Most Web Traffic Is Not Human, and Your Reports Will Not Show You That

Your Analytics Already Filters Bots, and Will Not Tell You How Many

Google Analytics 4 states that traffic from known bots and spiders is automatically excluded, and that you cannot disable that exclusion or see how much known bot traffic was excluded (Google, 2026). The filtering is real, automatic and invisible, which means a clean looking report is not evidence of clean traffic.

Start with what your own reporting tool already does, because most owners have never been told.

Google Analytics 4 documents that traffic from known bots and spiders is automatically excluded, that at this time you cannot disable known bot traffic exclusion or see how much known bot traffic was excluded, and that identification uses a combination of Google research and the International Spiders and Bots List maintained by the Interactive Advertising Bureau (Google, 2026).

Read that carefully, because two things follow and only one is comfortable. The comfortable one is that a large amount of obvious automated noise never reaches your reports at all. The uncomfortable one is in the word known. The filter works by recognition, against a list. Anything that does not match the list is not filtered, and you have no way to see the size of either group.

So the honest position for any business reading its own numbers is this. The traffic you can see has already survived a filter you cannot inspect, and what survives a known bot filter is, by definition, the traffic that did not look like a known bot.

The Scale of What Is Being Filtered Against

Bots account for more than 53 percent of all web traffic, up from 51 percent the year before, with human traffic down to 47 percent (Imperva, 2026). Attack patterns are also moving deeper into applications, with 27 percent of bot attacks targeting API endpoints (Imperva, 2026).

The filtering matters more than it used to because of what it is filtering against.

Bots now account for more than 53 percent of all web traffic in 2025, up from 51 percent the year before, and human traffic has fallen to 47 percent (Imperva, 2026). The majority of activity on the web is automated, which makes accurate measurement a harder problem than it was when the split ran the other way.

The character of it is changing too, not only the volume. Twenty seven percent of bot attacks targeted API endpoints (Imperva, 2026), which is a move away from poking at the front of a website and toward the interfaces behind it.

None of that means your specific site is half bots. Traffic mix varies enormously by industry, by how long a domain has existed and by how much automated interest it attracts. It does mean the baseline assumption that a session equals a person stopped being safe some time ago.

Where It Actually Distorts a Small Business Report

Inflated sessions deflate conversion rate because the denominator grows while real enquiries do not. Engagement and bounce shift toward whatever the automated traffic does. And a channel that attracts more automation looks worse on quality than it deserves.

The damage is rarely dramatic. It is a steady, quiet distortion of exactly the numbers used to make decisions.

Conversion rate is the clearest case. It is enquiries divided by sessions, and automated traffic inflates the denominator without ever filling in a form. The rate falls, nothing about the business has changed, and the conclusion drawn is usually wrong: that the page is underperforming, or that a channel has gone off.

Engagement metrics move in whichever direction the automation does. Something that loads one page and leaves pushes bounce up. Something that crawls forty pages quickly pushes pages per session up and time on page down. Neither tells you anything about a customer.

Channel comparison is where it does real financial damage, because budget follows it. If one source attracts disproportionate automated traffic, it will look like it delivers volume without quality, and money gets moved away from a channel that may in fact be performing.

And then there is the form. Spam submissions cost real time to sort, and worse, they train an owner to stop trusting the enquiry inbox at exactly the moment a genuine lead is sitting in it.

Not Every Bot Is a Problem, and Blocking Everything Costs You

Search engine and answer engine crawlers are automated traffic you actively want, because they are how you get indexed and cited, and which crawler you block decides whether AI names you. The goal is not less automation, it is separating traffic that has a legitimate reason to be there from traffic that does not.

It is worth resisting the obvious conclusion, which is to block anything that is not a person.

A large share of the automation arriving at your site is the reason customers can find you at all. Search engine crawlers index you. Answer engine crawlers are how you become the source an assistant quotes. Uptime monitors tell you the site is up. Blocking indiscriminately is how a business quietly removes itself from the surfaces it depends on, and it is a more common mistake than over-permissiveness.

The useful distinction is not human versus bot. It is whether a given automated visitor has a legitimate reason to be there, declares what it is, and behaves accordingly. That is a judgement about identity and behavior rather than a blanket rule, and getting it wrong in the cautious direction has a real cost.

We have written separately about which specific crawlers control whether you appear in AI answers, because that is the half of this most often got backwards.

Filter Before the Request Becomes a Number

Anything filtered inside the report has already consumed server resources and already influenced the data. Filtering at the edge, before the request reaches the site, is the only place where unwanted automation costs nothing and counts as nothing.

There are two places to deal with this and they are not equivalent.

The first is inside the reporting tool, after the fact. This is what GA4 already does for known bots (Google, 2026), and it is genuinely useful, but by then the request has already arrived, already used your server, and already been evaluated. You are cleaning up a record of something that already happened.

The second is in front of the site, before the request is served at all. Traffic refused there never consumes your resources, never lands in a log as a visit, and never enters the data. That is the difference between deducting something from a total and never adding it.

For a small business the practical implication is not that you need a security operations team. It is that the layer deciding who gets served should sit in front of your website rather than inside it, because everything decided inside it is decided after the cost has been paid.

If you want to know what your own numbers look like before deciding anything, our free audit reports what is actually reachable and readable on your domain, and it costs nothing.