Why Google Analytics doesn't show bot or AI crawler traffic (and how to see it)
On this page
Google Analytics does not show bot or AI crawler traffic because it only records visitors whose browser runs its JavaScript tag, and most crawlers fetch your HTML without running any script. Google then automatically excludes known bots that do run it. To see bot traffic, you need server-side data: access logs, CDN analytics, or a server-side tool.
That explains the gap, but it is only half the story. Some automation does run JavaScript, and GA4 counts it as human. AI assistants send real visitors that GA4 can partly see, while the far larger crawl behind each click stays invisible. This guide covers all three, with a table of what GA4 sees and a step-by-step way to measure your real bot share.
Why doesn’t Google Analytics show bot or AI crawler traffic?
GA4 is a client-side tool. The gtag.js snippet runs in the visitor’s browser and sends an event to Google; no event, no session. A request that never executes the snippet never exists in your reports.
Most automated traffic is exactly that kind of request. Search crawlers, AI training crawlers such as GPTBot and ClaudeBot, and user-triggered fetchers such as ChatGPT-User request the raw HTML over HTTP and move on. They do not keep a browser session open or fire your tag. OpenAI’s crawler documentation lists these agents by user-agent string, which is a server-side signal: it appears in the request headers your server logs, not in anything GA4 receives.
The scale of what goes missing is large. In its 2025 Year in Review, published in December 2025, Cloudflare found that AI bots averaged 4.2% of HTML requests across its network, Googlebot alone 4.5%, and other non-AI bots 44% as of December 2. Peak request volumes from ChatGPT-User were as much as 16 times higher than at the start of the year. None of that reaches a JavaScript tag. For the log-side view of the same traffic, see how to detect bot traffic in your logs.
What does GA4’s known bot-traffic exclusion remove?
GA4 adds a second filter on top of the JavaScript gap. Google’s help page on known bot-traffic exclusion says traffic from known bots and spiders is excluded automatically, and that it is “identified using a combination of Google research and the International Spiders and Bots List, maintained by the Interactive Advertising Bureau.”
Two sentences on that page matter most: “At this time, you cannot disable known bot traffic exclusion or see how much known bot traffic was excluded.” So if a declared bot does render your page and fire the tag, GA4 drops it before it reaches any report, and there is no counter, segment, or export that tells you how many events were removed.
The practical consequence: GA4 has no bot report, and you cannot work out your bot share from inside it. The tag misses bots that never run JavaScript, and the filter hides the declared ones that do. What remains in GA4 is the automation the filter does not recognise, which is the next problem.
Why do some bots still show up in GA4?
Bots that run a real browser engine execute your tag like any visitor. The 2026 Thales Bad Bot Report from Imperva says headless tools such as Puppeteer, Selenium and Playwright “enable bots to execute JavaScript, maintain session state, and replicate multi-step user journeys.” The same report found that 41% of bad bot traffic in 2025 declared itself as Chrome, up from 39% in 2024. To a JavaScript tag, that traffic looks like a person on Chrome.
The clearest recent case is the wave of fake visits from Lanzhou and Singapore. In February 2026, WIRED reported that site owners had seen these visits since the previous September. One blogger’s Google Analytics showed the visitors staying “an average of 0 seconds” without scrolling or clicking. As WIRED reported from the public Analytics.usa.gov dashboard, 14.7% of visits to US government websites over 90 days came from Lanzhou and 6.6% from Singapore. Site owners told WIRED the bots “disguised themselves as normal human users from the start” and bypassed common bot-blocking rules.
What fixed it was network-level, not analytics-level. One weather site manager blocked four ASNs belonging to Chinese cloud providers, and daily bot visits fell from a peak of 127,000 to just above 2,000. That is a single site’s account, but the lesson generalises: a GA4 filter can only hide bad sessions after they are recorded, while the request data shows you which networks to block.
Are AI agents and agentic browsers counted as humans in GA4?
Often, yes. Agentic browsers are real browsers driven by an AI on a person’s behalf, so they load pages, run JavaScript, and fire your tag. HUMAN Security’s December 2025 analysis of ChatGPT Atlas and Perplexity Comet found both are built on Chromium and “appear almost identical to a generic Chrome browser” to basic fingerprinting. GA4’s known-bot list is not built to catch software that presents as a normal browser. To tell these agents apart on the server side, see how to detect AI agents on your website.
