action—checkout, signup, or download.
- Interstitial challenge. A small human-verification step. Friction for genuine users, a real obstacle for cheap automation.
- Route elsewhere. Send suspected non-customers to a generic page rather than refusing them, which reveals less about your filtering.
- Hard block. Reserved for unambiguous cases: known automation frameworks, declared crawlers on paid pages, confirmed abusive infrastructure.
The middle options are where the value is. They convert a decision you might get wrong into a small cost you can absorb.
A tuning loop that converges
Set a review cadence and stick to it. Weekly works for most advertisers.
- Pull block volume by rule and by segment.
- Check the holdout cohort’s conversion rate against baseline.
- Investigate any rule whose share of blocks moved sharply.
- Adjust one thing at a time, so the next week’s data is interpretable.
- Record what you changed and why. Six months on, nobody remembers why a threshold is set where it is.
Allowlists are legitimate
There is no prize for filtering purity. Maintain explicit allowlists for known-good populations: your office egress, your monitoring and uptime services, partner integrations, and customers who have already transacted successfully. Reviewing them periodically costs little and prevents an entire class of embarrassing outages.
Takeaways
- False negatives cost one click; false positives cost a customer—and only one of them shows up in your dashboard.
- A holdout sample of would-be-blocked traffic is the only reliable way to estimate your false positive rate.
- Corporate networks, privacy tools, and carrier NAT generate most wrongful blocks.
- Graduated responses beat allow-or-block; reserve hard blocks for unambiguous cases.
- Tune on a fixed cadence, change one variable at a time, and write down why.
See it on your own traffic
MaxGuard scores every visit against IP intelligence, device and behavioural signals, then blocks, routes, or allows it by your rules.
Request access