Bot Traffic: Why Your Click Counts Are Lying

Say you share a link once, in one Slack channel, at 9:14 on a Tuesday. By 9:15 the dashboard shows 200 clicks. Nobody on the team has even seen the message yet. Half of them are in a meeting.

Those clicks would be real, in the sense that something requested your URL 200 times. But not one of them needs to be a person. Slack fetched the link to build a preview card. A security tool followed it to check for malware. A handful of crawlers noticed the new URL and came sniffing. Every one of those requests looks, to a naive counter, exactly like a human clicking, which is kind of wild when you realize how much of your dashboard is built on that assumption.

This is the part of link analytics almost nobody explains, and it changes how you read every number you have. If your reports say email outperforms everything else, you need to know whether that's your subscribers or their spam filters. If a campaign "spiked" the moment it launched, was that interest, or machines doing their jobs?

This page covers who these non-human clickers are, how they get caught, and what your numbers look like once they're gone. It's one piece of a bigger picture, so if you want the full journey from click to conversion, start with the complete link tracking guide and come back. Here, we're just dealing with the robots.

The machines that click your links

Every click on your links comes from either a person with a thumb or a machine with a job to do. The machines fall into three families, and once you know them you'll start spotting their fingerprints everywhere.

First, the search crawlers. Google, Bing, and their smaller cousins follow every link they can find, because that's how the entire web gets indexed. When your link lands on a public page, a crawler will visit it, often within hours. This is the polite family. They announce who they are, they visit predictably, and you want them there. Nobody finds your content if the crawlers don't.

Second, the scrapers. These are bots harvesting content for someone else's purposes: SEO tools mapping who links to whom, researchers collecting data, price monitors, and plenty of murkier operations that just vacuum up everything. Scrapers range from well-behaved to openly deceptive. Their visits look a lot like traffic if you're not filtering.

The third family is the one that catches everyone off guard. Preview fetchers. Paste a link into Slack and a little card appears with a title, description, and image. Where did that come from? Slack visited your link. So does WhatsApp. So does iMessage, Teams, Discord, LinkedIn, and basically every app that unfurls a preview. Each of those visits registers as a click, even though no human went anywhere.

Email is where this gets genuinely wild. Corporate email security scanners open every link in every incoming message to check for malware, before the recipient has even seen the email.

Say you send a campaign to 5,000 inboxes at companies with strict security. A burst of "clicks" can land within minutes of hitting send, long before anyone could have read the email. Nobody clicked anything. Robots did a safety inspection, and your dashboard called it engagement.

Here's a useful way to think about it. Crawlers are the mail carrier noting your address exists. Scrapers are strangers photographing your house, and preview fetchers are the neighbor who opens your package to describe the contents to someone else. None of them are the friend you actually invited over, but a raw click counter treats all four visitors exactly the same.

And that share isn't trivial. On a link posted somewhere public, or sent to inboxes behind security scanners, machine visits can be a large part of the count. So how do you tell them apart?

How bots get filtered

The good news first. Most bots tell you exactly who they are.

Every request to your link arrives with a user agent, a short text label that says what kind of software is asking. A browser sends something like "Chrome on a Mac." Google's crawler sends "Googlebot." Slack's preview fetcher literally says "Slackbot" right there in the request. It's like a visitor signing the guest book at the front door with their real name. Well-behaved bots do this on purpose, because they want to be identified. A search crawler that got mistaken for a person would get rate-limited, blocked, and generally treated worse than one that announces itself.

So the core of bot filtering is pretty simple. Keep a list of known bot signatures, check every click's user agent against it, and don't count the matches. The lists are long, covering many crawlers, scrapers, preview fetchers, and email security scanners, and new ones keep showing up. But the mechanism itself is just pattern matching. Nothing exotic.

There's a second layer on top of that. Some bots don't announce themselves in the user agent but leave other hints in how they behave. The same address clicking dozens of times in a minute isn't a person browsing. It's a script. A request with no user agent at all is another tell, because real browsers always send one. Neither of these proves a click is fake on its own. In Acturity, a missing user agent or fast repeat clicks raise a click's bot score, but only a match against a known bot signature marks it as a bot. That keeps real people on a shared office connection from being thrown out, and it means a bot that hides its name and clicks at a human pace gets through.