This traffic is small but growing fast. HUMAN’s 2026 State of AI Traffic & Cyberthreat Benchmark Report, based on more than one quadrillion interactions in 2025, measured traffic from AI agents and agentic browsers growing 7,851% year over year. In its August 2026 agentic traffic update, Comet produced 40.7% of observed agentic traffic, the Claude Chrome extension 22%, and ChatGPT Agent 19.8%. Product and search routes made up 80% of agent activity, so these sessions land on the same content pages your human visitors read. HUMAN’s own summary: “most analytics tools can’t distinguish AI agents from human visitors.”
Some agents now identify themselves, but only to your server. OpenAI’s allowlisting guide for ChatGPT’s cloud browser says it signs requests with Web Bot Auth and sends a Signature-Agent header set to "https://chatgpt.com". GA4 never sees request headers, so that signal is only usable in logs or at the edge. Web Bot Auth explained covers how verification works.
What does GA4 show about AI traffic?
GA4 can see the humans who click through from AI answers. Its default channel group now includes an AI Assistant channel, “the channel by which users arrive at your site from sources like ChatGPT, Gemini, Deepseek, Copilot, or Grok.” It “excludes Google’s AI Overviews and AI Mode,” and clicks that arrive with no referrer fall into Direct, which Google defines as arriving “via a saved link or by entering your URL.” The setup and referrer list are in how to see ChatGPT and Perplexity referral traffic.
What GA4 cannot show is the crawling behind each click. Cloudflare tracks this as a crawl-to-refer ratio. In its August 2025 analysis, OpenAI’s ratio was 1,091 bot requests per human referral in July 2025. Cloudflare’s 2025 Year in Review put Anthropic at roughly 25,000:1 to 100,000:1 after May, and Perplexity generally below 200:1 from September. Every AI Assistant session in GA4 sits on top of hundreds or thousands of requests GA4 never records.
Which traffic does GA4 see, and where do you see the rest?
| Traffic type | Runs your GA4 tag? | Shows in GA4? | Where to see it |
|---|---|---|---|
| Search crawlers (Googlebot, Bingbot) | Usually no | No | Server or CDN logs; Search Console crawl stats for Google |
| AI training crawlers (GPTBot, ClaudeBot, CCBot) | No | No | Server or CDN logs; Cloudflare AI Crawl Control |
| AI user-triggered fetchers (ChatGPT-User, Perplexity-User) | No | No | Server or CDN logs |
| Known, declared bots that render pages | Sometimes | No, removed by known-bot exclusion | Server or CDN logs |
| Agentic browsers (Comet, Claude in Chrome, ChatGPT agent) | Yes | Yes, usually as human sessions | Logs plus signature or behavioral checks |
| Headless bots posing as browsers | Yes | Yes, as human sessions | Logs grouped by ASN and IP, bot management |
| Simple scrapers and vulnerability scanners | No | No | Server logs, WAF events |
| Humans clicking from ChatGPT, Gemini, Copilot | Yes | Yes, AI Assistant or Direct | GA4 plus referrer data in logs |
| Humans clicking from AI Overviews or AI Mode | Yes | Yes, inside Organic Search | GA4 (not separable) |
What percentage of website traffic is bots?
Industry benchmarks put it at roughly half, measured as requests. The 2026 Imperva Bad Bot Report found automated traffic was more than 53% of web traffic in 2025, up from 51% in 2024. Cloudflare’s narrower HTML-only view had humans at 47% of HTML requests on December 2, 2025, against 44% for non-AI bots, with AI bots and Googlebot on top. HUMAN measured automated traffic growing 23.51% in 2025 against 3.10% for human traffic.
Your own figure can be very different. It depends on your audience, how much content you publish, and whether you are a scraping target: one site owner in WIRED’s report found visits from China and Singapore made up more than half of total visits over 12 months. It also depends on what you count. Bot share by requests and bot share by GA4 sessions are not comparable, because GA4 sessions exclude most bots by design. The only honest denominator is every request your server answered.
How do you measure bot traffic on your own site?
- Pick a server-side source. Use your origin access logs or your CDN’s logs. Both record every request before any JavaScript runs. If you are new to raw logs, start with log file analysis for SEO and AI search.
