At most 1 in 10 visitors to our sites was human
We pointed Humansift at our own five websites and sorted all 400,425 requests they received in 15 days. Under the most generous count, fewer than 1 in 10 visitors could have been a person.
Every website owner has a number they watch. Visitors, sessions, users. We build Humansift, a tool that reads what actually reaches a web server, so before asking anyone else to trust it we ran it on ourselves: five small but real websites with real readers, from 2 to 16 October 2026.
The result was humbling.
Where 400,425 requests came from
Here is every request, sorted into five groups. The bar is to scale.
- Attacks and fakes 74.3%
- Bots and scripts 16.3%
- Possible people 4.5%
- Search engines and tools 3.5%
- AI 1.5%
| Group | Requests | Share | Daily visitors | Share |
|---|---|---|---|---|
| Attacks and fake crawlers | 297,328 | 74.3% | 52,296 | 71.5% |
| Bots and scripts (curl, Go, Python, unnamed clients, headless browsers) | 65,253 | 16.3% | 7,280 | 10.0% |
| Possible people | 18,053 | 4.5% | 6,724 | 9.2% |
| Search engines, SEO tools, link previews, monitors | 13,850 | 3.5% | 4,463 | 6.1% |
| AI crawlers and assistants | 5,941 | 1.5% | 2,398 | 3.3% |
Three out of four requests were attacks
None of our five sites runs WordPress, yet bots asked them for xmlrpc.php, wp-login.php and other WordPress files 286,061 times. Add requests for .env files, .git folders and admin panels, and attacks were 74% of everything our servers answered. We wrote this up separately: we don't run WordPress, and it was attacked 286,000 times anyway.
Google Analytics shows none of this, because attack bots never run its tag. That's fine for your marketing numbers, but it means the tool you look at every day is blind to most of what your server spends its time on.
The next biggest group: software that doesn't say what it is
Another 65,253 requests came from scripts and tools: 38,004 from clients with a user agent we couldn't name, 19,251 with no user agent at all, and the rest from curl, Go, Python and Java libraries. Some are harmless (someone's price checker, a home-made monitor). Most are scrapers. They are invisible to analytics too, unless they run a real browser, and then it's worse: automated browsers run the analytics tag and get counted as users.
"Possible people" is a generous upper bound
We counted a visitor as a possible person if it looked like a normal browser, came from a home or mobile connection, and did nothing a bot gives away (no attack paths, no data-centre address, no bot user agent). That came to 6,724 daily visitors, 9.2% of the total.
It's an upper bound because careful bots do exactly this: rent home connections and copy a real browser's user agent. This is why Humansift also uses a small, cookie-free script that waits for a real interaction (a scroll, a tap, a keypress). With it, "possible people" splits into people who interacted and probably people who left without doing anything. Those numbers don't appear in this post because, for this snapshot, we read logs only.
Possible people were 20% of visitors on our education site and our small-business tool, 10% on the pet guide, and only 3% on the crafts marketplace and the fashion blog. One site-wide average hides more than it shows.
Crawlers: more AI than search
AI crawlers (ClaudeBot, GPTBot, Meta, Amazon, Perplexity and others) loaded 3,832 pages. Search engines loaded 2,414, and most of those came from one crawler, Huawei's PetalBot. ClaudeBot alone loaded 1,377 pages to Googlebot's 430. There's more in AI crawlers read 9× more of our pages than Googlebot.
We also caught 1,394 requests from fake crawlers: software claiming to be Googlebot, Bingbot, GPTBot or ChatGPT, from addresses those companies don't use. Roughly 1 in 6 "Googlebot" requests was fake. See how to check whether a crawler is real.
What this means for your numbers
- Your server works mostly for software. Plan capacity, bandwidth and security for the 90%, not the 10%.
- Your analytics is a sample with blind spots. It misses everything that doesn't run JavaScript, and counts automated browsers that do.
- Judge marketing on people who interacted. Visits, sessions and page views include software. A scroll or a tap is much harder to fake at scale.
- Watch your crawlers. Which search and AI bots read your pages, and which only pretend to, affects how you show up in search and in AI answers.
How we measured
Every number here comes from the server logs of our own five websites (a pet guide, an education site, a small-business tool, a crafts marketplace and a fashion blog), from 2 to 16 October 2026: 400,425 page and API requests. Images, styles and scripts were counted separately and are left out. Each request was sorted by Humansift: named bots by their user agent, Googlebot, Bingbot, GPTBot, ChatGPT and Perplexity checked against the address ranges their owners publish, attack paths by pattern, and data-centre traffic by network. A "visitor" is one address and browser on one day. Five small sites are a small sample, so read these as one honest data point, not an industry average.