Email alerts

An email when something changes suddenly on one of your sites: traffic that drops or spikes, more visits to missing pages, a goal that stops converting, or an AI agent visiting for the first time. If you want them in Slack, Discord or your own system too, each site can also send them to a webhook. Part of Pro.

How "usual" is worked out

• Every hour, a few minutes past the hour, SimpleData looks at the last 6 complete hours of each site (24 for goals), in the site's time zone.
• It compares them with the same hours on the same weekday of the previous 4 weeks, and takes the median: a holiday, last month's outage or a post that went viral one week does not set what is usual. A Saturday is compared with Saturdays, not with a Tuesday.
• Only weeks with visits in those hours count, and at least 2 are needed. A week before the site went live, with a broken tracker or with the plan's limit reached is no reference: a launch, or a repaired tracker, is not a spike. A site added less than two weeks ago gets no traffic, 404 or goal alerts yet.
• The figures are the dashboard's: human page views (bots never count), the 404 panel, the Conversions panel and the AI traffic card. Traffic you excluded is not there either. The email links to the dashboard on exactly those hours.
• Fixed rules and the thresholds below. No AI model decides or writes anything.

The alerts and their thresholds

The sensitivity sets the thresholds of every alert of the site. Minimum volumes are what keeps a quiet site from getting an email for noise: with 20 visits a day, six hours hold a handful of page views, and no drop of a handful is news.

• 404s: if traffic rose too, the bar rises with it. Three times the visitors bringing three times the usual 404s is the same rate, and the traffic alert already says so.
• Goals: only a goal that converted at least once in the 24 hours before those 24, so a goal that stopped is one email, not one every day. Page-visit and custom-event goals alike.
• AI agents: by company (ChatGPT, Claude, Perplexity…), the first time anything from that company reaches the site, whatever it came for, and only if it came for a purpose the sensitivity counts. On a site's first two weeks every agent is new, so there are none then. Search engines such as bingbot are not AI agents and never alert. Agents are not visits: they are counted apart, in the AI traffic card.

When nothing is sent

• An account that has reached its plan's page views for the month gets no traffic, 404 or goal alerts until the month ends: SimpleData is not recording its sites, and every one of them would look like a drop. The quota emails say so already.
• If more than 30 % of the sites where a drop can be measured (and at least 5) drop at the same time, the problem is ours, not yours: no traffic, 404 or goal alert goes out for the next 6 hours (24 for goals), and our team is told instead. AI agent alerts are not affected.

How many emails

• At most one email per site and hour, with every alert of that site in it: a broken tracker on a site with five goals is one email.
• The same alert at most once a day, and a drop, a spike or more 404s that last, at most every 3 days: the previous weeks take that long to catch up.
• A goal with no conversions: one email, until it converts again and stops again.
• A new AI agent: once per agent, ever.
• If an email cannot be sent, the next hours try again, up to 3 times, even if the hours it is about have passed.

Plans

• Pro. On Free the settings page shows them, locked.
• If an account goes back to Free its alerts stop, and its settings are kept for when Pro is back.
• By email, and to a webhook if the site has one.

What the email contains

Figures, the comparison and the hours they are about, the sensitivity that applied, and links to the dashboard and to the settings. The 404 alert gives how many missing pages were visited and how many the most repeated one got, not the addresses: anyone can request a made-up address on your site, and a mail client would turn it into a link. They are on the dashboard's 404 panel, where the email's button takes you. Nothing about any visitor.

Webhook: Slack, Discord or your own server

• Each site can have one webhook: an address that gets the same alerts as the email, as a POST, at the same moment. Site settings, "Email alerts", Webhook. Pro.
• One POST per site and hour with every alert in it, exactly when the email goes out: the alerts turned off, the sensitivity, the pause when many sites drop at once, the month's limit and the account-wide switch (Settings, Emails, "Alerts") apply to both.
• Only the site's owner sets it, tests it, renews its secret or removes it. A reader of the team sees that there is one, never the address.
• On Free nothing is sent and the webhook is kept for when Pro is back; it can be removed on any plan.
• The address and the signing secret are stored encrypted. The secret is shown once, when the webhook is created or the secret renewed; a new one stops the old one at once.
• "Send a test" POSTs an example, marked as a test, and shows what your server answered: 3 a minute and 20 an hour per site.

Which addresses

• https only, on the default port (443), and a domain name: no IP address, no localhost, no user name or password in it.
• Every address the domain points to must be on the public internet: it is checked when you save it and again before every POST. Redirects are not followed.
• Delivered means any 2xx answer within 5 seconds. What your server answers in the body is not read.

