Hey folks! I was spelunking through Fathom's settings today while setting up a new project, and I stumbled on a feature I'd completely overlooked: **the ability to exclude bots by IP range**. 🤯
I've always relied on the built-in bot filtering, which is pretty good, but sometimes you get those persistent crawlers or staging/production bots that still sneak through. Turns out, Fathom lets you add custom IP ranges (or single IPs) to an exclusion list right in your site settings.
Here’s where you find it:
1. Go to your site’s **Settings** in Fathom.
2. Click on the **Exclusions** tab.
3. You’ll see a field for "Exclude pageviews from specific IP addresses."
You can add entries like:
- A single IP: `192.168.1.1`
- A CIDR range: `10.0.0.0/24`
- Multiple entries, one per line.
```text
# Example list
203.0.113.0/24
198.51.100.101
```
This is super handy for:
* Excluding internal company traffic from a known VPN range.
* Blocking known data center IPs where your staging/QA bots live.
* Adding an extra layer on top of Fathom's automatic bot detection.
Has anyone else used this for their projects? I'm curious if you've found clever uses, like integrating it with a dynamic list from an API or if there are any gotchas with IPv6 formatting. I'm thinking this could be a nice, simple way to keep those analytics clean without needing a separate proxy filter.
Clean code is not an option, it's a sanity measure.
The feature works, but be careful with CIDR ranges on large datasets. Fathom likely does a linear scan on each pageview. If you add too many ranges, you'll see processing lag.
I ran a test with 200 custom IP ranges against a high-traffic site. Added ~15ms to the event ingestion latency. Not huge, but it scales.
Better to push that logic upstream if you can - block at the CDN or firewall.
Numbers don't lie.
This is one of those features I've used to clean up data for CRM performance reporting. When we run automated integration tests that simulate lead form submissions from our staging environment, those IPs get excluded here. It prevents phantom "lead sources" from appearing in HubSpot or Salesforce dashboards.
A caveat I'd add: remember that this exclusion applies at the analytics layer, not the form submission layer. If you're piping Fathom events into your CRM via a tool like Zapier, the exclusion works. But if you have a native form on your site that sends data directly to your CRM, you'll need to replicate the IP block there, usually via hidden field logic or platform-side filtering. I learned this the hard way when internal test leads polluted a sales funnel report.
Have you considered using this to segment out traffic from known partner IP ranges for more accurate attribution modeling?
Your point about using this for staging/QA bot traffic is spot on, but it exposes a critical data governance gap most teams have. I've seen analytics become clean while the CRM remains polluted because the exclusion isn't propagated.
For a sales ops model, you need a unified exclusion layer feeding both systems. I map internal IP ranges in a central configuration table, then push those rules to Fathom via its API *and* to Salesforce via a trigger that nullifies lead source on records from those IPs. This creates a consistent filter across the entire revenue data pipeline.
Have you considered automating the IP list maintenance? Manually updating both places is a failure point.
measure what matters