By Chris Leo, Movou
Your sessions went up and your phone did not. Most owners read that as a conversion problem and go looking for a new website. It is usually not a conversion problem. Before you spend a dollar fixing what happens after people arrive, you need to know whether people arrived at all. A traffic number on its own does not tell you that. It tells you how many times something loaded your site, and “something” is doing a lot of work in that sentence. This is the check I run first on any account, it takes about four clicks, and I am going to walk you through it using our own unflattering numbers as the example.
Key takeaways
- A session count on its own is not evidence of anything. Where the sessions came from is the actual number.
- Four signals tell you whether a spike is real: the Direct share, the engagement rate, pages per session, and the shape of the daily trend.
- Google already filters the bots that identify themselves. The ones worth worrying about are the ones that do not.
- Most fake traffic is not an attack on you. It is noise, and the correct response is usually to filter it and move on.
Why is most of my traffic suddenly Direct?
Direct does not mean “typed your web address into the browser.” That is what everyone assumes and it is the root of the confusion.
Direct means your analytics could not work out where the visit came from, so it put it in the drawer marked Direct. Sometimes that is genuine. Someone clicked a link in a text message, or came from an app, or your tracking dropped the referrer on a redirect. Those are real people who got mislabelled.
But automated traffic lands in that same drawer, and for a specific reason. Something that does not want to be identified simply does not send referrer information, and a visit with no referrer is a visit your analytics cannot categorise. So it becomes Direct.
This is why a Direct share that climbs on its own is worth a look. Not because Direct is bad, but because Direct is where anything unidentifiable ends up, and a sudden pile of unidentifiable visits is a question rather than an answer.
Doesn’t Google Analytics filter out bots already?
It filters some of them, and this is the part that gives people false comfort.
Google Analytics automatically drops traffic from known bots and spiders, identified using Google’s own research plus the International Spiders and Bots List maintained by the Interactive Advertising Bureau. It happens by default and there is no switch to turn it off.
Here is the catch, and it is in Google’s own documentation: you cannot see how much known bot traffic was excluded. So the filtering is real, but it is invisible, and it only covers bots that are on a list. A crawler that announces itself gets caught. Something built to look like a browser does not, because there is nothing to match it against.
So the honest position is this. Your analytics has already removed the well-behaved traffic that identified itself. Whatever is left in your reports still needs a human to look at it.
How do I tell bot traffic from real visitors?
Four checks, in this order. None of them requires a tool you do not already have.
- The Direct share. Open the Traffic Acquisition report and look at your channels. If Direct is a large majority of your sessions and it was not last month, that is signal one.
- The engagement rate. Google counts a session as engaged if it lasts longer than ten seconds, includes a key event, or racks up at least two pageviews. Those are Google’s published thresholds for engagement rate and bounce rate, and they are a low bar. Traffic that cannot clear a ten second bar over and over again is not reading anything.
- Pages per session. Real people wander. They land, they get curious, they check your services page or your reviews. Traffic that reads exactly one page every single time, with no variation at all, is not browsing. It is fetching.
- The shape of the daily trend. This is the one people skip and it is the most telling. Real growth is lumpy. It moves with your posting, your ads, the days of the week. Automated traffic tends to arrive as a smooth climb from nothing, or a flat plateau that holds steady through a weekend when your actual customers are not working.
One of these on its own means very little. Plenty of legitimate sites have a high Direct share. All four together, pointing the same way, is a pattern.
What our own numbers looked like
I am going to use us as the example, because it is easy to be brave with somebody else’s data.
Across the fourteen days from 17 to 30 August, our site recorded 552 sessions. 490 of those came in as Direct. That is just under 89 percent of everything, arriving with no identifiable source.
Over the same fourteen days, Organic Search sent 47 sessions. Organic Social sent 9. Referral sent 5.
Now here is the number that actually matters, and it is the reason I am not celebrating. The channel that represents people finding us on Google, the one we get paid to improve for other businesses, did not move at all. Every bit of the apparent growth sat in the one bucket that tells you nothing about who showed up.
I want to be careful about what I am claiming here. I have not proven those 490 sessions were bots. Proving it means going to the server logs and looking at what actually made those requests, and we have not published that. What I can tell you is that the pattern has every characteristic you would check for, and that is precisely why I would rather show you the check than the conclusion. If your dashboard looks like ours, you now know what to go and look at.
Is bot traffic hurting my Google rankings?
Almost certainly not, and I want to defuse this one because it is where owners waste the most energy.
Your rankings are decided by what Google’s own systems see when they crawl and evaluate your site. Traffic that shows up in your analytics is a separate thing entirely. Something hitting your website does not report back to Google’s ranking systems, and your analytics numbers are not a ranking input.
Where fake traffic genuinely does damage is in your decisions. It inflates your baseline, so next month’s real numbers look like a decline. It makes a bad month look fine. If you are running ads and optimising toward on-site actions, it can quietly pollute what the platform learns. That is the real cost, and it is a measurement cost, not a rankings cost.
What should you actually do about it?
Less than you would think, and this is the part most articles on this subject get wrong by trying to sell you something.
Do go and identify it, using the four checks above, so you know what your real baseline is. Do make a note of when it started, because that date is what separates your genuine numbers from the noise. If it is substantial and ongoing, do set up a filter or a segment so your reporting stops counting it, and be aware that a filter changes your data going forward rather than cleaning up the past.
Do not panic. Do not assume you have been attacked, because most of this is indiscriminate noise sweeping the web rather than anything aimed at you. Do not go and buy a bot mitigation product because one bad fortnight in a dashboard scared you. And do not rebuild a website that was converting perfectly well for the visitors who were actually human.
The point of the exercise is not to eliminate every non-human visit. That is not achievable. The point is to know which number to trust when you are deciding where next month’s money goes.
The short version
A rising session count is not a result. It is a question. Open your Traffic Acquisition report, look at your Direct share, check the engagement rate and pages per session against it, then look at the daily trend rather than the total. Four clicks, and you will know whether you are looking at growth or noise.
If the traffic turns out to be real and the phone is still quiet, that is a genuinely different problem and a fixable one. We wrote about the version of it where you rank well and still get ignored in our guide to rankings that never turn into clicks.
Go and check your Direct percentage this week. Most owners have never looked at it once. If it comes back over 70 percent and you cannot explain why, that is worth a conversation. Our local SEO services start by working out which of your numbers are real, and you can get in touch here.