Who is visiting my website? What you can (and can't) see

Web analytics counts visitors without identifying them. A stranger reading your pricing page appears as a browser in a country running a device — no name, no email, no face. That's by design: browsers actively restrict cross-site identification, and privacy law in most jurisdictions treats de-anonymizing strangers as a violation, not a growth tactic.

So the reframe: 'who is visiting my website' has three answerable versions. What kind of visitors — fully answerable. Which companies — partly, for B2B traffic. Which individuals — only after they identify themselves. Each version has its own tooling.

Plenty, in aggregate. Where each visit came from — the source, down to the exact campaign if links are tagged. The path: entry page, pages read, actions taken, exit. Rough geography (country, usually city), device and browser. And with session replay, behavior itself — watching an anonymous visitor hesitate over a pricing table teaches more than most identified data would.

For most site questions this is the whole job. 'Who visits' is usually a proxy for 'are these the right people', and audience shape, sources and behavior answer that without a single name. (The raw headcount is the easy half — how to check website traffic covers it.)

The category promising more — Leadfeeder, Clearbit-style enrichment, Salespanel and dozens of similar products — works by reverse IP lookup: office networks own identifiable IP ranges, so a visit from Acme Corp's headquarters can be labeled 'Acme Corp'. That's the company, never the person, and 'someone at Acme viewed pricing three times this week' is genuinely useful signal for a sales team.

The catch: it only works when the visitor sits on a company network. Home offices, phones and coffee shops resolve to consumer ISPs — a growing majority of all traffic — so match rates run low, and the tools earn their fee only when a sales team will act on the minority of visits that do resolve.

The moment a visitor signs up, logs in or clicks a link in your email, identification becomes both possible and fair game — they've told you who they are. Mechanically it's one call: identify the user to your analytics and pass the properties you hold (name, email, plan, company), and their sessions attach to that profile instead of an anonymous counter. From then on the dashboard shows the person, with consent and a privacy policy doing the paperwork.

The interesting part is what happens to the history: everything that person did before signing up joins their profile. The twelve pricing-page visits from last month, the campaign that first brought them in, the form they abandoned and came back to finish — the whole story attaches to the person, and in tools with replays, any visit on the timeline opens as a session recording. If they browsed on a phone and signed up on a laptop, those meet in the same profile too.

Setting it up is a one-time job: when someone signs in, your site tells the analytics tool who they are — a user ID is all it takes — and everything after that is automatic (in Bigdelta it's one line in the site snippet). Nothing is inferred, bought, or looked up. The visitor introduced themselves to you, on your site; the merge just stops their earlier history from being orphaned.

This is the legitimate version of what the question is usually reaching for — knowing who the engaged visitors are. Getting there takes no surveillance, just a reason for visitors to introduce themselves: a signup, a newsletter, a demo booking.

For a creator with a newsletter, the question is which posts produce subscribers — and pageviews can't answer it, because they count page loads, not people. A popular post might bring thousands of readers and five signups; a niche post fifty readers and ten.

With pre-signup history attached to each subscriber's profile, the picture flips. You can see which articles each subscriber actually read before subscribing, how many visits it took, and which source started the journey. Did the Reddit spike produce subscribers, or just traffic? Do people subscribe on the first visit or the third? The answers come straight from the profiles of people who subscribed — their journeys started before they introduced themselves, and now that part is visible.

DTC sites live on repeat customers, and the interesting questions sit before the first order: did the buyer stumble in and check out, or visit the product page four times, read reviews, and compare pricing first? When they came back for a second order, did they go straight to the cart or browse new arrivals?

Profiles show that full timeline — anonymous research visits, first purchase, repeat visits. With billing connected, every profile also shows lifetime value and purchase history, so “this customer bought twice, is worth $240, and hasn't visited in 45 days” replaces “we have repeat customers.” Segment by revenue and work backwards: which landing pages and which traffic sources produce repeat buyers rather than one-time orders, and what do loyal customers do differently before their first purchase?

For SaaS, identification turns a statistic into an account. A trial signup's profile shows the whole pre-signup arc: which pages they read, how deep they went into docs, what brought them in. Sales can open a profile before a call and see the actual research path. Product can segment a funnel by source and see which channels produce signups that activate and stick, not just signups.

With billing connected, the same profile carries MRR and plan, and usage drops become visible before renewal. For B2B, profiles roll up into accounts by domain or account ID: “someone visited pricing” becomes “six people at Acme viewed the feature page, and two read the billing FAQ.” Seat activity shows whether a trial is one curious person or a team spreading the product — which is the difference between a long shot and an expansion candidate.

Everything described above is anonymous by default. Nobody is identified unless you choose to identify them: profiles stay anonymous and unlinked until your site sends an identifier, and you choose exactly which attributes are stored — a user ID alone is enough, and anything beyond it (an email, a plan) is up to you. Whatever tool you use, these two properties are the ones to check for before adopting it.

In Bigdelta's case: any profile can be deleted or anonymized on request, and profile data is stored on EU servers and never sold. Retention follows the plan — Forever Free keeps profile data for one year, Growth extends it to five — which matters because the best profile questions span time, like how many of last spring's subscribers are still active.

Services exist that claim to unmask anonymous visitors as individuals, matching your traffic against purchased identity graphs to return names and emails of people who never gave them. In GDPR jurisdictions that is straightforwardly unlawful; in the US it collides with state privacy laws and email rules, and the contact data arrives poisoned anyway — emailing someone because they anonymously read your pricing page generates spam reports, not pipeline.

The disclosure duties run the other way too: session recording and any identified tracking belong in the privacy policy, and replay tools should mask inputs by default.

You can't see who anonymous visitors are, and the products claiming otherwise are either company-level (legitimate, B2B, partial) or person-level (avoid). What is available covers nearly every real need: sources and behavior for anonymous traffic, company names on office-network visits, and full profiles — pre-signup history included — the moment someone signs up. Instrument those three layers and the question stops needing the forbidden answer.