Rybbit vs Google Analytics

Notice the last two rows. Rybbit shows you the bots it blocked and GA4 never does, but both count agentic browsers as people.

Rybbit has shipped 35 releases since May 2025 (releases), so a lot of what you'll read about it is out of date, including some of its own pages. Here's what we found on 13 October 2026.

Notice that four of the seven claims come from Rybbit's own pages.

Our read: check the date on anything you read about Rybbit, this page included.

How Rybbit decides. Five checks run on every request: the user agent (the isbot list plus Rybbit's own patterns), the headers, signals its script collects in the browser, the network the request comes from, and the request rate. One blocking match makes it a bot. Bots stay out of your reports and your bill, and they're stored apart so you can inspect them. A hosting network alone isn't enough to call a visit a bot; known AI and scanner networks are (bot detection).

The browser checks look for automation flags, odd window sizes, a missing Chrome object, a software graphics renderer and an empty plugin list (code). Since August 2026, detection also runs when a site turns blocking off, and those records are kept 30 days (#1123).

What the report shows. The Bots page arrived with Bot blocking v2 in v2.7.0, on 7 July 2026 (release). Version 2.9.0, on 12 September, added an AI and agents view. It lists each bot by name and operator, sorts them into AI training, AI search and AI agent, and sets pages read against visits sent back (#1147, release). Bots recorded before then show as Unnamed. On self-hosted installs the page works but has no menu link yet; you reach it by typing its address (#1295, #1105).

What it can't see. Rybbit names two blind spots itself. The first is crawlers that fetch pages without running JavaScript, which never reach the script. Most AI training crawlers work that way, so if you want them counted, you forward them from your server or edge (bot detection).

The second is agentic browsers: ChatGPT Atlas, Perplexity Comet and Claude for Chrome. They run in a real browser, and Rybbit counts them as ordinary people, on purpose. Adding their names to the block list would delete the human-driven sessions behind them, and Rybbit's pull request calls this the largest remaining blind spot. Web Bot Auth, the signature some agents send, was left out of that work too (#1147).

In our lab. The agent-style visitor, a real Chrome that clicks without moving the mouse, stands for that kind of agent. Rybbit's script sent it like any visit. What Rybbit's server would have decided we can't see, because the lab answered every request itself. Headless Chrome as shipped reports an 800 by 600 screen, a size Rybbit's docs list among default automation viewports (bot detection), so its server would likely flag that visitor. The person and both disguised visitors reported a normal 1440 by 900 laptop screen.

What users report. Mistakes go both ways. With blocking on, one user saw 51 Rybbit users against 18 in GA4 and 2 in Clarity, mostly one-page, zero-second Direct visits from rotating countries (#1264, open). After v2.5.0, real Android WebView visitors were filtered as bots (#971, closed).

Google Analytics 4 drops known bots using Google's research and the IAB spiders and bots list. The filter is always on, you can't turn it off, and you never see how many it removed (Google). Its AI Assistant channel, since 13 May 2026, groups visits referred by ChatGPT, Gemini, Claude and others (Google), as Rybbit's AI channel does (Rybbit). Agentic browsers show up in GA4 as ordinary Chrome, often as Direct (MarTech).

Nora keeps every page view and labels it: a person, an AI agent or a bot, with the test that caught it. The tests are a signature check (Web Bot Auth), the name it gives, how it behaves, and machine signs. In our lab it labelled the as-shipped browser a bot and the agent-style click an AI agent. The disguised browser that never touched the page passed as a person, as it did everywhere.

Our read: a report of what was blocked, and which check caught it, is the right default, and GA4 gives you nothing like it. Counting agentic browsers as people is a fair choice too, as long as you know that's what your people count includes.

Crawlers such as GPTBot that run no scripts reach none of the three scripts. Rybbit documents forwarding them from your server or edge; Nora needs server or CDN logs, which aren't connected yet.

We installed each tool alone on a test page and opened it in Chrome four ways: as a person who moves the mouse and scrolls, and as three kinds of bot. One announces it's automated. One hides that. One clicks without moving the mouse, the way AI agents click.

Start with weight. Rybbit's own figure, about 11 KB against about 150 KB for GA4, matches what we measured (Rybbit). Rybbit is heavier than Umami's 2.3 KB or Nora's 2.7 KB; it carries the browser checks for its bot detection, among other things. Session replay, off by default, adds a separate recorder built on rrweb (replay.js, defaults).

Then the requests. Rybbit made 2 requests per page view: it fetches the site's settings, then sends the page view. GA4 made 2 requests, one of them as the visitor left.

