Threat score and threshold
Every visit scores 0–100. Visits at or above your threat threshold — 70 by default — are blocked. A score of 86 or higher results in a permanent block; lower scores block temporarily. Lowering the threshold blocks more traffic and risks catching real visitors; raising it does the opposite.
The threat score is the single number that drives automatic blocking. Everything the detection engine observes about a visit is condensed into it.
How the score maps to action
| Score | What happens |
|---|---|
| Below your threshold | No action — the visitor is treated as legitimate |
| At or above your threshold (default 70) | Blocked temporarily |
| 86 or higher | Blocked permanently |
The threshold is set per website in Settings → Protection. The default of 70 suits most accounts and is where we recommend starting.
When to change it
- Lower it (more aggressive)
- If you are still seeing obvious fraud get through and your conversion rate is healthy. The trade-off is a higher chance of blocking a real customer.
- Raise it (more conservative)
- If legitimate customers are reporting they cannot reach your site, or your industry naturally produces low-engagement visits that look like bounces.
Change one thing at a time
Move the threshold in steps of five or ten and give each change a few days of real traffic before judging it. Changing the threshold, the blocking mode and the click-frequency rules at once leaves you unable to tell which one did what.
Let your industry set the starting point
Rather than guessing, apply an industry profile — it sets the threshold, blocking mode, enforcement and duration to values tuned for your sector in one click. See Industry profiles.
Blocking a real customer is recoverable
If you run ConversionOS, a blocked visitor who later converts is rolled back out of your exclusion lists automatically and the conversion is credited. See What ConversionOS is.
Frequently asked questions
What is the safest threshold to start at?
The default of 70. It is deliberately set where most accounts get strong protection without meaningful false positives.
Does a permanent block last forever?
It persists rather than expiring on a timer, but you can unblock any person or IP manually at any time, individually or in bulk.
Related articles
Automatic blocking
Turn detection into action — how auto-blocking works, what it does on each platform, and how long blocks last.
Industry profiles
Apply blocking rules and risk benchmarks tuned to your sector in one click, using pre-built profiles covering 42 industries.
How detection works
Person-based fraud detection: fingerprinting, identity clustering across IPs and devices, and the 150+ behavioural signals behind every threat score.