Analytics saw 256 visitors. Our server saw 69,881
Over the same 14 days, Google Analytics counted 256 daily visitors across our five websites. Our server logs counted 69,881. Neither number is the number of people. Here's where the gap comes from, and where the truth sits.
Every site owner who has opened their server logs next to Google Analytics has had the same moment: these can't be the same website. We compared the two for our own five sites from 2 to 15 October 2026, day by day, and the gap was bigger than we expected.
To compare like with like, we used the same unit on both sides: one visitor on one day. Google Analytics' daily active users, added up over the 14 days, gave 256. In the logs, one address and browser on one day gave 69,881.
Most of the gap is easy to explain
Google Analytics runs in the browser. It only counts visitors whose browser loads the page, runs its script and isn't blocking it. Almost nothing automated does that. So we sorted the 69,881 log visitors and set aside everything with a clear identity:
| Who | Daily visitors |
|---|---|
| Attacks (password guessing, vulnerability scans, secret-file hunts) | 51,583 |
| Scripts and tools (curl, Python, unknown clients) | 4,004 |
| Bots without a name, from data centres | 3,073 |
| AI crawlers and assistants | 2,305 |
| Search engines, SEO tools, monitors, link previews and other named bots | 4,319 |
| Fake crawlers and automated browsers | 186 |
| Left: possible people | 6,600 |
Our five sites, 2–15 Oct 2026. A visitor can appear in more than one row (a scanner that also crawls), so rows add up to slightly more than 69,881.
Of those 6,600, only 4,428 actually loaded a page; the rest asked only for things like feeds or API addresses. So the honest comparison is 256 in Analytics against at most 4,428 in the logs. Still 17 times apart.
Site by site, the gap tells a story
| Site | Google Analytics | Possible people in logs | Gap | Visitor address hidden by CDN |
|---|---|---|---|---|
| Crafts marketplace | 18 | 266 | 15x | 18% |
| Fashion blog | 120 | 416 | 3.5x | 29% |
| Small-business tool | 50 | 173 | 3.5x | 10% |
| Education site | 51 | 2,166 | 42x | 76% |
| Pet guide | 17 | 1,407 | 83x | 92% |
Daily visitors, 2–15 Oct 2026. "Hidden" means the log recorded the CDN's address instead of the visitor's.
The pattern is hard to miss. On the fashion blog and the business tool, where our logs saw the real address for most visitors, logs and Analytics were about 3.5 times apart. The crafts marketplace sat in between. On the two sites where the log recorded Cloudflare's address for most visitors, the gap jumped to 42 and 83 times.
The reason: one of the strongest signals for spotting a bot is the network it comes from. A visitor from a home broadband or mobile network is probably a person; one from a cloud server almost never is. When the log only shows Cloudflare's address, that check can't run, and quiet bots that use a normal browser name slip into "possible people". In those two sites, most of the "people" in the logs are probably bots we can't see clearly.
Set up your web server to log the real visitor address (nginx's real_ip module with the CF-Connecting-IP header, or Apache's mod_remoteip). It takes five minutes and makes your logs far more useful, for security as much as for counting.
Why Analytics undercounts people
Even the 3.5x gap isn't all bots. Google Analytics misses real people too:
- Blockers. Ad and tracker blockers, and browsers with built-in tracking protection, stop the Analytics script from loading.
- Consent. Where a cookie banner asks first, people who decline aren't counted (or are only modelled).
- Quick exits. Someone who leaves before the script finishes loading, often on a slow phone connection, is never recorded.
- No JavaScript. Rare for people, but it happens: some privacy tools and reader apps fetch the page without running scripts.
And in the other direction, Analytics can count things that aren't people. Headless browsers that run JavaScript look like visitors to it, and fake "visits" can be sent straight to Google without touching your site at all.
Why logs overcount people
Logs see everything, which is their strength and their problem. A bot that sends a normal browser name, from an address you can't check, loads one page and leaves looks exactly like a person who glanced at your site and left. In our data, 3,460 of the 4,428 possible people loaded exactly one page. Some were people. Many weren't.
So how many people were there?
Somewhere between 256 and 4,428 a day across the 14 days, and on the sites where we can see properly, closer to the bottom. That's an unsatisfying answer, and it's the point: neither tool alone can tell you. Analytics only sees browsers that run its script; logs see everything but can't always tell a quiet bot from a quick human.
The way to narrow it is a signal neither side can fake easily: a real browser doing something only a person does, such as scrolling, tapping or pressing a key, from a network people use. That's what Humansift's cookie-free script checks, next to your logs and your Analytics numbers. Visitors who interact are confirmed as people; those who load a page and never do anything are counted separately, as probably people.
What to do with your own numbers
- Don't trust either number alone. If you report traffic to a client or a boss, say which tool it came from and what it can't see.
- Look at your logs once. Even a few thousand lines show how much of your traffic is automated. Paste a sample into our free log analyzer to see the split.
- Fix hidden addresses. If your log shows your CDN's addresses, fix that first. Every other check depends on it.
- Watch the gap, not just the totals. A sudden jump in log visitors with no change in Analytics is usually bots; a drop in Analytics with steady logs can be a broken tag or a new consent banner.
For how the rest of our traffic breaks down, see at most 1 in 10 visitors to our sites was human.
How we measured
Every number here comes from the server logs of our own five websites (a pet guide, an education site, a small-business tool, a crafts marketplace and a fashion blog), from 2 to 16 October 2026: 400,425 page and API requests. Images, styles and scripts were counted separately and are left out. Each request was sorted by Humansift: named bots by their user agent, Googlebot, Bingbot, GPTBot, ChatGPT and Perplexity checked against the address ranges their owners publish, attack paths by pattern, and data-centre traffic by network. A "visitor" is one address and browser on one day. Five small sites are a small sample, so read these as one honest data point, not an industry average.