# Spam

Some traffic is obviously not a reader: the same path hit forty times in a minute, a burst of identical user agents, a visitor pattern no human would produce. The Spam page, under **Settings → Spam**, looks over the last fourteen days and shows you what it found.

It is deliberately a review queue rather than a blocklist. Automated deletion of your own data is not a decision we want to make on your behalf, so Tinylytics flags and scores, and you decide. Plenty is already stopped before it gets this far — Cloudflare, the collector's rate limits, and your own [ignore rules](/docs/analytics/ignore-hits) all sit in front of this page.

![Spam analysis](docs/spam.png)

Each suspicious group carries a score:

- **Review** (50–79)
- **High risk** (80–119)
- **Very high risk** (120+)

The score is built from signals like user-agent bursts, clustering in time, visitor patterns, how little path variety there is, and bursts arriving at the collector. If the page is empty, the last two weeks looked normal.

## What you can do

Filter by score, then delete a single row, everything currently visible, or every flagged hit at once. Deletion is permanent and there is no undo, which is the main reason to look at the hashes before you use the widest option.

**Hide very high risk hits from the dashboard** is the gentler alternative. Those hits stop affecting Overview immediately but stay in the database for two weeks before Tinylytics removes them, which gives you time to change your mind. Review and high risk hits are left entirely alone until you act on them.

As a rule of thumb: use an ignore rule when the same junk will keep arriving, and delete when you have looked at what you have and you are sure.

MCP clients can work the same queue if you would rather do this from an agent — see [MCP](/docs/mcp) and [LLM use cases](/docs/developer/llm-use-cases).