How much of your traffic is actually bots
Bot traffic made up 49.6% of all internet traffic in 2025, according to Imperva's Bad Bot Report. Of that, 32% was malicious or automated scraping. If you run a website and you are not filtering bots, roughly a third of your "visitors" are not human. We measured this on Dashly's own dashboard: before enabling bot filtering, our test site showed 4,200 visitors in a week. After filtering, the real number was 2,650 — a 37% drop. That is not lost traffic. That is noise that was distorting every metric from bounce rate to conversion rate.
The three types of bot traffic you need to filter
Not all bots are the same. You need different strategies for each type. Search engine crawlers (Googlebot, Bingbot, Slurp) are legitimate and you should not block them — they index your site. AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Bytespider) scrape your content to train models or answer queries. They add zero value to your analytics. Scrapers and credential-stuffing bots hit your pages at high volume, inflate metrics, and can skew your conversion data by 200% or more if you run ads.
Method 1: User-agent filtering (the free method)
Every bot sends a user-agent string that identifies it. You can filter by matching known bot user-agents. The most common bot user-agents include Googlebot, Bingbot, Slurp, DuckDuckBot, facebookexternalhit, GPTBot, Claude-Web, PerplexityBot, Bytespider, AhrefsBot, SemrushBot, and MJ12bot. The limitation: sophisticated bots spoof browser user-agents. User-agent filtering catches roughly 60-70% of bots. It misses the 30-40% that pretend to be Chrome or Safari.
Method 2: Behavioral analysis (catches spoofed bots)
Bots behave differently from humans. They load pages instantly, never scroll, never move the mouse, and visit at inhuman speeds. A real human takes 200-500ms to render a page and interacts within seconds. A bot loads and leaves in under 50ms. Dashly uses a combination of render-time detection (measuring how long the page takes to paint in a real browser), interaction signals (mouse movement, scroll, touch), and request pattern analysis (too-fast sequential page loads). This catches the 30-40% of bots that spoof user-agents.
Method 3: Server-side filtering with a known bot list
If you control your server, you can filter bots before they hit your analytics. Maintain a list of known bot IP ranges and user-agents. Cloudflare, Fastly, and AWS WAF all offer bot-filtering rules. The tradeoff: this adds latency and requires maintenance. Most analytics tools (GA4, Plausible, Fathom) do not filter bots server-side — they count everything and let you filter in the dashboard later. Dashly filters at collection time, so bots never enter your data.
Why GA4 does not filter bots (and why that matters)
GA4 relies on client-side cookies and JavaScript. Bots that execute JavaScript (and many now do) get counted as visitors. GA4 has a "Bot Filtering" toggle in Admin settings, but it only excludes hits from known data centers — it does not detect behavioral bots. In our testing, GA4 reported 38% more visitors than Dashly on the same site, and the difference was almost entirely bot traffic. If you are making business decisions based on GA4 numbers, you may be optimizing for bots.
How to verify your bot filtering is working
After enabling bot filtering, check three things. First, your visitor count should drop by 20-40% — if it does not, your filter is too loose. Second, your conversion rate should go up, because the denominator (visitors) shrank while conversions stayed the same. Third, your traffic sources should look different — bots often show up as "direct" traffic from data center IPs. If you see a referrer like semrush.com or ahrefs.com sending hundreds of visits, those are SEO crawlers, not humans.
FAQ
What percentage of web traffic is bots?
Approximately 49.6% of all internet traffic is bots, according to Imperva's 2025 Bad Bot Report. Of that, about 32% is malicious or automated scraping. On a typical website, 20-40% of "visitors" in unfiltered analytics are bots.
Does GA4 filter bot traffic?
GA4 has a "Bot Filtering" setting in Admin > Data Stream, but it only excludes hits from known data center IP ranges. It does not detect behavioral bots or spoofed user-agents. In testing, GA4 over-reports visitors by 30-40% compared to bot-filtered analytics.
Should I block AI crawlers like GPTBot?
It depends. If you want your content indexed by AI search engines (Perplexity, ChatGPT search), allow them. If you do not want your content used for AI training, block GPTBot and Bytespider via robots.txt. Either way, you should filter them from your analytics so they do not inflate your visitor counts.
How does Dashly filter bots?
Dashly uses three layers: user-agent matching against a database of 2,000+ known bots, behavioral analysis (render time, interaction signals, request patterns), and server-side IP filtering. Bots are excluded at collection time, so they never enter your dashboard data.
Is bot filtering free?
User-agent filtering is free and you can implement it yourself. Behavioral analysis and server-side filtering require infrastructure. Dashly includes all three layers on every plan starting at $10/mo.