Are Those Real People? Bots, Fake Traffic, and Why Your Numbers Lie

Somewhere between a fifth and a half of all traffic to a typical small website is not a human being. It is software: search engines indexing your pages, monitoring services checking you are online, AI systems reading your content, scrapers copying your prices, and — at the less pleasant end — spam tools looking for a form to abuse.

That range is wide because it genuinely varies enormously by site. What does not vary is the consequence: if your analytics counts machines as visitors, every decision you make from that data is being made on a number that is partly fiction. You conclude the new page is working when it is not. You conclude marketing succeeded when it did not. And, most expensively, you get a conversion rate that looks alarmingly bad because the denominator is full of robots.

Not all bots are bad, and lumping them together is the first mistake. It is worth understanding the four broad categories, because the right response differs for each.

You do not need special tools to notice the pattern. Bot traffic has a recognisable signature, and once you have seen it you cannot unsee it.

The clearest tell is time on page of zero with a single page view. A machine requests a page and moves on instantly; a person lingers, even briefly. A cluster of visits with no time on page and no second page is almost always automated.

The second tell is timing. Real visitors follow the rhythm of human life — busy at lunchtime, quiet at 4am, different on weekends. A perfectly flat line across all 24 hours, or a spike at exactly the same minute each day, is a scheduled process rather than a customer.

The third is geography that does not match your business. A dog groomer in Leeds does not get organic interest from three continents. If a large share of your traffic comes from places you cannot serve, and none of it converts, it is not a marketing success.

The fourth is referrer spam — visits that arrive claiming to come from a website you have never heard of, usually one trying to get you to visit it in return. If your referrers list contains sites with implausible names that send exactly one visit each, that is what you are looking at.

It is tempting to shrug at this. So the number is a bit high — who cares, as long as it is consistently a bit high? The problem is that bot traffic is not consistent, and it corrupts exactly the comparisons you rely on.

A scraper that starts running daily in March will make March look like a growth month. When it stops in June, June looks like a collapse. You will spend real time trying to explain both, and both explanations will be wrong.

It also wrecks your conversion rate, which is arguably the most important number you have. If 400 of your 1,000 “visitors” were machines, then your 20 enquiries are 20 out of 600 real people — a 3.3% conversion rate, not the 2% you thought. That is the difference between “the website is doing badly” and “the website is doing fine and I should send it more traffic.” Owners have paused perfectly good marketing over exactly that misreading.

Three things get you most of the way to honest numbers, and none of them require you to become a technical expert.

First, use analytics that filters bots by default. Good bot filtering combines several signals — known bot identifiers, behavioural patterns, request characteristics — and does it before the visit is ever counted, rather than asking you to subtract them afterwards. This should not be a setting you have to find; it should be how the tool works. It is also why the same site can show wildly different visitor counts in two different tools: they are not measuring the same thing.

Second, exclude yourself and your team. If you and three colleagues load the site twenty times a day while working on it, that is 1,800 fake visits a month, and they are concentrated on exactly the pages you are trying to evaluate. IP exclusion takes two minutes to set up and it is the single most common source of self-inflicted bad data. Include the office, home connections, and anyone building the site for you.

Third, separate AI assistant traffic rather than deleting it. Lumping it in with human visitors inflates your numbers; throwing it away hides a genuinely important trend. Tracking AI traffic as its own category answers a question that is quickly becoming a business question: are AI assistants recommending my business, and is that growing?

Filtering keeps bad bots out of your reports, but it does not keep them off your server, and for a small proportion of sites they are worth actively dealing with. Signs that you have a real problem rather than background noise: your hosting bill or bandwidth usage climbing without a matching rise in real visitors, form submissions full of gibberish and links, or the site slowing down at predictable times of day.

The remedies are straightforward and mostly free. A CAPTCHA or a honeypot field stops the overwhelming majority of form spam. Most hosts and content delivery networks offer bot protection you can turn on in a settings panel. Rate limiting stops a single source hammering your site. None of this requires a security consultant for a typical small business site.

One thing that is worth doing regardless: keep the software up to date. A large share of automated attacks are simply scanning the whole internet for known holes in outdated plugins and themes. Being current is most of the defence.

Fifteen minutes, once, and you will know where you stand:

None of this is about achieving a perfect number. It is about achieving an *honest* one — a number where, when it moves, the movement means something. That is the entire value of analytics: not the dashboard, but the ability to make a decision and find out whether it worked.

It is also why filtering is not an optional extra in Crafty Meerkat. Bot detection runs before anything is counted, team traffic is excluded with a couple of clicks, and AI assistant visits are tracked as their own thing rather than quietly inflating your visitor count. The number you see is the number you can act on — and every week, an AI advisor reads those real numbers and tells you what to do next.