Not all of your web traffic is from real visitors. Bots are software applications that access and browse your site, and they can impact your online store in positive and negative ways. Bot traffic detection can sort the good bots from the bad bots.
Imperva’s 2025 Bad Bot Report found that automated traffic accounts for more than 51% of all internet traffic. Bad bots, the ones focused on data scraping, account hijacking, and inventory manipulation, accounted for 37% of that total. These bots may inflate your analytics or scoop up limited-edition inventory for resale before your real customers get a chance.
There are also good bots working in your favor; approximately 14% of bot traffic is useful. For instance, search engine bots index your product pages so shoppers can find you on Google. Bot traffic detection helps you better understand your site patterns by separating genuine revenue-generating visits arising from humans versus automated activity. Learn how bot traffic works and how to protect your store.
What is bot traffic?
Bot traffic is any visit to your website generated by software rather than a human. These automations run scripts that engage with web pages the same way a browser would, sending out HTTP requests (messages to the server asking it to take an action, like loading a page) and getting responses, but without a person behind the device screen.
Bad bot traffic can skew your conversion rates, waste your ad spend by inflating clicks, and even stall or crash your website during a product release. Some bad bots are built to scrape your pricing data for competitors, deny inventory by holding items in carts without purchasing, or commit payment fraud with stolen credit cards.
However, good bots like Googlebot and Bingbot crawl and regularly index your ecommerce shop for search results. LLM crawlers feed AI answer engines that support generative engine optimization (GEO) and your visibility in answers from Perplexity and ChatGPT.
Indicators of bot traffic
To spot bot activity on your store, you need a baseline of what “normal” looks like to understand unexpected deviations. Some signs are more obvious, while others only show up when you dig into the data. These are some signals to follow:
-
Abnormal spikes in traffic with no clear source. You didn’t run a summer marketing campaign, and you didn’t go viral on TikTok, yet sessions doubled overnight. Automated bots can hit sites in waves, especially scrapers programmed to pull pricing or product data on a set schedule.
-
Unusually high bounce rates. If your bestselling product page suddenly shows a 98% bounce rate while every other page holds steady, that page may be a target. Bots tend to land, grab what they need, and leave without clicking deeper around your store.
-
Sessions with zero engagement time. Real shoppers tend to scroll through your website, hover over product photography, and click through content. A cluster of sessions lasting under one second with no page interaction signals that the visitor may not be human.
-
Suspicious geographic patterns. Bots frequently operate from data centers or proxy networks concentrated in specific locations. If your store ships to the US and Canada, but you’re getting a sudden flood of sessions from IP addresses in regions you’ve never marketed to, something fishy might be going on.
-
Cart and checkout anomalies. If you see a rush of add-to-cart events that never convert, or a frenzy of failed payment attempts in quick succession, you could be dealing with inventory-hoarding bots or card-testing fraud. Human shoppers don’t enter 30 different credit card numbers in three minutes.
How to detect bot traffic in Google Analytics
If you’re an ecommerce brand, having Google Analytics connected to your store helps you understand visitor patterns, get visibility into your top-trafficked pages, and see conversion activity—both organic and paid. But Google Analytics is also one of the first places to detect bots hitting your store. GA4 does filter out some known bots automatically, but some slip through.
You can detect the rest with manual investigation:
-
Open your GA4 and navigate to Reports > Acquisition > Traffic acquisition. The traffic acquisition report gives you a top-level view of where your sessions are coming from. Look for traffic sources you don’t recognize or referral URLs that seem irrelevant to your store.
-
Examine engagement by traffic source. In the Traffic acquisition report, add a secondary dimension for “Session default channel group” and sort by engagement rate. Channels showing engagement rates near zero or session durations under two seconds may be bot sessions.
-
Check for startling spikes in the Realtime report. Go to Reports > Realtime and watch for abnormally high concurrent user counts, especially from a single geography or source. If you see 400 users on your site from one city at 4 a.m. on a Wednesday, investigate.
-
Review the landing page report for anomalies. Navigate to Reports > Engagement > Landing page. If a single URL is attracting a disproportionate number of sessions relative to the rest of your store, bots may be targeting that page. Product pages with pricing data are common targets for price-scraping bots.
-
Create an exploration with segments for odd behavior. Try GA4’s Explore feature to create a segment of sessions with zero engagement time, single-page visits, and a direct traffic source. If that segment accounts for a large and growing share of your total sessions, you may have a bot problem.
How to exclude bot traffic from Google Analytics
If your analytics are inflated by bots, your conversion rate may look lower than it really is, and your traffic reports suggest growth that isn’t real. Here’s how to tighten things up in GA4 by filtering out targeted traffic:
1. Define internal traffic rules to catch known bot IPs. Under Admin > Data Streams > your stream > Configure tag settings > Show all > Define internal traffic, add any IP addresses or IP ranges you’ve identified as bot sources. Label them so you can review them later.
