Data Integrity

Fusionaly blocks fake events, bots, and spoofing attempts. It does this on your server. The code is open source, so you can check how it works.

Browser-Only Validation

Every event must come from a real browser. There are no exceptions.

How It Works

Fusionaly runs three checks. All three must pass:

1. Sec-Fetch-Site header: Browsers include this automatically. Fusionaly rejects requests without it.
2. Valid header value: The value must match a real browser value (same-origin, same-site, cross-site, or none). Fusionaly rejects fake values.
3. Origin or Referer header: Browsers always send at least one of these on POST requests. Fusionaly rejects the request if both are missing.

What Gets Blocked

Request Type	Blocked?	Why
curl/wget	✅	No Sec-Fetch-Site header
Postman/Insomnia	✅	No Sec-Fetch-Site header
Backend HTTP clients	✅	Missing browser headers
Forged headers	✅	Invalid values
Real browsers	❌	Pass all checks

Why This Works

The Sec-Fetch-* headers are forbidden headers. JavaScript cannot set or change them. Only the browser can set them. Backend clients do not send them at all.

This makes spoofing hard:

# Rejected: missing headers
curl -X POST https://your-site.com/x/api/v1/events \
  -d '{"url": "https://fake-page.com"}'

# Also rejected: missing Origin/Referer
curl -X POST https://your-site.com/x/api/v1/events \
  -H "Sec-Fetch-Site: cross-site" \
  -d '{"url": "https://fake-page.com"}'

Bot Filtering

User-Agent analysis filters known bots and crawlers, for example Googlebot, bingbot, and headless browsers.

For stronger protection, put Cloudflare in front of your instance. Cloudflare’s bot detection catches sophisticated bots that User-Agent checks miss.

Rate Limiting

Fusionaly allows 100 requests per minute, per IP address. This blocks:

• Denial of service attempts
• Automated probing
• Runaway client loops

How It Fits Together

Request → Rate Limit → Browser Check → Bot Filter → Store
              ↓              ↓              ↓
           503 error     403 error       Ignored

Each layer catches a different kind of attack. Together, they let only real browser events reach your database.

Open Source

Unlike cloud analytics with proprietary filtering, everything here is:

• Auditable: read the code
• Configurable: adjust it to your needs
• Local: runs on your server, with no external calls