Now the honest caveat, and it matters. A bot that lies is much harder to catch. Anyone can send a fake user agent claiming to be Chrome on a Mac. It's a text field, not a passport. A scraper that copies a real browser's signature and routes through residential IP addresses will slip past signature lists and most behavioral checks too. The sophisticated ones are genuinely difficult to distinguish from humans, because imitating a human is the entire point of their design.

Which is why filtered numbers are best read as a floor on the truth, not the whole truth. Filtering catches the bots that identify themselves. What remains is your real traffic plus whatever managed to lie convincingly. That's still a far more honest number than the raw count. Just remember it's your best estimate, not a certified head count.

What your numbers look like before and after

Let's make this concrete with a campaign you've probably run a version of. An email blast to 5,000 subscribers, plus the same link posted to LinkedIn and X on the same morning. The numbers below are made up to show the effect. They are not measured results.

Raw numbers, end of day one:

Channel	Raw clicks	After bot filtering
Email	610	340
Social	290	245

Look at what happened to email in this example. Nearly half of it evaporated. That's the pattern to expect from email, not a sign your tool is being aggressive. Machine clicks pile up there because corporate email security scanners open every link in every message before a human ever sees the inbox. Send to 5,000 addresses and some of them sit behind a scanner that clicks your link within seconds of delivery. One send can produce a burst of instant "clicks" with no human behind them.

Social gets inflated too, mostly by preview fetchers rendering the little link card, but the damage tends to be smaller. A platform usually builds one preview card per post, not one per recipient.

Now watch what this does to a decision. On raw numbers, email got 610 clicks and social got 290, so email looks like it's beating social two to one. Next quarter's budget follows that ratio. On filtered numbers it's 340 versus 245, which is a much closer race, and once you factor in what each channel costs you to run, the ranking might genuinely flip.

Same campaign, same day, opposite conclusion.

That's the real cost of bot clicks. It's not that the totals are too big, it's that they're too big unevenly, and the unevenness tends to flatter email.

There's a useful side effect once you filter, too. Your click counts move closer to what Google Analytics reports for the same campaign, because GA never saw most of those scanner hits in the first place. It won't close the gap completely, and there are other reasons the numbers disagree, but bots are one of the biggest.

So when you compare channels, account for bots first. If your tool can't split them per channel, compare the channels on a day with no fresh send, when scanners are quiet. Raw numbers aren't just noisy. They're biased. If email is the channel you're judging, our post on short links in email marketing covers how to structure and read those links.

Check it yourself

You can see all of this on your own links. Create a test link, paste it into a private Slack channel, and don't click it. Then look at the click count. If it moved, a preview fetcher did that, not you. Afterwards, open the bot traffic report and check whether the bot count went up and under which reason.

It's a small test, and it's the quickest way to stop thinking of raw counts as people.

Judging any analytics tool by its bot handling

Once you know bots exist, you can't unsee them. Every click count you look at, in any tool, now carries the question of whether anything filtered it. So when you're evaluating a tracker, whether it's built into your email platform or a dedicated tool, there are three questions worth asking.

First, does it filter bots at all? Some tools don't. They count every request that hits the link, preview fetchers and all, and a bigger number looks better on the dashboard. If the docs don't mention bot filtering anywhere, assume it doesn't happen.

Second, can you see what was filtered? This one matters more than people expect. A tool that says "we removed 340 bot clicks from this campaign" is showing its work. A tool that silently adjusts the numbers is asking you to trust a black box, and you have no way to sanity-check whether it filtered too little or too much. Transparency here is like an itemized receipt versus a total scrawled on a napkin. Both give you a number. Only one lets you argue with it.

Third, does filtering happen before or after your reports? Some tools count everything, then let you apply a bot filter as an afterthought, a checkbox you have to remember every time. That means every export, every screenshot, every number someone pastes into a slide defaults to the inflated version. Filtering should happen before the click ever reaches your reports, so the clean number is the only number anyone sees.

Here is where Acturity stands on those three questions. Every click is scored for bot likelihood, and the bot traffic report shows suspected bot clicks with totals, a breakdown by reason, and a daily trend. So you can see what was flagged and why.

The part we don't want to oversell is the third question. Excluding suspected bots from your counts, billing, and webhooks is a switch that Acturity operates, not you, and it is off by default. Until it is switched on, bot clicks are still included in your totals and still sent to webhooks. Today that means the report tells you how big the problem is, and your headline count still includes it. We would rather say that plainly than hand you a smaller number and call it filtered.