Notice the cookie row. GA4 left _ga and _ga_<property>, each for 400 days, which is Chrome's limit; Google sets two years. Rybbit's hosted script left nothing, and so did Nora.

Self-hosters should check their version, though. Tagged releases from v2.7.0 through v2.9.1 write a visitor ID to localStorage on every page, even without feature flags. The fix is on Rybbit's main branch and on its cloud, but no tagged release has it yet (#1221, open).

Ad blockers stop GA4 but, for now, not Rybbit. EasyPrivacy, the list most of them use, blocks GA4's tag. It has a rule for rybbit.com, but Rybbit's script and page views go to app.rybbit.io, and no rule covers that host (version 202610140311, EasyPrivacy). A self-hosted Rybbit on your own domain matched no rule either. Nora isn't on it.

Now the bot rows. Rybbit's script sent a page view for all three, with the browser signals its server scores. GA4 sent a page view for every visitor and filters known bots later, on its servers. Nora labelled two of the three; the section above says what that means.

Notice the first two rows. Rybbit's smallest tier is 100,000 events, so a site with 10,000 page views pays the same $19.

Standard ($19 at 100k, $69 at 1M) covers 5 sites and 3 people and keeps data 3 years. Pro ($39 and $139) adds session replay, unlimited sites and people, and 5 years of data. Paying yearly costs eight months, so Standard at 100k comes to $152 a year (pricing). The API allows 5,000 requests a day on Standard and 25,000 on Pro (code).

The trial lasts 7 days, and Rybbit's own comparison says your card is charged when it ends (Rybbit).

The unit is events. Page views and custom events count from the start. Web vitals, outbound links, button clicks, copies and form events count once you turn them on (code, autocapture). A site that switches all of them on can use several events per page view. Bots that Rybbit blocks aren't billed, and imported events count toward the limit (bot detection, Rybbit).

Self-hosting is free, with replay and imports included (self-hosted vs Cloud). And note that Nora counts visitors, where Rybbit counts events.

Count the rows: besides Rybbit itself, that's four services on your machine.

Rybbit asks for a VPS with at least 2 GB of RAM, a domain with HTTPS, and on ARM at least ARMv8.2-A (self-hosting). It puts setup at 30 to 120 minutes and upkeep at regular updates (self-hosted vs Cloud). By its own description, Umami is one Node.js app and a PostgreSQL database, while Rybbit is a Docker Compose stack built around ClickHouse (Rybbit). We haven't measured either under load.

Here's what self-hosters run into.

• Shifted timestamps. v2.9.0 and v2.9.1 stored shifted timestamps when ClickHouse wasn't set to UTC, and the fix is manual (docs).
• Coolify. Getting it running behind Coolify has tripped people up (#608, open).
• Cloud-only parts. Email reports and the Pages view are cloud-only, and Search Console needs your own Google OAuth credentials (self-hosted vs Cloud).
• Hidden menu links. The Bots, Pages and Web Vitals links are still hidden in the self-hosted menu (#1295).

Replays are kept 30 days by default (docs).

• Visitor ID. A hash of the IP address and user agent. Daily salting is off unless you turn it on (code). Rybbit's own settings page says the unsalted hash may be considered personal data under the GDPR. It adds that with salting on, a visitor resets every day and the retention report becomes close to useless (settings). An open issue argues that hashing the IP address and browser only pseudonymises them, so the result is still personal data (#714).
• Re-linking. Since v2.8.0, a visitor whose IP address changes mid-visit is matched back to their earlier identity by fingerprint (release).
• IP addresses aren't stored by default (code).
• Feature flags store a visitor ID in localStorage, and Rybbit tells sites with EU visitors to treat it like a cookie (feature flags).
• Banner. Rybbit says no consent banner is needed (Rybbit). GA4 sets two cookies, and Google requires consent from visitors in the EEA, the UK and Switzerland (Google). Nora sets no cookies and stores nothing in the browser.

Expect Rybbit to show more. In a two-week test on one developer's blog that Rybbit sponsored, Rybbit logged 795 page views and GA4 242, with no split for bots (Tsykin). Four things drive a gap like that.

