The Humansift blog

What really reaches
your website.

Findings from real server logs, starting with our own five sites: people, AI crawlers, fake bots and attacks, with the numbers and how we measured them.

Research

At most 1 in 10 visitors to our sites was human

We sorted 400,425 requests to our five websites. Attacks, scripts and crawlers made up the rest. Here is the full breakdown and how we measured it.

· 6 min read Security

We don't run WordPress. It was attacked 286,000 times

In 15 days, bots asked our five Django sites for xmlrpc.php and wp-login.php 286,061 times. What they want, why analytics never shows it, and what to do.

· 5 min read AI and search

AI crawlers read 9x more of our pages than Googlebot

ClaudeBot loaded 1,377 of our pages in 15 days; Googlebot loaded 430. Which AI bots read your site, what each one is for, and how to choose who gets in.

· 6 min read Security

1 in 6 'Googlebots' on our sites was fake

Fake Googlebot, GPTBot and ChatGPT requests came from rented cloud servers, hunting for .env files. How to tell a real crawler from a fake in one minute.

· 5 min read