r/webdev • u/Innowise_ • 1d ago
Discussion How are you separating actual users from AI/bot traffic now?
With AI crawlers and agents hitting websites constantly, how much of what analytics calls “direct traffic” is even human anymore?
If bots are getting counted as visits, conversion rates automatically look worse. And then decisions about landing pages, content, ad spend etc. are being made from numbers with a messed up denominator.
Blocking bots doesn't really solve it either. Some are obviously junk, but others are search crawlers, monitoring tools or AI agents that might actually send users your way.
Feels like analytics needs to get much better at telling why something is accessing a site, not just whether it looks like a bot.
Anyone seeing this noticeably mess with their analytics yet?
16
2
2
u/UpsetCryptographer49 1d ago
You don't - I notice a lot of my apps get people using it to explore the apps. Just to steel the ideas and develop their own competing product.
1
u/Single-Fail-630 1d ago
Analytics vendors sell bot detection to protect their billing model. I stopped trusting direct traffic numbers entirely and only optimize for verified form submissions.
1
u/Innowise_ 1d ago
That's interesting. Did dropping direct traffic as a useful signal actually change any decisions you were making?
1
u/kritikov 1d ago
google analytics has added the 'AI Assistant' category in the metric, not sure how much accurate though
0
u/Innowise_ 1d ago
Yeah, classification is really the hard part. “Bot vs human” isn't that useful anymore when some automated traffic is legitimate. Wouldn't rely on the AI Assistant bucket alone yet.
1
1
u/OmerCevher 1d ago
I wouldn’t try to make one number answer both problems. Keep crawler traffic in server logs, then calculate conversion from sessions that actually navigate or interact. Otherwise every new bot changes a business metric it has nothing to do with.
1
1
1d ago
[removed] — view removed comment
1
u/webdev-ModTeam 1d ago
Your post/comment has been determined to be a low-effort post or comment. This includes title-only posts, easily searchable questions, vague/open-ended discussion prompts, LLM generated posts or comments, and posts/comments that do not provide enough context for meaningful replies or discussion.
1
u/polygraph-net 21h ago
Why don't you use a competent bot detection service to detect the bots and tag them as good or bad bots? That'll make your analytics clear.
1
u/julesbuildstuff 1d ago
We've started treating "direct" as guilty until proven otherwise. Channel labels lie when agents are in the mix.
What actually helped: look at UA + request shape, not just the referrer bucket. Flag no-referrer hits that also have a bot-ish UA or a burst from the same ASN in a few minutes. Then keep two views — one with that traffic stripped, one raw — so you don't nuke real agent-driven visits that later convert.
Blocking everything weird made it worse for us. Some of those agents were bringing a human a minute later.
1
1
u/OmerCevher 1d ago
Keeping both views sounds like the safest part to me. The filters will probably keep changing as agents get better, so having the raw numbers there should make comparisons less messy.
1
1
u/luodaint 1d ago
What helped me was stopping caring about pageviews entirely and defining one server-side event a bot basically never fires: account created, first real action, payment. Log those yourself with the source attached instead of trusting client analytics. Then split the funnel: raw hits are noise, events are the denominator. I also keep a separate view filtered to sessions with at least one interaction event, which kills most crawler traffic without blocking anything. Conversion numbers got boring but finally matched the database.
0
u/Innowise_ 1d ago
This is probably where analytics is heading anyway. Pageviews get less useful as non-human traffic grows, while server-side events tied to an actual action are much harder to misread. “Boring but matches the database” sounds like a pretty good outcome.
0
u/Vegetable-View-5114 1d ago
honeypots are a good first line of defense, especially for preventing automated form submissions. beyond that, looking at behavioral patterns like mouse movements or typing speed can often differentiate bots from human users more effectively than simple CAPTCHAs, which are becoming easier for AI to solve. rate limiting requests from a single IP is also crucial to prevent scraping or brute-force attacks.
0
u/uniquelyavailable 1d ago
That's the neat part, is not possible to determine who wrote text. There are many theories and general practices in place but no true secure method to differentiate who, what, or how text was entered.
0
u/Temperature_Majestic 1d ago
What helped us was moving the measurement point instead of trying to classify the traffic. A pageview stays a cheap raw metric, but a session only counts once a real engagement event fires, a click, a form field focus, a scroll past some depth after a few seconds on the page. Most bots never cross that line even when they run JS, so your conversion denominator becomes engaged sessions without you labelling anyone. Then for the agent-brings-a-human-later case, tie visits to a stored client id so the human visit joins the same identity and you can actually see the assist.
0
u/jaimittal91 1d ago
one thing nobody's mentioned yet, cross-reference your server access logs against what your client-side analytics actually captured. anything that hits your server but never fires the JS tag is either a bot that doesn't execute JS or something blocking the tag, either way it's a real request your infra served that your dashboard doesn't know about. the harder half is the agentic stuff that does run JS convincingly, that'll pass an engagement-threshold check for a while too. but the server vs client delta alone usually surfaces a big chunk of it before you even get to behavioral scoring.
1
u/Innowise_ 1d ago
Server logs vs client-side analytics is probably one of the more useful checks right now. It also catches the traffic that never makes it into the analytics dashboard in the first place, which is easy to forget when looking only at GA.
-8
u/Klutzy_Table_6671 1d ago
It is not interesting and has never been interesting to know. Only Ad companies try to convince you about that. What is interesting is what you're selling? Tell us.
3
u/Innowise_ 1d ago
Nothing being sold here. Just curious how people are dealing with the growing amount of bot traffic in their analytics.
25
u/IncompleteLitre 1d ago
it's a mess right now and most analytics packages are still way behind on this
one approach i've seen work is tracking time-on-page and scroll depth way more aggressively, most bots won't trigger either even if they execute js. you end up filtering out a ton of noise just by requiring a human-like interaction pattern before counting a session as real