How Much of Your Traffic Is Bots? Ours Was 41%

We sell analytics. That makes this a slightly embarrassing article to publish, and it is the reason it is worth publishing: the numbers below come from our own property, not a client's, and we did not like them.

Thirty days, 11 August to 9 September 2026, on ripples.sh. The dashboard said 214 new visitors. Fewer than a third of those were people.

The headline number and the number under it

208 of those visitors arrived on the Direct channel, meaning no referrer and no campaign tag. Split by device:

Tablet is 41.3% of direct traffic. We sell a developer tool. Nobody installs a tracking snippet from an iPad, and no developer-tools product on earth has a 41% tablet share.

The giveaway is not the device column though. It is the last one. 86 tablet visitors produced 86 events across 86 sessions: exactly one pageview each, one session each, and not one of them came back. Mobile is the same shape at 1.03. Desktop, the row with 30% of the visitors, carries 2,039 of the 2,186 events.

Real people are messy. They load two pages, or they bounce and return on Thursday, or they open six tabs. A population where every single member did precisely one thing precisely once is not a population of people.

Geography makes it obvious

153 visitors in the United States. 153 events. 153 sessions. Three columns of the same number.

If you take 153 real humans and count their pageviews, you get a distribution. You get a 1, a 1, a 4, a 1, a 12, a 2. You do not get 153 ones. The probability of that happening by chance is not small, it is zero, and the row is the cleanest evidence in the whole dataset.

Cyprus, at 7 visitors and 1,890 events, is us. That is the shape human usage has when the humans are two people who work here.

Windows tablets

Cross-cutting the device split with the operating system:

85 Windows visitors, 87 events between them. Windows is 40.9% of our traffic and produces 4% of our pageviews.

Set that beside the 86 tablets. Windows tablets exist, and they are roughly 2% of the Windows install base. A crawler that reports itself as a Windows device with a tablet-sized viewport is a very ordinary thing; 85 real Windows users who each looked at one page and left is not.

Two more checks, both free

Referrers. Across 208 direct visitors in 30 days, exactly one arrived carrying a referrer of any kind, and it was accounts.google.com, which is somebody logging in. Not one of the other 207 came from a link, a search or a social post. Direct traffic that is genuinely direct exists, but it is normally people who bookmarked you, and people who bookmarked you come back.

Landing paths. 179 of the 208 landed on / and went nowhere else. We publish 39 pages. A crawler fetches the homepage; a person who typed your domain in on purpose usually has a second question.

What this breaks downstream

Every ratio with visitors in the denominator.

Our signup conversion rate over those 30 days was 0 out of 214. That is a real zero and it is a bad number, but the denominator is roughly three times too big, so it is a differently bad number than the dashboard says. If we ever do convert at 2%, an inflated denominator will report it as 0.7% and we will spend a month optimising a funnel that was working.

The same arithmetic runs through channel share. Organic Search delivered 7 of 214 visitors, or 3.3%. Measured against the desktop population that actually behaves like people, it is closer to a tenth. The channel we thought was invisible is roughly three times more of what we have than we believed.

And it runs through cost per acquisition the moment you spend money. Cost per visitor is the metric most ad dashboards optimise toward, and it is the one this contaminates most directly.

The five checks

You can run all of these on any analytics tool that lets you break traffic down by two dimensions at once. None of them need a bot list.

1. Events per visitor, by device. Any device row sitting at exactly 1.00 is not people. Compare it to your best row.
2. Visitors, events and sessions by country. Look for rows where all three columns are the same number.
3. Device share against your product. A B2B developer tool with 41% tablet, or a mobile game with 60% desktop, is describing something other than its users.
4. Referrer coverage. What share of your direct traffic carries any referrer at all? Ours was 1 in 208.
5. Landing path concentration. If nearly all of it lands on / and nothing else, it is crawling, not reading.

What we are not claiming

This is inferred from the shape of the data, not from a user-agent list. We are not naming these crawlers and we cannot tell you which are search engines doing their job, which are AI training fetchers, which are uptime monitors and which are scrapers. Some of that traffic is welcome. Googlebot fetching every page we publish is the entire point of publishing them.

The claim is narrower and harder to argue with: 145 of 208 direct visitors over 30 days arrived once, loaded one page, and never returned, and the per-country event counts say they are not 145 individual people making the same choice. A number that includes them is not a number about your audience.

We are also not claiming this is unusual. Across the wider portfolio these numbers come from, our own traffic-quality filter flagged 464,340 hits as low quality in the same 30 days, across 10 of 15 projects. Ours is the property where the effect is large enough to change the headline, because our audience is small enough that a few hundred crawlers outnumber it.

Our own filter was running the whole time

This is the part we found most useful, and it is a criticism of our own defaults.

Ripples classifies automated traffic in two tiers. bot means a contradiction no shipping browser can produce, and suspect means unusual but possible. The default filtering mode, Balanced, removes the first and counts the second, on the reasoning that losing one real visitor is worse than letting ten crawlers through.

Every visitor in the tables above sailed through that. One pageview from a plausible-looking Windows tablet is not impossible. It is just not a person, and a rule built to avoid false positives will never say so on the evidence of a single hit.

The setting that does remove them is Strict, and the reason to reach for it is exactly the situation we are in: a site small enough that a few hundred crawlers outnumber the audience. On a property with 50,000 real visitors a month, Balanced is the right default and this article would be about a rounding error. On ours it was the headline.

So the practical advice is not "turn on bot filtering". It is almost certainly already on, in some tool, at a setting chosen to protect big sites from false positives. The advice is to find out which tier your tool puts single-hit traffic in, and whether your site is small enough that the conservative default is costing you the truth.

If you want to run the five checks above against your own site, Ripples is free until $1K MRR and the traffic-quality breakdown is not a paid feature. We would rather you found out that half your traffic is crawlers than that you paid us to agree with your old dashboard.

All figures in this article are from ripples.sh, 11 August to 9 September 2026, and are reproducible from the traffic-quality and breakdown views of any Ripples project.