Six in ten requests to a website are automated, and your analytics will not show you most of them

The monthly report says traffic is up. The phone has not noticed.

That gap is worth twenty minutes of anyone's attention, because the two numbers are not in conflict. They are measuring different things, and only one of them has ever paid a wage.

What the bot figures actually say

Cloudflare publishes a live view of the traffic crossing its network. Looking at it today, 21 September 2026, requests for web pages over the previous seven days split 61.5% automated to 38.5% human. Across all HTTP requests, including images, scripts and API calls, the same dashboard puts automated traffic at 36.2%.

Two numbers, both from the same source on the same afternoon, and the one people quote depends entirely on which question they were asking.

61.5%: Automated share of web page requests
38.5%: Human share of web page requests
21 Sep 2026: Cloudflare Radar, previous 7 days

Worth saying plainly what that is and is not. It is Cloudflare's own network, scored by Cloudflare's own bot detection, aggregated worldwide. It is not the whole web, it is not the UK, and it is certainly not your site. A local firm's website gets a different mix to a news publisher's. Treat it as the weather rather than the forecast for your street.

Why your analytics disagrees

Here is the part that trips people up, and it runs the opposite way to what you would expect.

Google Analytics does not see most of that. It works by running a piece of JavaScript in a browser, and a great many crawlers never run it. They fetch the page, take the text, and leave. No script, no session, no line in your report. Your server knows they were there. Analytics does not.

On top of that, Google filters. Its own documentation says traffic from known bots and spiders is automatically excluded, identified using a combination of Google research and the International Spiders and Bots List maintained by the Interactive Advertising Bureau. The same page says you cannot disable that exclusion, and you cannot see how much was excluded.

So the honest position is not that your analytics is a third fiction. It is that your analytics is a partial and silently filtered view, with no way to audit what it removed, and a real gap between it and what your server actually served.

Which report are you being shown

Before deciding any of this matters, find out what the number on the front page of your report is counting. They are not interchangeable and they do not come from the same place.

Sessions or users, from Analytics. Filtered as described, blind to non-JavaScript crawlers.
Hits or bandwidth, from server logs or a hosting panel. Everything, including every crawler, and usually a much bigger number.
Impressions, from Search Console or an ad platform. Times something of yours appeared, which is not a visit at all.

A report that mixes them, or that quotes the biggest of the three without saying which it is, is not necessarily dishonest. But it is the shape a flattering report takes, and the question "which of those is this" is a fair one to ask in a review meeting.

The number to promote instead

None of this is a reason to go bot-hunting. It is a reason to stop putting traffic at the top of the page.

Bots do not fill in your contact form, ring the office, or book a slot. The figures a small firm can actually trust are the ones that touch a human process at the end, and most local businesses already reconcile them without calling it analytics.

01Count enquiries, calls, quote requests and bookings, by month
02Record where each one came from at the point it arrives, not by guessing later
03Put that count on page one of the report and traffic on page three
04Judge any marketing spend against the first number

The second step is the one that gets skipped, and it is the one that makes the rest possible. If the origin is captured against the record when the enquiry lands, the monthly figure is a by-product of work people were doing anyway. If nobody captures it, you are reduced to asking the customer how they found you and hoping they remember, which is how "word of mouth" ends up as the largest category in every report it appears in.

If traffic doubled and enquiries did not, one of those numbers is telling you something, and it is not the big one.

Three questions for whoever produces your report

Ask them plainly. A competent agency will have good answers and will not mind being asked.

Is this figure filtered, and filtered how. Can I see the same period with only converting sessions in it. And when traffic moved last month, which specific sources moved, by name.

That last one matters most. "Traffic is up 30%" and "traffic is up 30% and all of it is one crawler working through your site" look identical on a line chart and mean entirely different things.

The unhelpful bit

Two things I would not do on the back of this.

I would not buy bot protection because of a percentage in an article. Bot management earns its money on sites under actual attack or paying for bandwidth by the gigabyte, and a brochure site on ordinary hosting is usually neither.

And I would not treat all the automated traffic as theft. Some of it is search engines doing the job that brings you customers, and some of it is AI tools reading your pages in order to recommend you, which is a real route to work now. We have argued before that the panic about AI and local search is pointed at the wrong thing, and this is the same shape of mistake one level down. The problem is not that software reads your website. It is being shown a number that counts software and calling it an audience.

We run search and digital marketing for clients and report on it monthly, which is why this is written from the reporting rather than the commentary. If your traffic and your enquiries have stopped agreeing with each other, that is worth a conversation. We work with businesses across Knutsford, Alderley Edge, Wilmslow, Altrincham, Stockport and Warrington, and remotely for clients anywhere in the UK.