Direct answer: To identify website visitors in B2B, you install a small identification script on your site, verify it fires on every page, and connect the resolved accounts to your CRM. The full setup has five steps: install and verify the script, set realistic match-rate expectations (about 47 percent of sessions resolve to a company and only about 7 percent to a named person, based on our study of 1.2 million real sessions), filter out bots and ISP noise, score and segment the identified accounts, and route the best ones to sales with alerts and a response SLA. The script is live the same day you add it, and most teams finish the whole pipeline in under a week.
Book a demo and see who is on your site today. Abmatic AI will show identification running on your own traffic, not a sample dataset.
How B2B visitor identification actually works (30-second version)
Somewhere between 95 and 98 percent of your website visitors never fill out a form. Visitor identification is the technology that tells you which companies those anonymous visitors work for, and in some cases who they are, so sales can act before the form fill that usually never comes.
Here is the whole mechanism in one paragraph. A JavaScript snippet on your site captures each session and its network signals. An identification engine matches those signals against several data layers: reverse IP lookup that maps corporate network addresses to company names, enrichment databases that add firmographics like industry and employee count, and identity graphs that can sometimes resolve an individual contact when enough first-party signal exists. The output is a stream of records that say, in effect, "someone from Acme Corp viewed your pricing page twice this week." Your job in setup is to get that stream flowing, clean it, and deliver it to the people who can do something with it.
Two terms you will see throughout this guide. Account-level identification (also called account deanonymization) resolves a session to a company. Contact-level identification resolves it to a specific person. They are different capabilities with very different hit rates, and most tools on the market only do the first one. Abmatic AI does both natively, which matters later when you route to sales. If you want the conceptual background before the hands-on steps, our primer on how to identify anonymous website visitors covers the theory in more depth.
The rest of this guide is the operational recipe: script, expectations, filters, scoring, routing. Follow the steps in order. Each one builds on the previous.
Book a demo if you would rather watch the whole pipeline get configured live on your site in one call.
Step 1: Install the identification script and verify it fires
Every visitor identification platform starts the same way: a single JavaScript tag in the head of your site. In Abmatic AI, you copy the snippet from your workspace settings and add it site-wide. There are three common install paths, and all of them take minutes, not sprints:
- Tag manager (most common). Add the snippet as a Custom HTML tag in Google Tag Manager, trigger it on All Pages, and publish. No code deploy needed, and marketing can do it without a ticket.
- Direct in the template. Paste the snippet into the global head template of your CMS (Webflow, WordPress, HubSpot CMS, Next.js layout, whatever you run). This is the most reliable path because nothing can pause or misfire the tag.
- Through a consent management platform. If you run a CMP like OneTrust or Cookiebot, register the script in the correct category so it loads according to your consent rules. Get this wrong and the script silently never fires for a chunk of your traffic, which looks like a low match rate but is actually a consent-gating problem.
Installing is the easy half. Verifying is the half teams skip, and it is where most "identification is broken" tickets come from. Run this four-point check before you move to step 2:
- Network check. Open your site in a browser, open developer tools, and confirm the script loads with a 200 status and fires its beacon on page view. Do this on your homepage, your pricing page, and at least one blog post, because tag managers often have triggers scoped tighter than anyone remembers.
- Cross-page coverage. Check a page on any subdomain you care about (docs, app login page, landing pages built in a different tool). Subdomains are the number one coverage gap.
- Live session test. Visit your own site from an office network or a known corporate VPN, then confirm the session appears in the platform within a few minutes. Abmatic AI shows sessions in near real time, so this test takes one coffee break.
- Single-page app check. If your site is a SPA, confirm the script tracks route changes, not just the initial load. Otherwise every visit looks like a one-page bounce.
Time budget for this step: 30 minutes to install, an hour to verify properly. The pixel starts capturing signal the same day, and history accrues from that moment, so install early even if the rest of your rollout is weeks away.
Book a demo and the Abmatic AI team will handle the install and verification with you during onboarding.