- Fix the window and the content type. Use the same date range for every number, and decide whether you count all requests or only HTML pages. Cloudflare’s Year in Review notes that its HTML-only shares differ from its all-content figures.
- Classify each request. Sort user-agents into search crawlers, AI crawlers, AI fetchers, signed agents, other declared bots, and everything else. What is a web crawler has the taxonomy.
- Verify claimed identities. User-agents are easy to fake. Check claimed crawlers against reverse DNS or published IP ranges, and check Web Bot Auth signatures where agents send them.
- Calculate the share. Bot share = verified plus unverified automated requests divided by total requests in the window. Report verified and unverified automation separately.
- Reconcile with GA4. Compare page-level request counts that look human with GA4 page views for the same pages and dates. Investigate GA4 spikes in Direct traffic, single cities, or near-zero engagement by finding the same window in your logs and grouping by ASN.
- Use your CDN dashboards if you have them. Cloudflare’s Bot Analytics is available on Business and Enterprise plans and shows a 1 to 10% sample, so treat its numbers as estimates. AI Crawl Control shows AI crawler requests, allowed and unsuccessful requests, and referrals on paid plans.
Does server-side tagging make GA4 see bots?
No. Server-side Google Tag Manager changes where your tags run, not which visitors are measured. Google’s server-side tagging fundamentals explain that “the client-side libraries have mechanisms to collect data from the web browser and dispatch it to the server-side tagging environment,” and that “the only way to make the server container process data is to send HTTP requests to it.”
A crawler that never executes gtag.js never sends that request, so your tagging server never hears about it. Google also says server-side tagging does not replace client-side tagging; it complements it. Google lists its benefits as page speed, tighter content security policies, privacy and more durable first-party cookies, not wider coverage. Seeing crawlers requires reading the requests your web server or CDN answered.
That is the gap Lume is built for. It reads traffic from your CDN logs or edge, or from one SDK call on your server, with no client JavaScript, and sorts each request into humans, AI-referred humans, AI agents, AI crawlers, search and utility bots, and spoofers. Claimed identities are checked against signatures, reverse DNS and published IP ranges. See how it works and agent analytics.
Keep GA4 for what it does well, which is human behavior on your pages, and get the bot picture from the requests themselves.
Frequently asked questions
Does Google Analytics 4 filter bot traffic automatically?
Yes. GA4 automatically excludes traffic from known bots and spiders, identified with Google research and the International Spiders and Bots List maintained by the Interactive Advertising Bureau. You cannot turn the exclusion off. It only catches bots it recognises that also run the tag; most crawlers never run the tag, so they never reach GA4 in the first place.
Can I see how much bot traffic GA4 excluded?
No. Google’s help page states that you cannot disable known bot-traffic exclusion or see how much known bot traffic was excluded. There is no report, segment, or export for it. To count bots, you need server or CDN logs, which record every request whether or not JavaScript runs.
Why is GA4 showing traffic from Lanzhou, China and Singapore?
It is very likely automated traffic that runs JavaScript and therefore fires your tag. WIRED reported in February 2026 that many sites saw these visits, with average engagement of zero seconds, and that they bypassed common bot-blocking rules. Check the same window in your server or CDN logs, group requests by ASN, and block at the network level if needed.
Does ChatGPT traffic show up in Google Analytics?
Partly. Humans who click a link in ChatGPT appear in GA4, usually in the AI Assistant channel or in Direct when no referrer is passed. ChatGPT’s crawlers and fetchers, such as GPTBot, OAI-SearchBot and ChatGPT-User, do not appear, because they do not run your tag. A ChatGPT agent driving a real browser can appear as an ordinary human session.
Will server-side tagging show crawlers in GA4?
No. Server-side Google Tag Manager receives data that the browser-side tag sends to it, so a crawler that never runs the tag never reaches your tagging server. It improves control over the data you forward, not coverage of non-human visitors.
What percentage of my website traffic is bots?
Benchmarks put it near half of all requests: Imperva measured automated traffic at more than 53% of web traffic in 2025. Your site will differ. Measure it from server or CDN logs as automated requests divided by total requests over a fixed window, and keep verified and unverified bots separate.
