Who's really in your access log?

Paste lines from your nginx or Apache access log. Every request is sorted into people, verified crawlers, AI, bots and attacks, and fake crawlers are caught by checking their addresses.

What you get back

The split. How many requests and visitors were possible people, search engines and tools, AI, scripts, and attacks or fakes.
Verified crawlers. Googlebot, Bingbot, Applebot, GPTBot, ChatGPT, OpenAI search and Perplexity, confirmed against the address lists their owners publish.
Fake crawlers. Requests that used one of those names from an address that isn't theirs.
Attack paths. The files and pages attackers asked for most, like /wp-login.php, /xmlrpc.php or /.env.
Other named bots. SEO tools, monitors, link previews and more than 100 others we recognise by name.

Images, styles and scripts are left out of the counts, so the numbers are about pages and API calls, not every file a browser loads.

How to get a sample

On most Linux servers, this prints the latest 2,000 lines:

# nginx
tail -n 2000 /var/log/nginx/access.log

# Apache (Debian and Ubuntu)
tail -n 2000 /var/log/apache2/access.log

# Apache (Red Hat, CentOS, AlmaLinux)
tail -n 2000 /var/log/httpd/access_log

On shared hosting, cPanel has Raw Access under Metrics, and Plesk has Logs for each domain. Open the file, copy a few thousand lines and paste them above. No log to hand? Press Use a sample log to see how it works. Not sure what you're looking at? Our guide to reading an access log line by line walks through every field.

Why a log, and not analytics?

Google Analytics only counts browsers that run its script and aren't blocked. Crawlers, scrapers and attacks don't run it, so they never show up, and some people never show up either. Your access log records every request that reached the server. When we compared the two on our own sites, the numbers were 270 times apart, and neither one was the number of people.

Behind Cloudflare?

If your site sits behind Cloudflare or another CDN, your log may show the CDN's address instead of the visitor's. Requests still get sorted by what they asked for and the name they gave, but address checks can't run on those lines. Humansift can read your traffic from Cloudflare directly after you sign up.

Questions

Which log formats work?

The standard combined format that nginx, Apache, LiteSpeed, cPanel and Plesk write by default: address, time, request, status, size, referrer and user agent on each line. Lines in other formats are skipped and counted.

Is my log stored?

No. The lines are sorted in memory and thrown away as soon as the result is sent back. Nothing from them is saved.

How do I get lines from my log?

On most Linux servers, tail -n 2000 /var/log/nginx/access.log (or /var/log/apache2/access.log) prints the latest 2,000 lines. On shared hosting, cPanel and Plesk let you download raw access logs.

How do you tell a real crawler from a fake?

Googlebot, Bingbot, Applebot, GPTBot, ChatGPT, OpenAI search and Perplexity are checked against the address lists their owners publish. A request that uses one of their names from any other address is counted as a fake.

More free tools

Free tool

AI crawler checker

See which AI crawlers and search engines your robots.txt lets in, and what else anyone can see from outside.

Run it now → Free tool

Googlebot checker

Check if an address claiming to be Googlebot, GPTBot or another crawler really belongs to it.

Run it now →