My blog is full of bots and AI agents

Some time ago I wrote about how I developed my own analytics tool. I built it to respect personal data protection. So much so that it does not even need the visitor's consent. I also wrote about the problems I had to solve during development and how AI helped me along the way.

The first version already had built-in bot detection and flagging of suspicious behaviour (probable bots). It was not enough. Visits, especially direct visits, were strangely high and took an odd share of the total traffic. So I decided to dive back into the topic and improve my own analytics.

Now, after tuning it to a reasonable level, I read with interest posts where someone claims that 20% of the visits on their website are bots and 80% are humans. I have replied to a few of them, on Threads for example, saying that I used to think the same. Today I would say that on your website too, the opposite ratio is closer to the truth.

How did I arrive at this view?

My analytics tool. A switch to hide AI agents, and a note that the year-over-year comparison is understated for now, while older data still contains bots from before the filter.

What did the first version of my analytics identify as a bot?

The first version stood mainly on two things. The first was simple. I know the list of known robots and I look for their names in the browser header. Googlebot, GPTBot, ClaudeBot, Amazonbot and others. The second was a browser that does not send the page language. That tends to be a quiet sign that there is no human behind the visit.

This catches the obvious ones. But a new group of visits appeared that it does not catch. These are programs that pretend to be a regular browser. There is no bot name in the header. They have the parameters of a human. The original filter does not expose them.

Why scroll no longer proves a human

It occurred to me that I would recognise a human by activity on the page. Scrolling, reading, clicking. There was a time when a robot would not do this.

That no longer holds. These new programs actually run the page. They scroll through the article, click a button, behave almost like a human. Scroll tells me the visit showed some activity. It does not tell me whether a human was behind it.

Bot detection: several signals at once

So I stopped looking for one signal and started combining them. None is enough on its own. But when I put several together, a score emerges. It lets me mark a visit as a probable AI agent even when no single signal gives it away.

One thing mattered to me here. These marks, the scores of probable agents, I keep on my side, outside the website database. The analytics only reads from the website database and never writes these marks into it. I can then subtract the flagged visits from the numbers.

Random parameters in the URL

The score I described above exposed almost every visit that behaved like an agent.

Then came one suspicious day. Absurdly high direct traffic numbers again. I looked into my analytics tool. Random strings were appearing in the page address. For example /?subject=hafhcfdevcf or /?utm_source=afjfyfggfe. These are programs that come to the page and attach their own random code to the address. It makes no sense to me. It does to them. It is their internal tag or a test.

I spent a while thinking about how to tell them apart from a real campaign. The answer was not in the parameter name. My own links use parameters too. The answer was the value. A real campaign has a name you can read. A random string cannot be read, it is just a cluster of letters with no vowels in the right places. So that is exactly what I look for. If the value is an unpronounceable cluster, I flag the visit. If it has a human shape, a separator, a known word or a year, I leave it alone. A real campaign never gets excluded this way.

And if campaigns that are clearly not mine keep showing up in my analytics, I will deal with that too.

Bot or human: five groups instead of two

This is where my analytics and my identification of machines and humans stand today: I stopped dividing visits into just human and robot. I have five groups, and I place every visit into one of them.

A human, who viewed several pages or scrolled. An AI agent, which admits itself in the header. A probable AI agent, exposed by the score. A machine, meaning a known robot or a suspicious browser. And an unverified visit, which passed the filters but has shown no interest yet.

That last group matters. For those visits I genuinely cannot say whether it was a human or a program. So I count them on neither side.

The breakdown of my visits since 13 June 2026. Machines 52%, unverified 36%. Confirmed humans are a fraction.

What percentage of web traffic is bots?

Once I divided the visits this way, the numbers were unpleasant. Confirmed humans are only a few per cent. Machines are more than half. Unverified visits take a large share.

My work here is not finished, I want to bring more and more light into this. But machines are getting better and better at imitating a human visitor, so chasing 100% certainty makes no sense either. Today it is simply impossible. What makes sense is to clarify what can be clarified, and that is something many analytics tools do not do well enough today. And then we settle for being told that 80% of our visits are humans, although they probably are not. In this sense the internet is a dead place, and most of its actors are machines.

Added on 22 October 2026

I decided to extend this article with further findings. I found several weaknesses in the way I identify bots and other non-human visitors to my website.