What Is Bot Traffic? Causes That Skew Channel and Ad Evaluation, and How to Exclude It

"I checked my analytics and traffic from one source had suddenly spiked. Maybe a new channel finally hit." Have you ever felt that and started shifting budget and effort toward it?

The bottom line: that traffic may not be human — it may be bots. Bots now account for 53% of all internet traffic, finally surpassing humans (47%) [1]. The problem is not that bots show up. It is that you mistake bot-inflated traffic for an "effective channel," pour budget into an invalid source, and overlook the channel that is actually growing.

Below we cover why bots blend into channel evaluation, the types of bots you can expect, the misjudgments they invite, and how to spot and exclude them — from an EC operator's practical perspective.

Key takeaways#

1. Bots make up 53% of all traffic, surpassing humans

   In Thales (formerly Imperva) research, 53% of all internet traffic came from bots and other automated access, surpassing human visits (47%) for the second year running. Of that, bad bots account for 40% and good bots (search engines and the like) for 13%.

2. GA4 automatically removes only "known" bots

   GA4 automatically excludes known bots and spiders, but its target is only what is on the blocklist (the known-bot list); any bot not on the blocklist passes straight through. And you cannot see how much was excluded.

3. Bot inflation throws off both ad and SEO decisions

   Mistake a source padded with zero-second bots for your "fastest-growing channel," and you pour ad budget into an invalid path while also spending SEO effort on pages and keywords that produce nothing.

1. What bot traffic is — and why it blends into channel evaluation#

The bottom line: a bot is access generated automatically by a program, not a human opening the page.

A bot is an automated-access program run by search engines, social platforms, and various tools. In Thales (formerly Imperva) research, 53% of all internet traffic came from bots in 2025, surpassing human visits (47%) for the second year running. Of that, bad bots account for 40% and good bots such as search engine and AI crawlers for 13% [1]. With the spread of generative AI, automated access has only increased.

Bots blend into channel evaluation because many of them are recorded as "traffic with a referrer." For example, when you paste your site's URL into a social post or the description box of a video, a bot automatically opens the page to read its contents. In your analytics, that access remains as "traffic from that social platform or video site."

In other words, "traffic from a new channel" rises in your numbers even though no human visited. The next section sorts out which kinds of bots get mixed in.

2. The types of bots to expect — which ones mix into your traffic#

The bottom line: bots come in different kinds with different purposes — some blend into analytics easily, others do not.

Not all bots are alike; their purposes vary widely. The main types sort out as follows.

Search engine crawlers (such as Googlebot) crawl pages to build search results. Their identity is clear, and because their name is included in the user agent (the information identifying the browser type), tools like GA4 exclude most of them automatically [2][3].

The ones to watch are bots that hide inside referred traffic. Link-preview bots for social platforms and chat apps open a page to build a summary card of the pasted URL. These remain as "traffic from that social platform," and some disguise themselves as browsers to hide their identity, so analytics tools cannot fully exclude them. SEO analysis tools, uptime monitoring services, price-scraping crawlers, and AI training crawlers can mix into your traffic as well.

3. Where the loss is — bot inflation throws off both ad budget and SEO decisions#

The bottom line: mistake bot-inflated numbers for "results," and you pour both ad budget and SEO effort in the wrong direction.

This is where the real loss begins. I nearly fell into this trap running my own site. Traffic from one video site appeared to be the "single largest channel per day" within days of launch. Naturally, it felt like a source that was taking off.

But when I looked closer, all 9 sessions on that path had zero seconds of dwell time. A crawler reading the URL I had pasted in a video description had simply been opening the page mechanically. Not a single human had visited. And I had been rating it as my "fastest-growing channel."

When bot inflation goes unnoticed, the misjudgment unfolds along two axes:

1. You get ad investment wrong — you judge a bot-inflated path as an "effective channel" and shift budget toward a source with no humans and no revenue, while undervaluing the unglamorous channel that genuinely drives sales.
2. You get SEO wrong — when crawlers from SEO tools and the like make one page look heavily trafficked, you keep pouring effort into pages and keywords that produce nothing, or you write off a promising one as "ineffective."

Both start going wrong the moment you trust the raw traffic count at face value. For another pitfall where search numbers go missing, see The Real Reason Your Search Console Clicks Don't Add Up; for how to read cost per click, see What Is CPC? The Formula, Industry Benchmarks, and How to Lower It as well.

4. Spotting and excluding bots — scrutinize by traffic volume and dwell time#

The bottom line: combine traffic volume with average dwell time and you can see bot inflation.