Step 2: Set realistic match-rate expectations (real numbers from our 2026 study)
Before you show this data to anyone, calibrate what "good" looks like, because vendor marketing has badly distorted expectations in this category. Vendors quote match rates from 30 to 70 percent, usually with no methodology attached. We measured it ourselves across 1.2 million real B2B sessions on the Abmatic AI network over 90 days and published the full results in our visitor identification match rate study. No other vendor in the category publishes its numbers this honestly, so use them as your baseline. The short version:
| Metric | What the data shows | What it means for your setup |
|---|---|---|
| Company-level match rate | About 47% of sessions by company name (51% by resolvable domain) | Roughly one in two visitors gets a company name. Half your traffic stays anonymous no matter which vendor you use. |
| Person-level match rate | About 7% of sessions | Named individuals are rare. Build your plays around accounts first, contacts second. |
| High-confidence matches | Roughly 1 in 5 company matches | Confidence tiers matter. Route only high-confidence matches to sales; use the rest for ads and personalization. |
| Range across sites | 13% to 65% depending on the site | Your traffic mix and geography drive your number. There is no single universal match rate. |
Three practical implications. First, do not promise sales a name for every visit. Promise them a steady feed of in-market accounts, which is what a 47 percent company match on real traffic delivers. Second, your number will differ from the blended average. Sites with mostly US mid-market and enterprise traffic land at the high end; sites with heavy international, mobile, or consumer-ISP traffic land lower. Remote work pushed a lot of B2B browsing onto residential networks, and no reverse IP database can resolve a home ISP address to an employer. Third, measure your own rate in week one and treat it as the baseline you improve, not a grade you pass or fail. For a deeper walkthrough of what drives the number up or down, see what match rates to expect from website visitor identification.
One more calibration point: person-level identification at 7 percent sounds small, but on a site with 20,000 monthly visitors that is still hundreds of named, warm contacts per month who never filled out a form. The teams that win with this data are the ones who priced it correctly going in.
Book a demo to see your site's actual match rate measured on live traffic instead of guessing from vendor claims.
Step 3: Filter noise: bots, ISPs, and existing customers
Raw identification output is noisy, and noise is what kills sales trust in the feed. If the first three "hot accounts" an AE sees are a scraping bot, a telecom carrier, and your own biggest customer's support team, they will stop looking by Friday. Build these filters before anyone downstream sees the data:
- Bots and crawlers. Search engine spiders, uptime monitors, SEO tools, and AI crawlers generate sessions that sometimes resolve to real-looking companies (usually cloud providers). Abmatic AI filters known bot signatures and datacenter IP ranges automatically; whatever platform you use, confirm this filter is on and spot-check a week of traffic for one-page, zero-scroll sessions from hosting companies.
- ISPs and carriers. Reverse IP lookup happily resolves a Comcast or Verizon address to Comcast or Verizon. Those are visitors on home or mobile networks, not telecom employees evaluating your product. Exclude the ISP and telecom category from anything sales sees.
- Your own company and agencies. Exclude your office IPs, your remote employees where possible, and any agency or contractor domains that browse your site all day. Internal traffic inflates every metric and occasionally embarrasses someone.
- Existing customers and open opportunities. This is a routing decision, not a deletion. A current customer reading your pricing page is a renewal or expansion signal that should go to the account owner or CS team, not to an SDR who will cold-email them. Suppress customers from prospecting alerts by syncing your CRM account list and matching on domain.
- Geography outside your market. If you sell to US, Canadian, UK, and European buyers, identified companies elsewhere are usually noise for sales even when the match is technically correct. Filter them from routing; keep them in reporting.
Expect filtering to remove a meaningful slice of your identified sessions. That is the point. A smaller, cleaner feed that sales trusts beats a bigger one they ignore. Revisit the filter set after two weeks; you will find at least one noisy source you missed on day one.
Book a demo and see how Abmatic AI applies these filters out of the box so your team starts with a clean feed on day one.
Skip the manual work
Abmatic AI runs targets, sequences, ads, meetings, and attribution autonomously. One platform replaces 9 tools.
See the demo →Step 4: Score and segment identified accounts (ICP fit plus intent pages)
After filtering you will still have far more identified companies than sales can work. Scoring turns "1,400 companies visited this month" into "these 60 deserve a human this week." The model that works is simple and two-dimensional: fit times intent.
