Ask ChatGPT to "pick something that fits my budget," and the AI goes off, finds the right site on your behalf, and buys the product. That kind of shopping is starting to spread, and traffic to sites is climbing. But whether the added traffic is really people or bots isn't something you can tell by staring at the visit count.
This article is about splitting apart the real nature of that added traffic. To say the conclusion first: the visitors arriving at your site right now are a mix of three kinds—people, traffic via AI agents, and bots. We'll walk, in order, through the two clues that tell these three apart, and what numbers you can only protect once you've split them. Along the way, we'll also tell you which parts today's technology still can't fully separate.
Contents
This article in brief#
- The visitors arriving at your site right now are a mix of three kinds—people, traffic via AI agents, and bots. Read the rising visit count straight as "we have more visitors" and your judgment gets pulled by the bot padding
- There are two clues for telling them apart: a mark of origin (the referrer) and behavior (dwell time and how pages are read). With these two, you can roughly split people, via-AI, good bots, and malicious bots
- Split them, and you protect the true human numbers that aren't padded, plus the revenue of a new channel—traffic via AI agents. That said, full identification isn't yet established across the industry, so the realistic move is to lock down the half you can see
1. AI agents and bots are the new visitors to your site#
To put the conclusion first: the traffic climbing right now mixes new visitors—AI agents and bots—in with your human ones.
Start with bots. One report found that more than half of the world's web traffic is bots, overtaking the share of people[1]. Some of these are good bots, like search-engine crawlers; others are malicious bots that strip product data and content at high speed. Neither is a person, so counting them straight pads your visitor numbers.
Next, AI agents. Mechanisms have appeared where an AI, like ChatGPT, searches for products on a person's behalf and carries on all the way to purchase[3]. Looking further ahead, there's even a pre-print research report arguing the web should be rebuilt with AI agents as its first readers[2]. We lay this out in The web in the age of AI agents: AI becomes a customer of your site too. You don't need to rush to rebuild your site, but it's a fact that "AI visitors" are starting to arrive.
The figure above splits one month's traffic into four types as an illustration. People account for roughly 70%, while good bots and malicious bots together reach about a quarter. And traffic via AI assistants is a few percent. In other words, the added visit count hides both bots with no intent to buy and AI-driven visitors who might intend to buy, all at once. Count these two together with people and you'll misread whether your efforts are working. So the first job is to split traffic apart correctly.
2. Two clues for telling traffic apart#
To put the conclusion first: there are two clues for telling traffic apart—a mark of origin (the referrer) and behavior.
The first is the mark of origin. A browser will sometimes pass along a mark (the referrer) showing which page a visitor came from. If traffic via an AI assistant passes this mark, you can carve it out as an "AI-driven customer." But this mark doesn't always come through. Traffic that arrives without it gets lumped into "Direct" or unknown origin in GA4[4]. In 2026 an "AI Assistant" channel was added, but even that catches only the portion that passed a mark. We cover the caveats of this GA4 channel in how to count rising AI traffic correctly in GA4.
The second is behavior. People and bots move through a site differently. A person lingers on a page for tens of seconds to a few minutes and loads the images and buttons. A malicious bot, by contrast, stays only an instant, flips through a mass of pages at high speed, and often doesn't run the rendering machinery (JavaScript). Look at this difference in movement and you can roughly tell person from machine even without a mark.
The figure above illustrates the flow of sorting a new session with these two clues. First, look at the mark of origin and judge whether it came via AI. If there's no mark, use whether it's a known crawler and whether the behavior looks human to split good bots, malicious bots, and people. That's the whole idea. The catch is that doing this judgment every day, across every channel, is grueling by hand.
3. The human metrics and per-channel revenue you protect by splitting traffic#
To put the conclusion first: split traffic apart and you protect the true human numbers that aren't padded, plus the revenue of a new channel—traffic via AI agents.
Start with the human numbers. Fail to remove bots and you'll see your added visit count as larger than your real strength. Even if traffic looks up nearly 30% over a few months, count only the people with bots removed and the growth may turn out to have been far more modest. Judge "traffic grew, so the effort succeeded" without knowing this gap, and you'll misread your next move. We handle how bots distort channel evaluation in detail in How bot traffic distorts channel evaluation.
The figure above illustrates raw session counts (the upper line) alongside people only, with bots removed (the lower line), month by month. The raw figure looks like it's climbing briskly, but the people-only figure rises only gently. The widening gap is non-human traffic. Your true baseline is the lower line.
The other one is per-channel revenue via AI. Traffic via AI assistants that passed a mark can be carved out as its own channel. Then you can see how many sessions it drove and how much revenue it brought. Small in count though it may be, it's not unusual for these to be new visitors who buy well. What's worth noting here is that even if the idea of splitting is simple, tying each purchase back to page-level data and re-aggregating across every channel each time is quite heavy as an operation.
4. What can't be fully told yet#
Some parts still can't be fully split apart with today's technology.
