Nearly half of all internet traffic came from bots in 2023. The Imperva 2024 Bad Bot Report, published by the cybersecurity firm Imperva (a Thales company), put automated traffic at 49.6% of the total, the highest share since Imperva began tracking it in 2013, with bad bots alone accounting for 32%. So if a dashboard tells you a site got 10,000 "visits" last month, a sizeable chunk of those were never people. The harder question is which chunk, and how to count the humans who remain.
Why edge and server metrics overcount humans
Every request a browser or bot makes touches a server, a content delivery network (CDN), or both. Tools that count traffic at that layer (web server logs, CDN dashboards, reverse-proxy stats) tally raw HTTP requests. That is exactly why they overcount real people: a request is cheap, and most automated clients can issue one without behaving anything like a human.
Many crawlers never execute JavaScript. They fetch the HTML and move on. OpenAI's GPTBot, the crawler it uses to collect training data, identifies itself with a user-agent string containing GPTBot and pulls page content the same way a simple HTTP client would. Search and AI crawlers like it generate server hits but never load the analytics script that fires on a real page view. The result: a CDN's "visits" number sits well above the count of people who actually rendered your page.
JavaScript-based analytics sit on the other side of that line. They only count sessions where a browser downloaded, parsed, and ran the tracking code, which excludes most non-rendering bots by construction. First-party owned events (your own server or app recording a signup, a purchase, an activated event tied to a real user) are tighter still, because they reflect an action a person actually completed rather than a page that merely loaded.
The rise of AI crawlers
The volume problem got worse in 2023. OpenAI introduced GPTBot in August 2023, and a wave of AI training and retrieval crawlers followed from other companies. Cloudflare's managed AI-crawler controls now recognize a long roster of them, including GPTBot, Anthropic's ClaudeBot, ByteDance's Bytespider, and Common Crawl's CCBot, per Cloudflare's bot documentation. Imperva attributed part of the 2023 jump in simple automated traffic directly to the popularity of AI tools.
These crawlers are not malicious in the way a credential-stuffing bot is, and many of them honor robots.txt. But they still inflate raw request counts, and they make a server-side "traffic" figure increasingly unreliable as a proxy for human interest.
Signals that separate bots from humans
No single signal is decisive, but several combine into a reasonable judgment.
User-agent string. The cheapest tell. Verified crawlers announce themselves (GPTBot, Googlebot), and Cloudflare maintains a verified-bots list so legitimate ones can be confirmed by reverse DNS rather than the easily spoofed string alone. Malicious bots lie here, so user-agent is a starting point, not proof.
navigator.webdriver. In a real browser this property is false; when a page is driven by automation such as Selenium or headless Chrome, it reads true, as MDN documents. It catches naive automation but not bots that patch the flag.
Behavior. Humans move a mouse, scroll unevenly, pause, and take seconds between actions. Many bots request pages in tight, perfectly timed sequences with no interaction events at all. Timing and interaction patterns are among the harder signals to fake at scale.
Network origin. Residential traffic comes from consumer ISPs; a large share of automated traffic originates from datacenter autonomous system numbers (ASNs) belonging to cloud providers. Datacenter origin is suggestive, though privacy tools and corporate networks muddy it.
Why a CDN's "visits" is not your visitor count
Stack the points up and the gap is clear. A CDN dashboard counts requests at the edge, including the AI crawlers and simple bots that make up a large slice of the ~50% automated traffic Imperva measured. It cannot run navigator.webdriver, has limited behavioral signal, and treats a GPTBot fetch the same as a person reading the page. Its "visits" answer the question "how many requests hit my edge," which is genuinely useful for capacity and caching, but it is not "how many humans showed up." Treating the two as equal is how a site convinces itself traffic is up when human attention is flat.
Getting closer to a real human count
The most resilient approach combines two layers. First, count humans where they take real actions: first-party owned events recorded by your own backend, tied to identifiable, deduplicated users. A signup or a completed checkout is hard for a passive crawler to fake. Second, apply bot filtering to whatever client-side analytics you keep, using the signals above to drop known crawlers and obvious automation before you report a number.
This is the model VibesAnalytics is built around: owned first-party events as a human-leaning source of truth, less exposed to the crawler inflation that distorts edge metrics. It is a more honest baseline, not a magic one.
Be clear about the limits. JavaScript analytics undercount humans, because roughly 29.5% of internet users run ad blockers at least some of the time (Backlinko, citing GWI), and some of those block trackers too, erasing real people from the count. Meanwhile, sophisticated bots increasingly render JavaScript and execute pages in headless browsers, so they sneak past JS-only counting. No method captures exactly the humans and only the humans.
The practical stance: use edge and CDN numbers for infrastructure, treat them as an upper bound on humans, and lean on filtered analytics plus first-party owned events for anything you would call a "visitor." When two sources disagree, the gap is usually telling you how many of those "visits" never had a pulse.