Slack and Discord

• Slack: paste an incoming webhook (https://hooks.slack.com/services/…). It gets the message in text, with links in Slack's format and the dashboard's preview off.
• Discord: paste a channel webhook (https://discord.com/api/webhooks/…). It gets the message in content, 2,000 characters at most, with mentions off: nobody is pinged.
• Any other address gets the whole JSON below, which carries text (Slack's format) and content (Discord's) too. Microsoft Teams and Google Chat do not take it as it is: put Zapier, Make or n8n in between.

What is sent

A JSON object. Its keys are a promise: new ones may appear, and none is renamed or removed. An example, a traffic drop, with the links shortened:

{
  "event": "alerts",
  "id": "3f0c2a8e-5b1d-4c7a-9e2f-6d8b1a4c0e57",
  "created_at": "2026-11-03T10:07:12.345Z",
  "test": false,
  "title": "Traffic drop on shop.example",
  "language": "en",
  "sensitivity": "medium",
  "site": { "id": "1b9d6bcd-…", "domain": "shop.example", "timezone": "Europe/Madrid" },
  "alerts": [
    {
      "id": "3ce33e010436be0c13599fdd4956c266",
      "rule": "traffic_drop",
      "title": "Traffic drop",
      "period": "2026-11-03",
      "start": "2026-11-03T04:00:00.000Z",
      "end": "2026-11-03T10:00:00.000Z",
      "dashboard_url": "https://simpledata.dev/dashboard/1b9d6bcd-…?start=…&end=…",
      "summary": "On November 3, from 05:00 to 11:00 (Europe/Madrid), shop.example had 45 page views, against a median of 120 at those hours over the previous 4 weeks: 63% fewer.",
      "figures": { "pageviews": 45, "usual": 120, "weeks": 4, "change_pct": -63 }
    }
  ],
  "dashboard_url": "https://simpledata.dev/dashboard/1b9d6bcd-…?start=…&end=…",
  "settings_url": "https://simpledata.dev/dashboard/1b9d6bcd-…/settings#alerts",
  "text": "*Traffic drop on shop.example*\nOn November 3, … 63% fewer. <https://…|See it in the dashboard>\n<https://…|Alert settings>",
  "content": "**Traffic drop on shop.example**\nOn November 3, … 63% fewer. <https://…>\nAlert settings: <https://…>"
}

Headers

Checking the signature

Compute the HMAC over the body exactly as it arrived, before parsing it, and refuse signatures older than five minutes. In Node:

import crypto from 'node:crypto';

// body: the request body exactly as it arrived (a string or a Buffer), before JSON.parse.
function verifySimpleData(body, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(String(header ?? '').split(',').map((p) => p.trim().split('=')));
  const t = Number(parts.t);
  if (!Number.isInteger(t) || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${body}`).digest();
  const given = Buffer.from(parts.v1, 'hex');
  return given.length === expected.length && crypto.timingSafeEqual(given, expected);
}

// Express: keep the raw body for the check.
app.post('/simpledata', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifySimpleData(req.body, req.get('SimpleData-Signature'), process.env.SIMPLEDATA_WEBHOOK_SECRET)) {
    return res.sendStatus(401);
  }
  const { event, alerts } = JSON.parse(req.body);
  // event is "alerts" or "test"; alerts[].id is the same on a retry.
  res.sendStatus(204);
});

Slack and Discord do not check it: there, the address itself is the secret. Keep it as you would a password.

Retries

• A timeout, a connection error, a 5xx, a 408 or a 429 is retried in the next hours, 3 attempts in all, even if the hours it is about have passed. Any other 4xx (401, 404, 410…) is given up at once: your server said no.
• A redirect (3xx) is a failed delivery: it is not followed.
• The email and the webhook do not wait for each other: a failed POST is retried without sending the email again, and a bounced email without POSTing again.
• Very rarely (our server stopping halfway through a delivery) the same alert may be POSTed twice, an hour apart: alerts[].id tells you it is one you have.
• The settings page shows the result of the last delivery.

What it never carries

The same as the email: figures, hours and links, and nothing a visitor can write. No page addresses (the 404 alert gives counts), no referrers, no UTM tags. An AI agent is named only if it is on SimpleData's list, the one of the AI traffic card; a goal's name is the one you gave it, cut and escaped so that it cannot become a link or a mention in Slack or Discord. Nothing about any visitor.