Bot traffic on small business websites: how much of it is not people
Website analytics count what reaches them. Most of what reaches a small business website is not a person. We measured it on our own site, and we measure it every night across the sites built here.
The finding on our own site
On 7 November 2026 we took 72 hours of requests to webkio.com that had already passed every per-request check a website analytics product applies: a browser-like user agent, the headers a real browser sends, no known crawler name, no datacenter address. The server had labeled 1,489 of those requests, from 1,318 addresses, as people.
In the same 72 hours the page itself was loaded by a browser that ran our JavaScript and stayed on the page for four seconds 238 times. A second, independent script (the one that measures page speed) reported 214.
1,173 of the 1,318 "people" made exactly one request, and that request claimed to come from a page on our own site. A first visit cannot arrive from a link on the site it has never loaded. Seven hundred and twenty of them arrived inside two hours. Ninety-eight percent reported a desktop browser. They were a crawler using home internet connections, one request each, with every header a real browser would send.
About 85%
of the requests that looked like people, were not. Two independent in-page measurements agreed on roughly 60 to 80 real page loads a day where the server-side count had said about 500.
This is not a story about one site. Every analytics product that counts on the server, or that counts any client that runs JavaScript, sees some version of it. The owners of small business websites are the least equipped to notice: a shop with twenty real visitors a week has the same crawlers as a busy one, so the inflation is largest exactly where the owner has the least to compare it with.
The live figure across small business websites
Across 17 published small-business websites, from 2026-10-12 to 2026-11-10:
Who the bots were
Method
- Population. Published websites of real customer accounts on Webkio. Our own demo and test accounts are excluded. A site counts once it has answered at least one request in the window.
- What is counted. Every HTML page request a site answered (GET, 200 or 404), after the response was sent. Static files, images and API calls are not requests "to the site" in this sense and are excluded.
- How a request is labeled. In order: a crawler that names itself (Googlebot, Bingbot, Yandex, the AI crawlers, uptime and SEO tools); a script or scanner (HTTP libraries, command-line tools, requests for paths only attackers ask for); an address that belongs to a datacenter rather than a consumer network (GeoLite2 ASN); a browser claim missing the headers that browser always sends, or a referrer no browser can produce; and behavior - thirty or more pages in a minute, one address reading several unrelated sites in a day, or a "click from inside the site" from an address that never loaded a page. Everything else is labeled a person.
- Confirmed page views are a separate count: the page's own script reports a view after four seconds on the page or a first interaction. A crawler that fetches HTML and leaves never fires it.
- What is stored. A count per day, per site host, per label. No address, path, user agent or timestamp.
- Window. The last 30 complete days, recomputed nightly. The share is published once at least 10 sites are in the window.
Labels are readings, not blocks: every request in these counts was answered. The labeling code is the same one that keeps bots out of the analytics shown to site owners, documented at Real visitors vs bots.
Cite this
Webkio Research, "Bot traffic on small business websites", 2026. Figures recomputed nightly; the date on the page is the date of the figures. Free to reuse with a link (CC BY 4.0).