Most of your website visitors are bots: how to check

For weeks, our own website dashboard told us a happy story. More than 2,000 visitors from the USA. A busy site. Growth.

We are a small web and software studio with one office, in Udupi. Our website is written for businesses on the Karnataka coast. So we asked a simple question: who were all these Americans?

Most of them were not people. Neither were most of our other "visitors". This post shows what we found on our own site, how we found it, and how you can check yours in an afternoon.

Our dashboard counted machines as people

Our website records every page view on its own server, not only in Google Analytics. Between 30 July and 2 October 2026 it recorded more than 13,000 page views.

Until 25 September, the dashboard counted many machines as visitors. The top American cities were Ashburn, Mountain View, Altoona and DeKalb. Look at the first three:

• Ashburn, Virginia, is in Loudoun County. The county says it has "the highest concentration of data centers anywhere in the world". A data centre is a building full of rented computers, called servers.
• Mountain View, California, is where Google's parent company has its head office.
• Altoona, Iowa, has a large Meta data centre campus. Meta owns Facebook, Instagram and WhatsApp.

Nobody in a server hall in Iowa is shopping for a website in Udupi. These were machines.

Here is what the old dashboard counted as people:

• Link-preview robots. When someone shares a link on a Meta app, Meta's crawler, facebookexternalhit, fetches the page to show its title and picture. Another one, meta-externalagent, reads pages to train AI models and index content. A crawler is a program that reads web pages on its own.
• Speed tests. Chrome-Lighthouse is the tool behind Google's PageSpeed Insights. Every test loads your page, just like a visitor. (We explain speed scores in why slow websites lose rankings in India.)
• Requests with no browser name. A real browser always says what it is. These said nothing.
• The owner. On 24 September 2026, one "visitor" from Udupi viewed 252 pages. That was the studio's owner, working on the site.

This is not the first time robots fooled our numbers. Our newsletter list once had 306 signups, and every one of them was a bot.

What happened when we filtered out the machines

On 25 September 2026 we added a filter. It marks a request as a machine if:

• it has no browser name;
• it has no language setting (a real browser tells the site which language its user reads);
• it uses a known robot name;
• it asks for pages that break-in scanners look for, such as /wp-login.php;
• it comes from a data-centre internet address.

Staff who are signed in are not counted at all.

Page views from before 25 September carry no mark, so every share below covers 25 September to 7 October 2026 only. We counted "visitor-days": one visitor seen on one day.

• 87.6% of page views were machines.
• 67.6% of visitor-days were machines, about two in three.

The "people" who were still robots

Then we looked closely at the third that the filter let through. They were odd.

88.7% of them, almost 9 in 10, were single-page visits from outside India. The top countries were Brazil, Bangladesh, Turkey, Argentina, the Philippines, Venezuela, Vietnam, Singapore, Pakistan and the USA. They arrived in every hour of the day and night, at a fairly even rate. About two in three landed on deep service and town pages. Only about one in eight landed on the home page, where a real first-time visitor usually starts.

Real customers do not behave like this. A business owner on the Karnataka coast does not open one page from Venezuela at 3 a.m. and vanish.

It is the pattern of a crawler using residential addresses: home internet connections that are rented out, so a robot looks like a person at home. Imperva's 2025 Bad Bot Report lists "using residential proxies, faking browser identities" among the ways bots avoid being caught.

So we tried a strict test for a real visitor: from India, and either viewing two or more pages or arriving from a real search or link. Fewer than 1 in 100 visitor-days (0.9%) passed.

That test is harsh. A real person who reads one page and leaves fails it. But it shows how far a raw visitor count can sit from the truth.

Other robots that pretend to be visitors

• The daily check. A "visitor" from Mumbai opened our home page once a day, every day, and nothing else. It was almost certainly a monitoring service, checking that the site was up.
• Fake Google visits. A referrer is the address of the page a visitor came from. The browser passes it on. Between 29 August and 4 September 2026, 20 page views from Santa Clara, USA, claimed to come from a Google search for "whirldesigns". But by default, modern browsers pass on only the site's main address, such as https://www.google.com/, when moving from one secure site to another. The search words are not sent. A "Google" referrer that shows the search words is very likely made up.
• Break-in scanners. Robots asked for /wp-login.php 81 times, /xmlrpc.php 38 times and /.env 4 times. Our current site does not run WordPress. The first two are WordPress entry points that attackers try passwords on. A .env file often holds passwords and keys. These robots try every site, hoping one door is open. A website security audit checks that yours is shut.