Fit: does this account look like your ICP? Score the firmographics that identification and enrichment hand you: industry, employee count, revenue band, geography, and tech stack. A 500-person US software company scores high if that is who you sell to; a 10-person local services shop scores low no matter how many pages it reads. Keep it to four or five weighted attributes. Elaborate 20-factor models feel rigorous and change nothing.
Intent: does this account's behavior signal buying? Not all pages are equal. Weight them roughly like this:
- High intent: pricing, demo, comparison and "vs" pages, integrations, security or trust pages. A pricing visit is the single strongest signal you get; our pricing page visit playbook covers the exact play to run when it happens.
- Medium intent: product and feature pages, case studies, repeat visits within a short window, multiple people from the same company.
- Low intent: blog posts and top-of-funnel content, single short sessions. Valuable in aggregate, not alert-worthy alone.
Combine the two axes into segments and give each segment a default motion. High fit plus high intent goes to sales now (step 5). High fit plus low intent goes into ABM ads, retargeting, and personalized web experiences until the intent shows up. Low fit stays in reporting. In Abmatic AI, scoring and segmentation run on the platform's first-party intent layer, and the same segments drive personalization, advertising audiences, and outbound sequences, so you build the segment once and every channel uses it. That is a real advantage over stitching a point identification tool to a separate scoring spreadsheet and a separate ads tool: one identity graph, one signal layer, no sync lag between them.
Timebox this step to an afternoon. Your first scoring model will be wrong in ways only real routed accounts can reveal, so ship a simple version and tune it in the weekly review you will set up in step 5.
Book a demo to see fit and intent scoring configured for your ICP in about 20 minutes.
Step 5: Route to sales: CRM sync, alerts, and SLAs
Identification without routing is a dashboard nobody opens. This step is where demo pipeline actually gets created, and it has three parts: sync, alert, and SLA.
CRM sync. Push identified, scored accounts into the system sales already lives in. Abmatic AI syncs bi-directionally with Salesforce and HubSpot: identified companies match to existing accounts by domain, net-new companies create records with firmographics attached, and visit activity lands on the account timeline so an AE preparing for a call can see that three people from the account read your security page last week. Bi-directional matters because ownership, opportunity stage, and customer status need to flow back into the identification platform to drive the suppression and routing rules from step 3. Decide two policies up front: whether net-new accounts are created automatically or reviewed first, and who owns unassigned inbound accounts.
Alerts. Reps do not watch dashboards; they watch Slack and email. Set alerts only for the segment that justifies interruption: high fit plus high intent, for example "ICP account viewed pricing" or "three or more visitors from one target account this week." Route each alert to the account owner, or round-robin unowned accounts to the SDR team. Abmatic AI's Slack integration sends the alert with the account context attached, and its agentic workflows can go further than a ping: when an account crosses your intent threshold, the workflow can enroll it in an outbound sequence, add it to a retargeting audience, and notify the AE in one motion, with no human glue work in between.
SLA. Signal decays fast. A pricing-page visit is a live buying moment on Tuesday and trivia by the following Monday. Agree on a response window with sales leadership (one business day for hot alerts is a common standard), define what "response" means for an account where you may not have a named contact (a relevant-persona outreach into the account, not a "saw you on our site" email, which reads as creepy and burns the signal), and review the loop weekly for the first month: alerts sent, alerts worked, meetings created. That weekly review is also where you tune the step 4 scoring model based on which alerts sales actually converted.
Book a demo and see an identified pricing-page visit travel all the way to a Slack alert and a CRM record, live.
What good looks like after 30 days
Thirty days in, you should be able to answer yes to most of these. If you can, the setup is working; if not, the miss tells you exactly which step to revisit.
- Coverage: the script fires on every page and subdomain that matters, and identified sessions flow daily. (Step 1 if not.)
- A measured match rate: you know your company-level match rate and it sits somewhere in the honest 13 to 65 percent range from the study, with a reason you understand if it is at the low end. (Step 2.)
- A clean feed: no bots, ISPs, or internal traffic in anything sales sees, and customers route to owners instead of SDRs. (Step 3.)
