How to tell a bot session from a real one without deleting people

The symptom

Traffic reports include sessions that never acted like a person: no scroll, no time on page, gone in under a second. The question is how to filter them out without also deleting real visitors on a slow connection or a cautious first visit.

The cause

A single tell is cheap to act on and wrong often enough to matter. A session showing source direct or not-set can be a bot, or it can be a real returning visitor whose tags didn't carry. A single page per session can be a bot, or it can be a real visitor who left after reading the first screen because it answered their question. Any one signal alone produces false positives in both directions.

The four-signal combination narrows this close to certain: source reading direct or not-set, a country outside your advertised markets, an engagement rate of exactly zero, and exactly one page per session, all four present at once. That combination is rarely a real person doing something unusual. It's almost always a prefetcher, scanner or bot.

The fix

Filter at read time, never at collection. Collect everything as it comes in, so the raw data still exists if the filtering rule needs to change later. Require a real engagement signal, a scroll past a quarter, ten seconds of active time, or a click, before any session enters a denominator at all. Read every report through the same saved, filtered view, so two people looking at the same week get the same number.

How to spot it

Pull a sample of sessions you suspect are phantoms and check all four signals together, not just the one that first caught your eye. Published bot-traffic estimates run as high as half of all web traffic on other networks, but those figures come from unpublished methods on different data; use them to justify scepticism about your own number, never as a substitute for measuring it. Large free analytics suites filter only a published list of known spiders, so a headless browser with a normal user agent walks straight through their own filters.