How-to
The What Changed Page
Compare the current window against the one before it to see which networks, paths, countries and browsers moved, and how much of the change actually reached your origin.
Jump to section
What it answers
Every other Monitor page tells you what is happening now. What changed tells you what is different from before, and who is responsible.
It is the page to open when someone says "traffic looks odd today" and nobody yet knows why. It compares the window you have selected against the window immediately before it, then lists whatever moved most.
Reading the top card
The card at the top compares the whole storefront across both windows: total requests, the automated share, how much automation reached your origin, and the cache-hit ratio.
The two numbers to read together are automated share and cache hit. During an automation surge, cache hit usually rises, because bots concentrate on cacheable paths like product images and static assets. Read on its own that looks like an improvement. When the page sees both rise together it says so directly, because the honest reading is the opposite of the reassuring one.
Judge a window like that on automation to origin instead. That is the number that reflects work your origin actually had to do.
The movers table
Below the card, the four buttons switch what you are breaking the change down by:
| Breakdown | Answers |
|---|---|
| Network | Which networks changed how much they send |
| Path | Which parts of the storefront changed |
| Country | Where the change came from |
| Browser | Which client versions changed. Version churn concentrated on one network is a bot signature |
Rows are ranked by how much each one moved, largest change first, not by how much traffic it sends. A network that has been steadily busy all week will not appear. One that appeared overnight will be near the top.
Each row is labelled:
- New — sent nothing in the previous window
- Up / Down — moved materially in that direction
- Gone — sent nothing in the current window
The column that matters most
To origin shows how much of that row's automated traffic missed cache and reached your origin, in both windows.
This is what separates a change that costs you from one that does not. Two networks can both double their traffic. If one is served entirely from cache, your origin never notices. If the other misses cache on every request, your origin carries all of it. The request columns alone cannot tell you which is which.
A row whose To origin figure jumped is worth investigating even if its request increase was modest. A row that added far more requests but barely moved To origin usually is not.
Small movements are filtered out
A key has to move by a minimum amount to appear at all, scaled to the size of your traffic in the window. Without that floor, something going from two requests to forty reads as a nineteen-hundred percent increase and pushes real movements off the page.
The footer tells you what that floor was and how many movers were found in total, so nothing is quietly hidden.
When nothing moved
If no key cleared the floor, the page says so. A quiet window is a real answer, and worth knowing when you are checking whether something you did earlier had an effect.
Related
- Reading the Offenders page ranks networks by what they are costing you right now
- The ASN Detail page breaks a single network down once you have picked one out