- A working shortlist: a weekly list of high fit, high intent accounts small enough that sales works all of it, typically 20 to 60 accounts for a mid-market team. (Step 4.)
- Closed loop: alerts land in Slack and the CRM, sales responds inside the SLA, and you can count meetings that started as an anonymous visit. (Step 5.)
The number to report to leadership is the last one: meetings and pipeline sourced from identified visits. On a typical mid-market site, the math is straightforward. Twenty thousand monthly visitors at a 47 percent company match yields roughly 9,000 to 9,500 identified company sessions; filtering and deduplication compress that to a few hundred unique target-market accounts; scoring surfaces a few dozen with real intent; and a sales team that works those inside the SLA books meetings that would otherwise never have existed, because 95 percent of those visitors were never going to fill out the form.
From there the roadmap is expansion, not maintenance: turn the same segments into ABM advertising audiences, personalize the website for identified target accounts, and let contact-level identification and agentic outbound extend the motion from accounts to people. This is where running it all on one platform pays off. Abmatic AI is the most comprehensive AI-native revenue platform in the category: identification, scoring, personalization, advertising, sequences, chat, and CRM sync share one identity graph, so each expansion is a toggle, not a new procurement cycle.
Book a demo to see who is on your site today and what the full motion looks like on your own traffic.
FAQ
What percentage of website visitors can actually be identified?
Across 1.2 million real B2B sessions in our 2026 study, about 47 percent matched to a company by name (51 percent by resolvable domain) and only about 7 percent resolved to a named individual. Roughly one in five company matches was high confidence, and individual sites ranged from 13 to 65 percent depending on traffic mix and geography. Treat any vendor quoting a single high number with no methodology as quoting a best case, not an average.
Is website visitor identification legal and GDPR compliant?
Company-level identification of B2B traffic is legal in the US and widely used. In Europe, GDPR and ePrivacy rules apply because IP addresses count as personal data, so compliance depends on your lawful basis, your consent setup, and how your vendor processes data. Run the script through your consent management platform where required and review our guide on whether website visitor identification is GDPR compliant for the specifics. Person-level identification carries stricter requirements than company-level, so hold it to a higher bar.
How long does visitor identification take to set up?
The script install takes under an hour and starts capturing signal the same day. The full pipeline in this guide, including filters, scoring, CRM sync, and alert routing, typically takes a few days to a week for a mid-market team. Plan on a 30-day tuning window after that, mostly spent refining scoring weights and the alert threshold based on which accounts sales actually converts.
Do I need engineering help to install a visitor identification script?
Usually not. If you run Google Tag Manager or a CMS with a global head setting, marketing can add the snippet and publish without a code deploy. You may want an engineer for two cases: single-page apps where route-change tracking needs a quick check, and consent management platforms where the script must be registered in the right category. Budget an hour of engineering time at most.
What is the difference between company-level and person-level identification?
Company-level identification resolves an anonymous session to an organization: you learn that someone from Acme Corp viewed your pricing page. Person-level identification resolves the session to a specific individual contact. Company-level works for about 47 percent of sessions; person-level for about 7 percent, because it needs much stronger identity signal. Most tools only offer company-level. Abmatic AI does both natively, so you can run account plays on the 47 percent and person plays on the 7 percent without buying a second tool.
How do identified visitors get into my CRM?
Through a native sync. Abmatic AI matches identified companies to existing Salesforce or HubSpot accounts by domain, creates records for net-new companies with firmographics attached, and writes visit activity to the account timeline. The sync is bi-directional, so ownership, opportunity stage, and customer status flow back to drive suppression and routing rules. Pair the sync with Slack alerts for high-intent segments so reps see the signal where they already work.
Why is my match rate lower than the vendor promised?
The usual causes, in order: the script is not firing on all pages or is blocked by your consent setup; your traffic skews toward remote workers on residential ISPs, mobile networks, or geographies with weak IP registration data; or a large share of your visitors are small companies that reverse IP databases cannot resolve. Verify coverage first (step 1), then compare your traffic mix against the ranges in the match rate study before concluding the tool is underperforming. A 30 percent rate on heavily remote traffic can be a healthy result.
Book a demo and get every one of these questions answered against your own site's data.
