Traffic quality
Your SEO Traffic Probably Isn't All Human.
We know because we built a tool to audit paid traffic for bots. Then we applied the same thinking to organic.
Here's a question most SEO agencies never ask: How much of this traffic is real?
They report sessions, page views, time on site. They celebrate growth. They assume the baseline is human. It often isn't.
We see this in our PPC audits. BotExorcist captures post-click behaviour that platforms don't report - arrivals with no mouse movement, no scroll, no timing patterns that suggest a person reading. Repeat infrastructure. Automated patterns. These exist in paid traffic. They also exist in organic traffic. Google Analytics doesn't distinguish.
What happens when the data is polluted.
- Your conversion rate is wrong (calculated against a denominator that includes traffic that was never going to convert)
- Your cost-per-lead looks higher than it actually is
- Your SEO decisions are built on a false baseline
- Your agency reports "growth" while your actual qualified traffic stays flat
Why this is hard for most agencies to admit.
If an agency discovers that a meaningful share of organic traffic is automated, their growth story becomes harder to tell. They have to explain that the baseline was wrong. Most choose not to ask the question.
We don't have that problem. BotExorcist was built to surface this data. Our clients either have clean data or they know why they don't.
What we do about it.
When we start an SEO engagement, the first question isn't "what keywords should we target?" It's "is the measurement clean?" If it's not, we fix that before measuring progress. This makes our reported results look smaller in month 1. They're more honest in month 12.
What actually shows up in an analytics account
An analytics account does not measure people. It measures requests that carried the tracking tag.
A session is a container, not a person
The script sends a hit when it loads, and hits from the same browser identifier are grouped into a session. Nothing in that process checks whether the sender was a person. A headless browser, a rendering service and a real visitor on a phone all produce the same kind of hit.
The session count is therefore a software metric, not a demand metric. It tells you the tag fired. It does not tell you someone wanted something.
Two counting systems that never agree
Your server keeps its own record: every request for a page, an image or a stylesheet, with an IP address, a user agent and a timestamp. Analytics only records requests where JavaScript ran.
The gap between the two is useful. If the log shows four thousand page requests for a URL and analytics reports two thousand views, the rest did not run JavaScript or was filtered out. That tells you how much non-browser fetching the site attracts.
Referral spam and why it appears
Referral spam is traffic arriving with a referrer pointing at a domain you have never heard of. That domain then sits in your traffic sources next to Google, and anyone who opens the report gives the spammer an audience.
How a spam referrer gets into your reports
The first route is a genuine request. A bot loads a page on your site and sets the referrer header to a domain it wants you to look at. The visit really happened. It just was not a customer.
The second is a forged hit. Measurement endpoints accept hits posted directly, with no browser involved. In Universal Analytics a measurement ID was public, so a spammer could invent sessions against a hostname that was not even yours. GA4 requires an API secret for direct posts, which closes the easy version of that trick.
Why anyone bothers
Someone sees an unfamiliar domain in their referral report and visits it out of curiosity. A referral report is also a list of placements that can be bought cheaply. Neither has anything to do with your business, and both inflate a number you might be reporting on.
Bots that behave like visitors
Not every automated visit announces itself. The ones that matter run your page properly, so they produce data that looks plausible.
Crawlers that execute JavaScript
Modern search crawlers and most commercial SEO tools do not just download HTML. They load the page in a real browser engine, run the JavaScript and see what a visitor sees. Your analytics tag is JavaScript, so a rendering crawler can fire it.
Google filters traffic it recognises as its own crawler, and analytics platforms keep blocklists of known bots. A blocklist only covers what someone has already catalogued, so a new scraper or a smaller SEO tool is not on it and gets counted.
Preview fetchers and monitoring services
Several services touch your site constantly and most are invisible in analytics.
- Link preview fetchers. When someone pastes your URL into a chat app, the platform fetches the page for its metadata. Most fetch HTML only, so they appear in your server log and not in analytics.
- Uptime monitors. These check the site on a schedule from data-centre addresses, and they arrive in a rhythm: same page, regular intervals, scattered locations.
- AI and research crawlers. Increasingly common and increasingly capable of rendering, so a growing share of them execute JavaScript.
That is the normal weather of a public website. The problem is only that it is mixed into the numbers you use to judge demand.
How to tell the difference in your own data
You do not need a bot-detection product for this. User agent strings are easy to fake, so treat them as a hint and look at behaviour instead. A real visitor moves a mouse, scrolls, hesitates and comes back. A script lands, fires the tag and stops.
What I check, in order
- Engaged sessions against conversions. Analytics calls a session engaged on a cheap threshold: enough time, or enough page views. Compare those to actual key events. A wide gap means engagement is being earned by timing, not interest.
- Session duration. Real visitors cluster in the middle. Bots pile up at the very short end and at exactly identical durations.
- Pages per session. An interested visitor opens a second page. Automated traffic rarely does.
- Geography. Data-centre regions with no connection to your market are the giveaway, especially when they carry your best conversions.
- Device and browser mix. Identical browser versions across a large block of sessions, missing screen resolution, or an operating system and browser that cannot exist together.
- Engagement events. Scroll depth, video plays, form starts, outbound clicks. These are the hardest to fake and the fastest way to separate a rendering crawler from a reader. If scroll events sit near zero while sessions look healthy, those sessions are not reading.
Cross-check against a second measurement
Compare the picture against Search Console. Those clicks are counted by Google from its own results rather than by your tag. When Search Console clicks stay flat while sessions climb, the growth is coming from somewhere other than people searching for you.
Your enquiry records are the real check. If sessions doubled and the phone did not ring, the sessions are not demand.
What to do about it
Filter, but filter narrowly
Excluding a referral does not delete the sessions. It removes the credit. The traffic is usually reclassified as direct, which is why direct so often behaves like a dumping ground rather than a channel.
Internal traffic and known-bot filters are worth setting up and checking. Be careful with IP blocking, though: aggressive blocking at the server or firewall will eventually catch a real visitor, and a blocked visitor does not come back to tell you. Filter at the reporting layer before you block at the network layer.
Change what you report on
The durable fix is choosing metrics a bot cannot manufacture. Conversions, qualified enquiries, booked calls and revenue are hard to fake at volume, because faking them costs the spammer something real. Sessions, page views and time on site are free to fake.
So I lead with what reached the business: genuine form submissions, calls, bookings and the queries that preceded them. Sessions sit underneath as context. Whether anyone wanted anything is the only question that pays the bills.
BotExorcist isn't for everyone. It's for businesses that spend significant budget on paid traffic and want to know whether their SEO numbers mean anything. If that's you, we should talk.