Just built a Slack alert for traffic spikes.

Just finished integrating Fathom Analytics with our internal Slack ops channel to trigger alerts on unusual traffic patterns. It's a straightforward setup but addresses a real operational need: moving from reactive log-checking to proactive notification when something on the site changes drastically, for better or worse.

While Fathom excels at providing clean, privacy-focused dashboards, its native alerting is currently limited to weekly/monthly reports. For those of us managing infrastructure, a sudden spike or drop can mean anything from a successful marketing launch to a misconfigured CDN or even the beginnings of a DDoS probe. Here's the pragmatic solution I implemented.

I used Fathom's API to fetch the current day's pageview count and compared it to a rolling baseline (the average of the previous 7 same weekdays). If the current value deviates by a configured percentage, a message fires into Slack. This runs as a scheduled Kubernetes CronJob, keeping it serverless and within our existing ops tooling.

```yaml
# cronjob.yaml (abbreviated)
apiVersion: batch/v1
kind: CronJob
metadata:
name: fathom-traffic-alert
spec:
schedule: "*/30 * * * *" # Every 30 minutes
jobTemplate:
spec:
template:
spec:
containers:
- name: alert-script
image: python:3.11-slim
env:
- name: FATHOM_API_KEY
valueFrom: {secretKeyRef: {name: fathom-secrets, key: api-key}}
- name: SLACK_WEBHOOK_URL
valueFrom: {secretKeyRef: {name: slack-secrets, key: webhook-url}}
command: ["python", "/script/alert.py"]
```

The core logic is simple. The script fetches the data, calculates the threshold, and decides to alert.

```python
# alert.py - core logic snippet
def check_traffic_spike(current_pageviews, baseline_average, threshold_percent=50):
"""Return True and deviation percentage if threshold is exceeded."""
if baseline_average == 0:
return False, 0
deviation = ((current_pageviews - baseline_average) / baseline_average) * 100
if abs(deviation) >= threshold_percent:
return True, deviation
return False, deviation
```

**Key considerations from a deployment perspective:**

* **Cost:** This adds ~1440 API calls per day (if polling every minute). Fathom's API is generous, but monitor your usage tier.
* **Noise Reduction:** I built in a cooldown period (e.g., don't alert again for the same spike within 4 hours) by logging alert timestamps to a small Redis cache.
* **False Positives:** The baseline is critical. Excluding weekends if your business is weekday-heavy, or using a longer rolling period, might be necessary.
* **Security:** The API key needs `Site Stats` read permissions only. The webhook URL is stored as a Kubernetes Secret, never in code.

This approach gives the ops team a heads-up without requiring everyone to live in the Fathom dashboard. The next evolution is to tag alerts with the top-referring sources for that period (also available via API) to provide immediate context—was it Hacker News, a newsletter, or an unknown referrer?

The integration took about half a day to build and test. For teams needing more granular alerting (by page, by referrer, etc.), the same pattern applies, just with more specific API queries.

- Mike