Your host says the site uses too much; your analytics say traffic is flat. Both can be true, because much of what reaches a website is not a person reading it. We pulled 30 days of our own Cloudflare data, from 28 September to 28 October 2026, to see what that looks like on a real site, and what to do about it without hurting your search traffic.
What our own site showed
grafica.group received about 382,000 requests in those 30 days. The largest single source was us: 45 percent came from the uptime monitor we run to know when the site goes down. Search engines that Cloudflare could verify were under 1 percent. AI crawlers that Cloudflare could verify were also under 1 percent.
The interesting part was the traffic pretending to be someone else. Across our domain and its subdomains, about 6,800 requests said they were Googlebot or Bingbot and Cloudflare could not confirm it. We checked each one against the address lists Google and Bing publish for their crawlers: 99 percent came from outside them. Every verified Googlebot sat inside Google’s list, so the test tells the two apart.
The same happened with AI names. About 30,700 requests called themselves ChatGPT, Claude, Perplexity, Bytespider and other AI crawlers without being verified. Nearly nine in ten came from 48 addresses that each used at least three different AI names, some of them twelve. That is not an AI company reading your site; it is someone hiding behind their names.
On the 17 sites we look after on Cloudflare, ours included, requests claiming to be Google or Bing that Cloudflare could not verify (about 111,000) outnumbered the verified search engine requests (about 51,500) by two to one.
How to tell bot load from real traffic
Start with your own tools. Uptime monitors, deploy checks, SEO crawlers and page-speed tests all count as traffic. On our site they were the biggest group. They make every chart look busier than it is, so name them first and set them aside.
Trust proof, not names. A user agent is a line of text any program can write. What counts is whether the visitor can prove it. Google offers two ways to check a crawler: a reverse DNS lookup on the address in your logs, then a forward lookup to confirm it, or matching the address against Google’s published IP ranges. Cloudflare runs its own check on every request and marks the ones that pass as known bots.
Know what your numbers cannot say. On Cloudflare’s free plan, the traffic data separates bots that prove who they are from everything else. It does not tell you how many of the rest were people, because an ordinary browser name is as easy to fake as a crawler’s. For people, look at an analytics tool that counts page views in the browser, and treat the server’s request count as load, not audience.
What to block
Anything that claims to be a search engine and cannot prove it. On Cloudflare, a custom rule can block a request whose user agent says Googlebot or Bingbot when Cloudflare’s known-bot check says no. That stops the impostors and never touches the real crawler. Never block by name alone: a few requests from inside Google’s own ranges carried unusual names, and a name-only rule would have caught them.
AI crawlers, if you choose to. Cloudflare lets every customer block AI bots by what they do: crawling to train models, crawling to answer search questions, or fetching pages live for a person. Each setting covers the verified bots of that kind and some unverified ones that behave the same way. Whether to allow AI search, which can send you visitors, is a business choice.
Rotators. An address that keeps changing its name is not worth serving. A rule aimed at that pattern should never reach a real visitor, who keeps one browser name.
What never to block
Googlebot. Google says rules addressed to Googlebot affect Google Search, as well as other products such as Google Images and Google News. Block the real one and you are asking to leave Google.
AdsBot. If you run Google Ads, AdsBot checks your landing pages. Google notes that AdsBot ignores the global robots.txt user agent, the asterisk line, so a blanket “disallow everything” there does not stop it, but a firewall rule does. Blocking it can hurt ads you are paying for.
Google-Extended, if your worry is Gemini. It is a robots.txt token, not a separate crawler, and Google says it does not affect your inclusion in Google Search. You can turn AI training off there without touching Search.
The Bot Traffic Check
We offer this as one fixed-scope job, for one site on one domain that already runs on Cloudflare. We read 30 days of its traffic and separate verified search engines, AI crawlers, your own tools and the impostors. We test every request that claims to be Googlebot or Bingbot against Google’s and Bing’s published lists. Then we set the rules: impostors blocked, AI crawlers as you choose, Googlebot and AdsBot left alone. You get a short written report of what we found and each rule we set, so any of them can be undone. The price is US$450, fixed, for one site.
To ask for it, write to info@grafica.group with the subject “Bot Traffic Check”.
Gráfica built this survey as a WordPress plugin, and builds plugins like it for clients. Tell us what your site needs
