Most of Your Website Traffic Isn't Human. Here's How to Tell.

A business owner shows us a chart. Sessions are up. The line goes from lower-left to upper-right, which is the direction lines are supposed to go. Then we ask a different question: how many of those sessions lasted longer than zero seconds? The answer, on that account, was not most of them. It was a small minority. The rest arrived, requested one page, and left inside the same second — which is not something a person can do.

We found this on our own property first, which is the only reason we trust the finding enough to write it down. It is not a niche problem and it is not a sign that something is broken. It is what web analytics looks like in 2026 if nobody has filtered it.

The three tells that show up in every account

You do not need a bot-detection vendor to find this. The evidence is already sitting in the reports you have.

1. Zero-second engagement, in bulk

GA4 reports average engagement time per session. Segment by channel and look at Direct, Email and anything labelled Unassigned. If those channels report an average engagement time of zero seconds — not low, zero — you are not looking at shy visitors. You are looking at automated requests that fetched the page and never ran the timer, because nothing was ever on screen.

2. Cities that are not cities

Open the geographic report and read the top rows. If you see Boardman, Ashburn, Des Moines, Council Bluffs or The Dalles near the top, you have not discovered an unexpected customer base in rural Oregon and Iowa. Those are the towns that host the big cloud regions — AWS, Azure, Google Cloud. What that report is telling you is that your traffic originates in datacenters, which is where bots live and where customers do not.

3. Traffic that tracks your sending, not your marketing

This is the one that fools people, because it looks like success. You send a cold email campaign on Tuesday. Tuesday's sessions spike. The obvious reading is that the campaign worked. The other reading — usually the correct one — is that corporate mail security opened every link in every message before delivering it, because that is precisely what link-scanning is for. The spike is your recipients' security vendors, arriving in a burst, engaging for zero seconds, from a datacenter.

Why this got worse, and why it will not get better

Three things happened at once. Mail security moved from optional to default, so a much larger share of B2B email now has every URL pre-fetched. AI crawlers arrived and started reading the open web at a volume search engines never needed. And link-preview generation — the little card that appears when a URL is pasted into a chat app — means a single shared link can produce several page requests before a human sees anything.

None of these are attacks and none of them will stop. They are the normal background traffic of the modern web. The problem is not that they exist; the problem is that the default analytics configuration counts them as your audience, and then you make decisions with that number.

What it costs you to believe the raw number

Inflated traffic is not a harmless vanity problem. It corrupts every decision downstream of it:

• Conversion rate looks catastrophic. If you divide real leads by inflated sessions, a healthy page reads as a broken one — and people rebuild pages that were working fine.
• Channel comparison inverts. The channels most polluted by scanners (email, direct) look like your best traffic sources, so budget moves toward them and away from channels that were actually producing revenue.
• A/B tests never resolve. Bots hit both variants indifferently, which dilutes the real signal until the test needs far more traffic than you have to reach significance.
• Content decisions go backwards. Pages that get crawled most are not pages people read most, and if the report cannot tell the difference, you will write more of the wrong thing.

How to get to a number you can act on

The goal is not a smaller number. The goal is a number that moves when your business moves. Practically:

• Stop reporting sessions. Report engaged sessions — sessions with real time on page or a real interaction. It is a stricter definition and it is the one that correlates with revenue.
• Filter known datacenter regions out of your reporting view rather than your raw collection, so you keep the underlying data and can always check your work.
• Add a server-side or event-based signal for the things that actually matter — form submitted, call clicked, chat opened. Those are hard for a scanner to fake and easy for you to verify against your CRM.
• Reconcile monthly against a system that only records humans. Your CRM knows how many real enquiries arrived. If analytics says traffic tripled and the CRM says enquiries were flat, analytics is describing crawlers.
• Expect the chart to drop when you fix this, and warn whoever reads the report before it happens. A large fall in reported sessions after filtering is the fix working, not a traffic loss.

If your traffic number never moves when your business does, it was never measuring your business.

The uncomfortable part

Plenty of marketing reports are built on this number. Agencies report sessions because sessions go up and to the right almost regardless of what anyone did. Nobody is necessarily lying — the dashboard says what it says — but if a report leads with total traffic growth and never mentions engaged sessions, enquiries or revenue, it is describing an internet-wide trend in crawler volume rather than anything about your company.

The correction is not complicated. Pick two numbers you would be willing to be judged on — engaged sessions and real enquiries — and put them at the top of every report. Everything else is context. Traffic that never asked you a question was never a customer, and no amount of it will become one.

← Back to all articles