Most of Your Traffic is Not Human

[keyplyr]

It's a disappointing but eye-opening statistic that most of the traffic to our websites is not from actual people. In fact, well over half of our traffic is not human.

Bot traffic is in an uptrend. Most of this is from bad bots, or at least by bots that are not beneficial to our interests (depending on site model.)

Here's the estimated breakdown*:
• 28% Search Engine & other good bots
• 10% Scrapers & Downloaders
• 5% Hacking tools & scripts
• 1-3% Automated link spam
• 12% Other impersonators

Analytics & site reporting software is easily fooled by bots masquerading as human. That's not what they are built to do.

*based on 10k daily page loads (YMMV)

[NickMNS]

There is a believe that Google ranks sites base on certain GA stats, such as bounce rate, page speed and others. There is no evidence to support this, and Google denies it. None the less some may use this as a form of negative SEO. That is where sites are "attacked" by bots or bot nets to mess with the GA stats or to slow the site down in order negatively impact Google page speed measure.

[keyplyr]

That is where sites are "attacked" by bots or bot nets to mess with the GA stats or to slow the site down in order negatively impact Google page speed measure.

That wouldn't make sense. To effectively accomplish something like this the bot campaign would need to continually hit a site 24 hours a day, 7 days a week with enough impact to change that site's metric. Highly unlikely.

[NickMNS]

To effectively accomplish something like this the bot campaign would need to continually hit a site 24 hours a day, 7 days a week with enough impact to change that site's metric.

I agree fully agree, but actual effectiveness has little do with it. The scam just needs to be plausible. There are plenty of snake oil sales people out there selling all kinds of other stuff that is ineffective.

[lucy24]

To effectively accomplish something like this

They might not accomplish their underlying purpose, i.e. to affect your SEO, but they can certainly accomplish a secondary purpose of confusing and annoying you.

[keyplyr]

confusing and annoying you.

A lot of things do that!

[born2run]

My site is being visited by "invalid traffic" which means bots, ddos scripts, etc. So this artificial traffic issue is a real problem. Don't know if someone's doing this on purpose..

[keyplyr]

My site is being visited by "invalid traffic" which means bots, ddos scripts, etc. So this artificial traffic issue is a real problem. Don't know if someone's doing this on purpose

It's not artificial, all traffic is real traffic... some human, some not. "Invalid" only to Adsense because they're only validating human traffic.

Yes, this is done on purpose, it's not an accident. This is just all the bots that are being discussed in this thread. Some are beneficial, some are not.

Almost certainly not a DDoS attack... you're not that important :)

[Nutterum]

Thread Necromany is real, however recently I had the opportunity to look under the hood of a huge website. So read below :

A piece of advice from a guy who has seen the Google Analytics Premium stats of a 150k sessions(confirmed human visits!) a day site and a custom made bot analytics system that tracks both good, bad and labeled as "strange" bots, DDoS threats, bot-nets, the works.

There are around ~2000 bots with another 1000 strange bots circulating around the web at any given time. If you decide to increase your website footprint by heavily interacting with social media or manage to get into one of those content aggregation sites, you will get anywhere between 150 and 300-ish visits. If God forbid you are using Wordpress, you might get 50-60 scrapers and another 100 or so "hack checkers" basically bad bots, that try to get as much info for your WP setup as they can so then their owners can sell the info to bot-net farm builders, who then trash your website and use it to funnel either fake ad revenue or trash your ad campaign - whichever works better/is paid for.

Now the strange bots, are strange because they are from little-known sources, and their behavior is inconsistent. Maybe these are old or poorly made bots, or some experimental scripts, who knows. The server admins had little clue as well.

What was explained to me was that, if I have a new website and am not careful about it and how I read the GA data, I might think I am doing OK while being in the gutter. At the same time GA is doing OK job of protecting the data, so long as we talk about small-scale stuff that is not in the internet BS business (reselling, traffic funneling, ad revenue site, etc, etc.) I should not be bothered with obsessing over fake traffic, because the data GSC and GA shows will be accurate enough (85%+).

The problem starts when you have 7-8k human sessions per day going to your site. Then the bot-nets kick in and might try to mess with you and your stats unless you are operating in a quiet corner of the web. But if you are in the money pile(luxury rentals for example) then expect some #*$! traffic coming your way.

I asked about zombies too. It was explained to me that to their knowledge the only zombie-like behavior is coming from mobile mainly from apps. Perhaps some content aggregator apps that do a poor job at doing what they do, thus people click on your site, enter, see nothing of value and then leave. None of these guys had any info about Google throttling visitors or sending crap traffic. What they did say however is that there was around 50k daily traffic that was just not converting in any direct or non-direct way - not even smart goals or any meaningful GA events. They were categories as "bookmarks" because they behave as people who bookmarked the site and open it every day just to check if there is anything new, then bounce straight off there.

My personal experience - as soon as I moved hosting to Amazon and started using Cloudflare and IP blocked everything but 4 countries and the EU, my traffic relevance jumped close to 95% which is all I really care about.

[samwest]

Good post nutt - as far as WordPress goes, the best defense is to use a CDN like Cloudflare to set up deliver a challenge page to "visitors" from bad actor countries or where you just never intend to offer products or services.