Every blogger has had the moment: traffic jumps overnight, you check which post went viral, and it turns out to be none of them. The visits all lasted zero seconds and came from a city you have never heard of.
Bots make up a big share of web traffic, and blogs are an easy target. Here is how to spot them.
The warning signs
- Very short visits. Lots of sessions lasting zero or one second.
- Sudden spikes that don't match anything you published or shared.
- Unexpected countries, especially a single country you don't write for appearing in large numbers.
- Odd referrers, often spammy domains you have never linked with.
- Perfectly regular timing, like a visit every 30 seconds through the night.
- Pages nobody can reach, such as old URLs, admin paths or feed files getting heavy traffic.
Why analytics filters are not enough
Analytics tools filter some well-known bots, but they only see what happens in the browser. Simple scripts that never run JavaScript don't show up at all, while smarter bots that do run it look like normal visitors.
The one thing bots struggle to fake is where they connect from. Running thousands of fake visits from real home internet connections is expensive. Running them from rented servers is cheap, so that is what most of them do.
Check the network on the server
When a page is requested, look up the visitor's IP. If it belongs to a datacenter, proxy, VPN or known bot network, you have a few options:
- Skip loading the analytics script for that visit, so it never counts.
- Load it, but tag the visit as automated so you can filter it out in reports.
- For aggressive scrapers, rate-limit or block them outright.
Leave search engine crawlers alone. You want Google to visit, and you can verify real search bots separately.
Honest numbers are worth it
Your traffic will probably look smaller once bots are filtered out. That is fine. A smaller, true number tells you which posts readers love, which channels send real people, and whether your work is paying off. A big fake number tells you nothing.