Lightweight tracking

Flow of bot detection

When an incoming request is identified as a bot:

• The SDK sends a single page view event to the Sitecore Events API during middleware execution, recorded on the bot channel.
• The SDK sets the sc_bot cookie on the request and response so that subsequent middleware and server-side rendering can identify the request as bot traffic.
• Personalization is skipped, so no visitor variant is resolved and no call is made to Sitecore CDP.
• Your application's own page view is suppressed automatically, so the crawler is counted once rather than twice.

This keeps analytics data clean and reduces unnecessary overhead for bot traffic. Analytics contain a single, server-side page view for the bot request.

Your tracking components need no changes. The pageView function checks whether the current visitor is a bot before sending anything, so the page view your application would normally send is dropped for crawlers while the middleware's dedicated bot event is recorded instead.

For real visitors, the SDK tracks page views normally through the SITECORE_ANALYTICS token, as described in Plugins.

Using createBotTrackingMiddleware

To enable bot detection, add createBotTrackingMiddleware to the Express middleware chain in src/server.ts:

// src/server.ts
import express from 'express';
import { createBotTrackingMiddleware } from '@sitecore-content-sdk/angular';
import config from '../sitecore.config';

const app = express();

const middlewareMatcher = {
  excludePaths: ['/healthz', '/metrics', /\.[^/]+$/],
};

app.use(
  createBotTrackingMiddleware({
    ...config.api.edge,
    locales: config.angular.locales,
    defaultLanguage: config.defaultLanguage,
    defaultSite: config.defaultSite,
    matcher: middlewareMatcher,
  })
);

The middleware handles the following automatically:

• Detecting bots from the incoming HTTP request.
• Sending a page view event for bots to the Sitecore Events API.
• Setting the sc_bot cookie so that following middleware and the server-side render can react accordingly.

Middleware order

Register bot detection after the multisite middleware and before the redirects and personalization middleware:

import {
  createBotTrackingMiddleware,
  createMultisiteMiddleware,
  createPersonalizeMiddleware,
  createRedirectsMiddleware,
} from '@sitecore-content-sdk/angular';

app.use(createMultisiteMiddleware({ /* ... */ }));
app.use(createBotTrackingMiddleware({ /* ... */ }));
app.use(createRedirectsMiddleware({ /* ... */ }));
app.use(createPersonalizeMiddleware({ /* ... */ }));

Multisite runs first because it resolves the site the request belongs to, which the bot page view is recorded against. Bot detection must run before personalization so the personalization middleware can read the sc_bot cookie and decide whether to skip.

Requests that are skipped

Bot detection does no work for a request when any of the following applies:

• The request is an editing or preview session.
• The path does not match the configured matcher.
• Your skip predicate returns true.
• The application is running on localhost or in a development environment, unless the SITECORE_ENABLE_BOT_TRACKING environment variable is set to true.
• The request has no user-agent header.
• The user agent is not identified as a known crawler.
• The request is a browser prefetch.

For identified bot requests, the middleware awaits SDK initialization and the bot page view event before calling the next middleware, so those requests can incur additional latency. This delay does not affect non-bot requests. If detection or event reporting fails, the middleware logs the error at debug level and the request continues normally; it never blocks or fails the response.

Bot traffic and personalization

createBotTrackingMiddleware also enables the personalization middleware to skip work for crawler requests. The personalization middleware uses this out of the box: personalization is disabled for bot traffic by default and does not trigger variant resolution.

If you need personalization to run for bot requests, opt in explicitly:

app.use(
  createPersonalizeMiddleware({
    ...config.personalize,
    ...config.api.edge,
    skipForBot: false, // default: true
    // ...
  })
);

In most scenarios, keep the default behavior so that bot traffic stays inexpensive and personalization metrics remain accurate.