You cannot reduce bots to zero, but you can spot and exclude them. The key is behavior. A human who opens a page dwells for at least a few seconds and may view multiple pages. Most bots open a single page, dwell zero seconds, and leave.

As the matrix above shows, arranging channels by "traffic volume × average dwell time" makes their character clearly distinct.

1. High volume but near-zero average dwell — suspect bot inflation first. Exclude it and scrutinize whether any human visits remain.
2. High volume with real dwell — a genuine flagship channel. You can shift budget toward it with confidence.
3. Low volume but with dwell — small but genuine traffic. A candidate to nurture.
4. Repeated access to the same page at the same time — the textbook signature of mechanical access. Evenly spaced, same-page duplicates are a bot sign.

GA4 automatically excludes known bots, but only those on the blocklist (the known-bot list) maintained by the IAB. Bots not on the blocklist, and bots that hide their identity, pass straight through — and you cannot see how much was excluded [3]. So "it's safe because it's auto-excluded" is not something you can assume.

5. Only after excluding bots can you judge investment by revenue#

The bottom line: look not just at traffic counts but all the way through to revenue, and bots stop throwing you off.

The danger of bot inflation is that you cannot notice it by watching traffic figures alone. The only reason I caught my own misjudgment was that, when I lined up average dwell time across channels side by side, one path stood out at zero seconds. Had I watched traffic counts alone, I would have kept believing it was my "best channel."

The same pitfall shows up in other metrics. Traffic whose source is unknown getting lumped into Direct, and the bias of crediting only the last ad — both stem from the same problem of "deciding on only the part you can see."

• For how unknown sources fall into Direct, see 5 Causes of Rising GA4 "Direct/(none)" Traffic and How to Fix Them
• For the bias that distorts ad evaluation, see The Last-Click Trap That Skews Ad Budget Decisions
• For designing KPIs back from revenue, see Marketing KPI Design — Five Layers Working Back From Revenue

That is exactly why you should not stop at traffic counts but ultimately judge by revenue. If you read all the way through to "how much revenue that access generated" per channel in one line, it becomes far harder to mistake a zero-second, zero-revenue path for an "effective channel." The thinking is laid out in What Is RPS? The Metric, Formula, and How to Get It in GA4.

RevenueScope already filters out identifiable bots using user-agent and server signals—on our own site, about a quarter of our traffic was flagged as bots. The cloaked crawlers that still slip through get caught too: it spots behavior like a single-page visit with zero dwell time and drops them from the numbers. Once you evaluate the remaining human traffic by revenue, budget stops getting siphoned off by a bot-inflated "apparent winner." Looking from revenue first is the shortcut to avoiding measurement pitfalls.

6. FAQ#

Q. If I use GA4, are bots automatically excluded?

Known bots and spiders are excluded automatically. But this covers only the bots on the blocklist (the known-bot list) maintained by the IAB; bots not on the blocklist, and bots that hide their identity, pass straight through. You cannot see how much was excluded either, so relying on auto-exclusion alone is risky.

Q. Where do I look to tell whether traffic is from bots?

Average dwell time and page count are the clues. Suspect bot inflation on a path with high traffic but near-zero average dwell, where only one page is opened before leaving, or where the same page is accessed repeatedly at the same time.

Q. Should I care even if I only run a small amount of advertising?

Yes. Bot inflation throws off your judgment of whether a channel is good or bad, so it matters regardless of budget size. If anything, in the low-traffic launch phase, a small number of bots can move the numbers a lot and lead easily to misjudgment.

Summary#

Bots now make up 53% of all internet traffic, finally surpassing humans, and many of them blend into analytics as referred traffic. GA4 automatically excludes only the known bots on the IAB blocklist (the known-bot list); bots not on the blocklist pass straight through, and you cannot see how much was excluded. The real loss is not that bots show up, but that you mistake a zero-second, invalid path for your "fastest-growing channel" and get both your ad budget and your SEO effort wrong. Combine traffic volume with average dwell time to spot bots, and ultimately read all the way through to revenue. That keeps your budget from being siphoned off by a measurement pitfall.

Related articles#

• 5 Causes of Rising GA4 "Direct/(none)" Traffic and How to Fix Them
• The Last-Click Trap That Skews Ad Budget Decisions
• What Is RPS? The Metric, Formula, and How to Get It in GA4
• What Is CPC? The Formula, Industry Benchmarks, and How to Lower It
• Marketing KPI Design — Five Layers Working Back From Revenue

References#

• Thales, "2026 Bad Bot Report", 2025 [1]
• Google Search Central, "Googlebot" [2]
• Google Analytics Help, "Exclude known bot traffic" [3]