• Consent. In the EEA, the UK and Switzerland, GA4 needs consent to set its cookies, and visitors who decline go uncounted or estimated. Google models them only once a site has 1,000 declined events a day for a week and 1,000 consenting users a day. In one study, GA missed 55.6% of visits when a banner was shown (Orbit Media).
• Blocking. EasyPrivacy blocks GA4 and, today, not Rybbit. So every visitor with a common blocker is in Rybbit's count and missing from GA4's.
• What a visitor is. With salting off, Rybbit keeps one visitor for as long as the IP address and browser stay the same. GA4 keeps one user per cookie for up to 400 days in Chrome. A phone that changes network is one GA4 user and, unless the fingerprint re-link catches it, a new Rybbit visitor.
• Bots. Each tool drops different bots. Rybbit shows you what it blocked; GA4 never does. On the first site running Nora, 3.3% of the page views its script saw over nine days in October 2026 were bots or AI agents.

Where GA4 is ahead

• Google Ads. Import conversions, build audiences, report spend against results.
• Ecommerce revenue reports. Rybbit has none; an order value can only travel as an event property (Rybbit).
• Raw data. A free daily export to BigQuery, up to 1 million events a day (Google). Rybbit's raw events come through a paginated API (Rybbit).
• Age, gender and interests, though small reports are hidden by thresholds.
• Free at any volume, from a product that has run since 2005.

Where Rybbit is ahead

• Replays and more. Session replay, funnels, journeys, error tracking and web vitals in one tool. GA4 has no replay.
• A Bots report that shows what was blocked and which check caught it. GA4 shows nothing of the kind.
• No cookies, and data on Hetzner in Germany and Finland (subprocessors).
• Open source and self-hostable, with replay included at no cost.
• Feature flags, and an MCP server with 44 tools for AI assistants, write access included (Rybbit).
• Data kept 3 or 5 years. GA4 keeps the event-level data behind its explorations 2 or 14 months (Google).

From each maker's pages on 13 October 2026. Rybbit's replay needs Pro on Cloud; Search Console and email reports are Cloud features.

We read reviews and threads from the past two years. The same few things come up again and again. Here they are, in our words, with links to where people said them.

1. Keep your history in Google. Rybbit imports from Umami, Simple Analytics and Plausible only (import). Leave GA4 open or export it to BigQuery, as Rybbit itself suggests (Rybbit).
2. Plan a longer test than the trial. Seven days is too short to compare weekday with weekday. Pay for a month, or run a self-hosted copy beside GA4 for two to four weeks.
3. Decide on salting first. Turn it on later and visitors are counted differently from that day.
4. Rebuild goals and funnels. Turn on only the autocapture events you need; each one is billed.
5. Keep Google's tag for Ads if you buy Google Ads and rely on its conversions.
6. Connect Search Console in Rybbit Cloud, or set up Google OAuth if you self-host.
7. Remove GA4, then check whether your cookie banner still has anything to ask about.

Work began in January 2025 (Rybbit). Version 0.1.0 came out on 5 May 2025 and v2.9.0 on 12 September 2026, about two releases a month (releases). The repository had 13,114 stars on 13 October 2026 (GitHub), and one developer wrote about three quarters of the commits (contributors).

The company is Tomato.gg LLC in Troy, Michigan (Rybbit). A third-party tracker that reads its payment records shows $11,872 of revenue in the 30 days to 13 October 2026 (TrustMRR). The code is public under the AGPL (licence), so it would stay available to run whatever happens to the company.

Google Analytics has run since 2005. Nora is younger than either: it launches on 1 November 2026.

Our read: a tool this young, written mostly by one developer, changes fast, and so does what's true about it. The AGPL keeps the code in reach, but if the company stopped, running it would be up to you.

Nora is for you if you want a simple, cookieless dashboard for free and need to know which visits are people. It's free up to 1 million visitors a month, weighs 2.7 KB, and labels every page view person, AI agent or bot, with the test that caught it. That includes the kind of agent-driven visit that Rybbit, by its own choice, counts as a person. You also get live visitors, pages, sources (AI assistants among them), countries, goals, a weekly email and CSV export.

Rybbit beats Nora on a lot. It has session replay, funnels, journeys, feature flags and error tracking; Nora has no funnels, heatmaps or recordings. Rybbit is open source, can be self-hosted and keeps data in the EU; Nora is closed, hosted only, in the US, and can't import data. Rybbit can count crawlers forwarded from your server today. And Rybbit has a year and a half of releases, while Nora launches on 1 November 2026. If any of that matters to you, Rybbit is the better pick.

Nora Lab, the research team at Nora Analytics, ran every test on this page the same way for each tool. Here is exactly how, so you can judge the results yourself.

The full method, with what each visitor stands for, is on How we test. Every result from the lab run is public as JSON.