This is normal now, everywhere

Our site is not special. The 2026 Bad Bot Report from Thales, Imperva's parent company, says: "In 2025, bots made up more than 53% of all web traffic, up from 51% the previous year, while human activity fell to 47%." Cloudflare's 2025 Year in Review found that people made 47% of the requests for web pages that it saw.

Those are averages across the web. A small local site gets few real visitors, so robots take a much bigger share. On ours, counted on our own server, it was 87.6% of page views.

Google Analytics 4 does help. It automatically excludes "known bots and spiders", using Google's research and a list kept by the Interactive Advertising Bureau. You cannot switch this off, and you cannot see how much it removed. But a list of known robots will miss many that use a normal browser name and a home internet address.

How to tell a real visitor from a robot

Open your analytics and check these signs. No single sign proves anything. Three or four together usually do.

Then look for yourself. Hundreds of page views in one day from your own town are usually you or your staff, not a keen customer.

What to count instead

Stop counting hits. Count the things only people do.

• Search Console clicks. Google defines a click as "How often someone clicked a link from Google to your site." Robots that come to your site directly are not in it. Search Console also shows which searches bring people to your site.
• Calls. Count them, and ask each caller how they found you.
• WhatsApp chats. Count every new enquiry that arrives by chat.
• Form enquiries. Count real ones only. Spam and your own test messages do not count.

We checked our cleaned numbers against Google's. For August, our own count of visits from Google and Search Console's count of Google clicks were the same: 15 and 15. Search Console and enquiries are the numbers we trust now.

One warning. When someone taps a call button or a WhatsApp button on your site, their phone calls you or WhatsApp opens. Your analytics may show nothing at all. With its enhanced measurement switched on, GA4 records clicks on links that lead "to another website". A WhatsApp link may land there, mixed in with every other outside link. A call button is not a website link at all. Unless each button is tracked on its own, your best enquiries stay invisible.

Your Google Business Profile keeps its own count: "The number of times a customer clicked on the call button on your Business Profile." That is worth watching too. Our Google Business Profile guide explains why that listing matters so much for a local business.

What you can set up in one afternoon

1. Google Search Console. It is a free service from Google. Add your site, prove you own it, and note the clicks and searches in the Performance report each month.
2. Google Analytics 4, without your own visits. In Admin, go to Data streams, Configure tag settings, Define internal traffic, and add your office's internet address. Then, under Data filters, create the Internal Traffic filter, leave it in Testing while you check it, and switch it to Active. Google warns that an active filter's effect is permanent, and filters do not change past data. This catches a fixed office connection. It will not catch your phone on mobile data, whose address usually changes.
3. Tracking on WhatsApp and call buttons. Give each button its own named event, such as whatsapp_click and call_click. Google Tag Manager or a few lines of code can do this. Then mark both as key events in Admin, under Events. Google describes a key event as one that "measures an action that's particularly important to the success of your business." If you would rather not do it yourself, this is what our analytics and conversion tracking work covers.
4. A one-page monthly sheet. Write down Search Console clicks, calls, WhatsApp chats, form enquiries and new customers. Five numbers, once a month. They will tell you more than any visitor counter.

Common questions

Why does my website get so many visitors from the USA?

On our site, most of them were machines, and the top cities were data-centre and tech-company towns. A simple counter shows all of them as visitors. If you sell only in India, check the cities. Ashburn and Mountain View point to machines, not customers.

Does Google Analytics remove bot traffic?

Partly. GA4 automatically excludes known bots and spiders, using Google's research and the Interactive Advertising Bureau's list. You cannot see how much it removed, and it will miss many robots that look like ordinary browsers on home connections.

Can bot traffic harm my website?

Much of it only spoils your numbers. Some of it is looking for a way in, through login pages and files that hold passwords, like the scanners above. Some fills in forms, as our newsletter list showed us. Keep your software updated and your forms protected.

My website gets visitors but no enquiries. Why?

First, check that the visitors are people. Compare your Search Console clicks with your visitor counter; if the counter is far higher, the gap is mostly machines. Then check that calling or messaging you takes one tap on a phone.

See your real numbers

Whirl Designs is a small web and software studio in Udupi. We can set up Search Console, filter your own visits out of GA4, and track your call and WhatsApp buttons, so you know how many real people find you each month. Message us on WhatsApp at +91 99025 67645, or write to us through our contact page.