AI assistants don't always pass a mark of origin. The portion that isn't passed sinks into "Direct" and can't be fully caught as AI-driven. On top of that, no industry-established mechanism yet traces a purchase an AI agent chose and bought autonomously all the way through to that revenue as a single path. Bot judgment isn't perfect either, and real users on an internal network or via VPN can be mistaken for machines.
That's exactly why you should be wary of any method that claims to "show you everything, whole." The realistic move is to lock down the half you can see. Make the AI-driven traffic that passed a mark a channel, for sure. Remove the bots you can tell by behavior. And treat the uncertainty that remains as uncertain. We lay out the whole picture of building a site that welcomes AI as a customer in A site for humans, or a site for AI agents?.
RevenueScope solution
The wall you hit when splitting traffic is always the same in the end. The idea is simple, but re-aggregating by hand each time—the human numbers with bots removed, and the per-channel revenue via AI—is heavy. Left in GA4 as-is, much of the AI-driven traffic sinks into "Direct," and carving it out takes work.
RevenueScope presents this split on one screen. It separates the human sessions after bots are removed and the traffic via AI assistants that passed a mark as an independent channel, and lays out the revenue for each side by side. Below is one example on demo data modeled on a cosmetics EC store.
Illustrative; the figures are one example from a fictional EC store on sample data. Ask an AI assistant like ChatGPT through RevenueScope's MCP, "For last month's traffic, what's the breakdown across humans, bots, and AI agents?" and this is what comes back.
| Traffic type | Raw sessions | After bot exclusion (humans) | Revenue |
|---|---|---|---|
| Humans (search, social, direct) | 33,400 | 33,400 | ¥4,180,000 |
| Via AI assistants (referrer present) | 2,900 | 2,900 | ¥512,000 |
| Good bots (search-engine crawlers) | 6,300 | 0 | ¥0 |
| Malicious / unknown bots (no referrer, high-speed crawling) | 5,600 | 0 | ¥0 |
| Total | 48,200 | 36,300 | ¥4,692,000 |
There are two things to read in this table. One is that of the 48,200 sessions, about a quarter (11,900) were bots, not people. Evaluate your efforts on the raw figure and your judgment gets pulled by that padding. The other is that the 2,900 sessions via AI assistants come in at ¥176 per session, above the human average of ¥125. Small in count, they turn out to be new visitors who buy well.
So your next move is set too. Evaluate your efforts on the true baseline with bots removed, and grow AI-driven traffic as an independent channel—by, say, beefing up the product pages AI is likely to cite. RevenueScope specializes in reliably carving out the traffic via AI assistants that passed a mark as a channel, and in protecting the human numbers after bots are removed. How far you count AI-agent-driven traffic as your own revenue is something we handle in detail in The difference between AI-agent purchases and referral revenue. You can see the actual split screen on the demo screen.
FAQ#
Frequently asked questions#
Q. Traffic went up but revenue isn't following—why?
A. The added traffic may hold bots there to gather information, with no intent to buy. Bots pad your visitor count but don't purchase. So visit count alone climbs while revenue doesn't move. First check, on the people-only figure with bots removed, whether your human traffic is really growing. If the growth is people, the next thing to revisit is how they buy.
Q. Can I tell traffic via AI agents apart in GA4 as-is?
A. Only partly. Traffic via AI assistants often doesn't pass a mark of origin, and the portion that isn't passed gets lumped into "Direct" or unknown origin. In 2026 an "AI Assistant" channel was added, but even that catches only the portion that passed a mark. The realistic way to face this is to reliably carve out the traffic that passed a mark as a channel, and to accept that the portion without a mark can be missed.
Q. Can bots be excluded completely?
A. Not completely. You can roughly tell bots apart using behavior as a clue, but real users on an internal network or via VPN can be mistaken for machines. Conversely, a bot that skillfully mimics a person can slip through. Rather than aiming for full identification, the realistic move is to reliably remove the portion you can tell apart to protect the human numbers, and to treat the uncertainty that remains as uncertain.
Conclusion#
The visitors arriving at your site right now aren't only people. They're a mix of three kinds—people, traffic via AI agents, and bots. Read the rising visit count straight as "we have more visitors" and your judgment gets pulled by the bot padding, and you misread your next move.
There are two clues for telling them apart: a mark of origin (the referrer) and behavior. Split traffic with these two and you protect the true human numbers that aren't padded, plus the revenue of a new channel—traffic via AI agents. That said, full identification isn't yet established; AI traffic that passes no mark, and skillful bots, will still slip through. So what you aim for isn't "see everything," it's "lock down the half you can see." Start by revisiting your own site's traffic on the people-only figure with bots removed, for one month. The real nature of your added traffic starts to show—in numbers, not a hunch.
See which ads actually drive revenue, at a glance
Free up to 5,000 sessions/month, AI analyst included. No credit card required. Up and running in 5 minutes.
![[Research] The Web Is Being Rebuilt for AI Agents: What Online Store Owners Should Know](/_next/image?url=%2Fimages%2Fnews%2Fagent-first-web-ec-preparation.jpg&w=3840&q=75)