2. Create a data filter for developer or internal traffic. Navigate to Admin > Data collection and modification> Data filters. Create a new filter using the “Internal traffic” filter type. This lets you exclude the IPs you tagged in the previous step from your reporting data.
3. Set the filter to “Testing” before going live. Run new filters in testing mode first so you can preview the impact without permanently impacting your data.
4. Activate the filter once you’ve validated it. Switch the data filter from “Testing” to “Active.” From this point, sessions matching your defined rules will be excluded from standard reports. For a less permanent approach, you can opt for report filters instead.
5. Revisit your filters regularly. Bot behavior is constantly changing, due to the ever-evolving strategies of the malicious actors who run them. The IP range hammering your store today might go quiet next month while a new one spins up. Set a routine reminder to review your filters and refresh them based on your bot traffic data.
Limitations of Google Analytics bot filtering
GA4’s built-in bot filtering catches bots they detect through their own research and those that appear on the IAB/ABC International Spiders and Bots List. Unfortunately, that doesn’t cover everything.
Sophisticated bots increasingly rotate through residential IP addresses, spoof their user agent strings to look like regular browsers, and mimic human-like mouse movements and scroll behavior. These bots may not trip GA4’s automatic filters because they’re designed to look like legitimate users.
Tips for protecting your site from bot activity
- Use your platform’s built-in bot filtering and protection
- Protect high-demand product drops
- Harden your store’s technical defenses
- Screen orders for fraud signals
No single tool catches everything. Your best defense against bad bots is a strategy that layers platform-level protections with analytics monitoring. If you’re on Shopify, you already have built-in bot detection and filtering integrated into your store. Here’s how to manage those tools and other tips:
Use your platform’s built-in bot filtering and protection
Shopify gives store owners several native tools to handle bot traffic without installing extra apps. In Shopify Analytics, you can apply the “Human or bot session” dimension to filter bot traffic from your reports, giving you a clear view of human versus bot conversion rates and letting you assess traffic sources by bot behavior. You can see exactly how much of your traffic is real and make confident choices about inventory and sales promotions based on real customer activity.
On the security side, Shopify uses Cloudflare for web application firewall and DDoS protection, along with hCaptcha to automatically block bots before they get to your storefront. You can also use Shopify Analytics to keep a watchful eye on traffic spikes and patterns, so you can spot unusual bot activity as it develops rather than after it’s already muddied your data.
Protect high-demand product drops
If you run flash sales or limited-edition releases, automated bots can buy out your stock in seconds. Just like humans, they add products to their carts and finalize purchases, but quicker than a flesh-and-blood shopper could type their name and shipping address.
For Shopify Plus merchants, bot protection for flash sales is a dedicated feature that blocks checkout bots during high-demand product drops, giving your real customers a fair shot at purchasing. This is a useful feature if your brand specializes in streetwear, sneakers, and collectibles, where resellers use bots to snap up inventory for resale on sites like StockX.
Harden your store’s technical defenses
If you have a software developer on your team or can contract an agency, these targeted technical changes can help reduce your exposure to bot attacks:
-
Add rate limiting for your checkout pages. This puts a cap on how many requests a single IP address can make, slowing down card-testing bots.
-
Block traffic from data center IP ranges. Most legitimate shoppers browse from residential internet connections, not AWS server clusters. Blocking data center IPs cuts out a share of automated traffic.
-
Use honeypot fields in your forms. A honeypot is a hidden form field invisible to human users but visible to bots that auto-fill every field on a page. If the honeypot field comes back filled in, the submission wasn’t human.
Screen orders for fraud signals
Order-level screening is a nice fallback to have when bot traffic inevitably sneaks through. Shopify’s fraud analysis features flag orders that show expected signs of fraudulent bot activity. That includes billing and shipping addresses that don’t match, multiple failed payment attempts arising from the same session, or orders placed with throwaway email addresses.
This feature also assigns each order a risk level, letting you review suspicious ones before fulfilling them. Checking flagged orders ahead of shipping prevents chargebacks and protects against fulfilling orders that won’t lead to real revenue for your store.
Bot traffic detection FAQ
How does bot traffic work?
Bots are software scripts that send automated requests to websites, simulating the same HTTP calls a browser makes when a living and breathing person loads a page. They crawl sites in several seconds, fill out web forms, and even complete ecommerce checkout (without a human at the helm).
How does bot detection work?
Bot detection techniques analyze incoming web traffic for signals that distinguish automated visitors from real people, like IP addresses, user agent strings, mouse movement patterns, and request frequency.
How do you get rid of bot traffic?
You can’t (and shouldn’t) eliminate all bot traffic. Some of that automated traffic, like search engine bots, is useful for your store. However, filter out unwanted and malicious bot traffic using bot detection tools in Google Analytics, such as internal traffic filters, and bot-filtering features baked into your ecommerce platform.
