Bot traffic: what it is, how to spot it and how to stop it

What is bot traffic on a website?

Every request to your site comes from either a person using a browser or a program. Programs that visit pages on their own are bots, and the visits they make are bot traffic. A bot can be a search engine fetching your pages so they can appear in results, a monitor checking your site is up, an AI assistant fetching a page because someone asked it a question, or a script copying your prices.

Bot traffic is not the same as traffic you bought or faked. It is simply automated traffic, and whether it is a problem depends on who runs the bot and what it does on your site.

Good bots and bad bots

Sort the bots you find into groups before you decide anything. Allow search crawlers so engines can read and refresh your pages. Blocking crawling can harm indexing, but does not guarantee removal from search results.

The line between the groups is a decision, not a fact about the bot. A scraper to one site owner is a price-comparison service to another. And a user agent can be faked: a request that says it is Googlebot may not be. Google documents how to check, either by a reverse DNS lookup on the visiting IP address, checking that the hostname is in a Google domain and that a forward lookup of it returns the same IP, or by matching the IP against the ranges Google publishes, in Verifying Googlebot and other Google crawlers.

How to spot bot traffic in your analytics

Bots rarely behave like people, and that shows up in the numbers. No single sign proves it. Treat each one as a reason to look closer, and trust the pattern when several line up on the same dates.

• A spike with no cause. Visits jump on a day you sent no email, ran no ad and got no mention. Check the date against your campaign calendar first.
• Sessions of zero seconds. A visit that loads one page and leaves instantly, over and over, looks more like a request than a reader. Compare with your usual average session duration and bounce rate.
• One page takes all the hits. A flood of visits to a login page, a search page, a form or one product page.
• Countries you do not serve. A sudden block of visits from one country with no reason for it.
• Odd sources. A large rise in direct traffic, or referrers you do not recognise. Bots often send no referrer, which analytics files as direct.
• Old or unusual browsers and devices. The same screen size or browser version repeated thousands of times.
• Cloud-hosting networks. Visits from data centres, where real people rarely browse from. A cloud address is a hint, not proof: a visitor using a VPN looks the same.
• Server strain. Pages slow down or your host warns you about load while your analytics shows nothing unusual. Bots that never run JavaScript do not appear in script-based analytics at all, so your server logs or CDN analytics are where they show.

For the opposite worry, traffic that disappears, see why website traffic drops. A bot filter that gets stricter can make visits fall without losing a single real person.

How analytics tools filter bot traffic

Most bots never reach your reports, because analytics tools filter many of them out. The method differs by tool, and none catches everything.

• Google Analytics 4 automatically excludes known bot and spider traffic. Google's help page states: "At this time, you cannot disable known bot traffic exclusion or see how much known bot traffic was excluded" (Exclude known bot traffic, checked 17 October 2026). So you cannot see how much it removed, and a bot that is not on the known list can still be counted.
• Stickybeak labels bots and keeps them out of visitors, pageviews, sessions, goals and revenue attribution. It checks each visit as it arrives against a list of signals: signed AI agents, a missing user agent, over 70 named bots and tools, Cloudflare's verified bots, anything calling itself a bot, automated or headless browsers, non-browser clients, data-centre networks and requests missing the language headers every mainstream browser sends. The full list, and its limits, are in Bot filtering.

Stickybeak also shows you what it filtered. Each site page has a panel of bots that were not counted, grouped by what they are (AI answers, search indexes, AI training crawlers, SEO tools, social previews, monitoring, scripts and others). For sites on the Cloudflare account Stickybeak runs on, a crawler panel built from Cloudflare's request analytics adds the bots that never run JavaScript. See Bots and crawlers.

Filtering has limits you should know about. A bot that drives a real browser from a home connection, with ordinary headers, can look like a person to any analytics tool. And some real people browse from data-centre networks, so a filter based on them counts a few real people as bots. Stickybeak's docs say both plainly.

How to stop bot traffic

Filtering bots out of your reports and stopping them reaching your site are two separate jobs. Do the second only for bots that cost you something: server load, scraped content, spam, or attacks on a login.

1. Identify the bot first. Find its user agent, IP range and the pages it requests in your server logs or CDN analytics. Without that you are guessing, and you might block a search crawler.
2. Use robots.txt for bots that behave. A robots.txt file asks crawlers to stay away from paths or the whole site. Reputable crawlers follow it. Bad bots simply ignore it, so it is a request, not a lock. Test a rule with the robots.txt checker before you upload it. A sample that turns away one named crawler:

   User-agent: ExampleBot
   Disallow: /

3. Block or challenge the rest at your host or CDN. Firewall rules by IP range or country, rate limits on a login or search page, and a challenge page for suspicious requests all work before the request reaches your site. Many CDNs and hosts offer bot management as a setting or paid add-on; check what yours includes.
4. Protect forms and logins. Add a CAPTCHA or a hidden honeypot field to sign-up and contact forms, and limit failed login attempts.
5. Check you did not block people. After a change, watch your real visitors and your Search Console crawl stats. If search visits or crawling drop, undo the rule.

Do not rely on the user agent alone. It is text the visitor sends, so any bot can claim to be a browser or a search engine.

Does bot traffic hurt SEO?

Bot visits do not count as search traffic, and they do not lower your rankings by themselves. The harm is indirect. They skew the numbers you use to judge SEO, such as bounce rate and visits by country, so a campaign can look better or worse than it was. And heavy bot load can slow your server, which slows the pages real visitors and Googlebot are fetching. Googlebot itself is a bot you want.

If your analytics already filters bots, your reports are cleaner but not perfect. To check what your reports include, compare them with a second source, as the SEO and Google Analytics guide explains.

Where Stickybeak fits

Stickybeak is live analytics for every site you own, and it is in early access. Bot handling is built in, with nothing to set up:

• Bots are labelled and kept out of every visitor number.
• A separate panel lists each bot with its category, so you see which AI assistants, search engines and scrapers are visiting.
• On the wall, a robot pill on each site's card shows how many bots visited in the last 30 minutes.

It does not block bots. Stopping them is done at your host, CDN or firewall. What Stickybeak gives you is the evidence for that decision, and visitor numbers you can trust in the meantime.

Sources, checked 17 October 2026: Google Analytics Help, Exclude known bot traffic; Google Search Central, Verifying Googlebot and other Google crawlers. Stickybeak docs: Bot filtering and Bots and crawlers.