Anomaly Detection

Pro

Anomaly Detection is available in Burst Statistics Pro only. Upgrade to Burst Pro

Burst Statistics Pro automatically monitors your daily visitor data and alerts you when traffic deviates significantly from your historical baseline. Anomalies appear as dismissible tasks in the Burst dashboard task list, so you can quickly spot and investigate unusual patterns without manually reviewing charts.

How It Works

Once per day, triggered by the burst_daily cron event, the anomaly detector schedules a background check that runs 2 minutes later. The check looks back up to 7 days and compares each day's visitor count against the average of the same weekday over the previous 4 weeks. This weekday-aware comparison avoids false positives caused by normal weekly traffic cycles (e.g., lower traffic on weekends).

Detection Requirements

Before an anomaly is raised, two conditions must be met:

Condition	Value	Purpose
Minimum weeks of historical data	2 weeks	Prevents false positives when the site is new
Minimum average visitors	20 visitors/day	Prevents noise on very low-traffic sites

If either condition is not met for a given day, that day is silently skipped.

Anomaly Types

Traffic Spike

Triggered when daily visitors are 200% or more of the weekday average (ratio ≥ 2.0).

A task is created with an insight icon and a link to the referrers view (#/statistics?referrers) so you can identify the traffic source.

Example message:

Traffic was unusually high on yesterday. You had around 1,240 visitors, well above your typical Monday average of 310. You may want to check your referral sources to understand the cause.

Traffic Dip

Triggered when daily visitors are 40% or less of the weekday average (ratio ≤ 0.4).

A task is created with a warning icon and a link to the statistics view (#/statistics).

Example message:

Heads up: Traffic was unusually low on last Thursday. You had about 42 visitors, a noticeable drop from your typical Thursday average of 280. It might be worth checking if your site is performing as expected.

Good Day

Triggered when daily visitors are 130% or more of the weekday average (ratio ≥ 1.3), but only for yesterday (not for older days in the lookback window). This prevents a backlog of "good day" notifications accumulating.

A task is created with a completed icon and a link to the statistics view (#/statistics).

Example message:

Nice! Traffic was above average on yesterday. You had around 520 visitors, higher than your typical Tuesday average of 380. Keep up the good work!

Thresholds Reference

Anomaly Type	Threshold	Condition
Spike	≥ 2.0× average	Visitors ≥ 200% of weekday average
Good Day	≥ 1.3× average	Visitors ≥ 130% of weekday average (yesterday only)
Dip	≤ 0.4× average	Visitors ≤ 40% of weekday average

Task Display

Up to 3 anomaly tasks are shown in the dashboard task list at any one time. When more than 3 anomalies exist, they are prioritised as follows:

Priority	Type	Icon
1 (highest)	Traffic Spike	`insight`
2	Traffic Dip	`warning`
3 (lowest)	Good Day	`completed`

Within each priority tier, the most recently detected anomalies are shown first. All anomaly tasks are dismissible.

Data Storage

Anomalies are stored in WordPress options. Each entry is keyed by date (Y-m-d) and contains:

Field	Type	Description
`visitors`	int	Actual visitor count for that day
`average_visitors`	int	Calculated weekday average at time of detection
`weekday_name`	string	Localized weekday name (e.g., "Tuesday")
`date_label`	string	Human-readable label (e.g., "yesterday", "last Tuesday")
`timestamp`	int	Unix timestamp for the anomaly date
`detected_at`	int	Unix timestamp when the anomaly was detected

Option Name	Contents
`burst_anomaly_spikes`	Array of spike anomalies keyed by date
`burst_anomaly_dips`	Array of dip anomalies keyed by date
`burst_anomaly_good_days`	Array of good day anomalies keyed by date

Automatic Cleanup

Anomalies older than 7 days (one week) are automatically removed the next time the daily check runs. When an anomaly is cleaned up, its associated dashboard task is also dismissed automatically.

Anomalies are also removed individually when you manually dismiss the task from the dashboard.

Hooks Reference

`burst_daily`

The standard Burst daily cron action. Anomaly detection hooks into this to schedule the background check job. This hook is not specific to anomaly detection but is what triggers the process.

`burst_check_for_anomalies`

WordPress action fired approximately 2 minutes after burst_daily. This is when the actual anomaly analysis runs. Scheduled as a single event (not a recurring cron) to avoid stacking checks.

Parameters: none

Example — run the anomaly check immediately (e.g., during testing):

do_action( 'burst_check_for_anomalies' );

`burst_dismiss_task`

WordPress action fired when a task is dismissed from the Burst dashboard. Anomaly detection listens to this action to remove the corresponding stored anomaly entry.

Parameters:

Parameter	Type	Description
`$task_id`	string	The ID of the dismissed task (e.g., `anomaly_traffic_spike_2026-04-05`)

`burst_tasks`

WordPress filter used to inject anomaly detection tasks into the Burst dashboard task list.

Parameters:

Parameter	Type	Description
`$tasks`	array	Existing array of task definitions

Return: array — The modified tasks array with anomaly tasks appended.

Example — remove all anomaly tasks from the task list:

add_filter( 'burst_tasks', function( array $tasks ): array {
    return array_filter( $tasks, function( $task ) {
        return strpos( $task['id'] ?? '', 'anomaly_traffic_' ) !== 0;
    } );
} );

Example — inspect the raw anomaly data before tasks are built:

add_filter( 'burst_tasks', function( array $tasks ): array {
    $spikes    = \Burst\Pro\Admin\Anomaly_Detection\Anomaly_Detection::get_spike_anomalies();
    $dips      = \Burst\Pro\Admin\Anomaly_Detection\Anomaly_Detection::get_dip_anomalies();
    $good_days = \Burst\Pro\Admin\Anomaly_Detection\Anomaly_Detection::get_good_day_anomalies();

    // $spikes, $dips, $good_days are arrays keyed by 'Y-m-d' date string.
    return $tasks;
}, 5 ); // Priority 5 runs before Burst adds the tasks at default priority.

Public Static Methods

The following static methods can be called directly to retrieve stored anomaly data: