Bot Clicks: Why Your Click Counts Are Lying

You share a link once, in one Slack channel, at 9:14 on a Tuesday. By 9:15 it has 200 clicks. Nobody on the team has even seen the message yet. Half of them are in a meeting.

Those clicks were real, in the sense that something requested your URL 200 times. But not one of them was a person. Slack fetched the link to build a preview card. The company's email security gateway followed it to check for malware. A handful of crawlers noticed the new URL and came sniffing. Every one of those requests looks, to a naive counter, exactly like a human clicking, which is honestly kind of wild when you realize how much of your dashboard is built on that assumption.

This is the part of link analytics almost nobody explains, and it changes how you read every number you have. If your reports say email outperforms everything else, you need to know whether that's your subscribers or their spam filters. If a campaign "spiked" the moment it launched, was that interest, or machines doing their jobs?

This page covers who these non-human clickers are, how they get caught, and what your numbers look like once they're gone. It's one piece of a bigger picture, so if you want the full journey from click to conversion, start with the complete link tracking guide and come back. Here, we're just dealing with the robots.

The machines that click your links

Every click on your links comes from either a person with a thumb or a machine with a job to do. The machines fall into three families, and once you know them you'll start spotting their fingerprints everywhere.

First, the search crawlers. Google, Bing, and their smaller cousins follow every link they can find, because that's how the entire web gets indexed. When your link lands on a public page, a crawler will visit it, often within hours. This is the polite family. They announce who they are, they visit predictably, and honestly, you want them there. Nobody finds your content if the crawlers don't.

Second, the scrapers. These are bots harvesting content for someone else's purposes: SEO tools mapping who links to whom, researchers collecting data, price monitors, and plenty of murkier operations that just vacuum up everything. Scrapers range from well-behaved to openly deceptive. Their visits look a lot like traffic if you're not filtering.

The third family is the one that catches everyone off guard. Preview fetchers. Paste a link into Slack and a little card appears with a title, description, and image. Where did that come from? Slack visited your link. So does WhatsApp. So does iMessage, Teams, Discord, LinkedIn, and basically every app that unfurls a preview. Each of those visits registers as a click, even though no human went anywhere.

Email is where this gets genuinely wild. Corporate email security scanners open every link in every incoming message to check for malware, before the recipient has even seen the email.

Send a campaign to 5,000 inboxes at companies with strict security, and you can watch hundreds of "clicks" roll in within minutes of hitting send. Nobody clicked anything. Robots did a safety inspection, and your dashboard called it engagement.

Here's a useful way to think about it. Crawlers are the mail carrier noting your address exists. Scrapers are strangers photographing your house, and preview fetchers are the neighbor who opens your package to describe the contents to someone else. None of them are the friend you actually invited over, but a raw click counter treats all four visitors exactly the same.

And that share isn't trivial. Depending on where your links live, the machines can easily outnumber the humans. So how do you tell them apart?

How bots get filtered

The good news first. Most bots tell you exactly who they are.

Every request to your link arrives with a user agent, a short text label that says what kind of software is asking. A browser sends something like "Chrome on a Mac." Google's crawler sends "Googlebot." Slack's preview fetcher literally says "Slackbot" right there in the request. It's like a visitor signing the guest book at the front door with their real name. Well-behaved bots do this on purpose, because they want to be identified — a search crawler that got mistaken for a person would get rate-limited, blocked, and generally treated worse than one that announces itself.

So the core of bot filtering is honestly pretty simple. Keep a list of known bot signatures, check every click's user agent against it, and don't count the matches. The lists are long — hundreds of crawlers, scrapers, preview fetchers, and email security scanners, with new ones showing up constantly — but the mechanism itself is just pattern matching. Nothing exotic.

There's a second layer on top of that. Some bots don't announce themselves in the user agent but are still catchable by how they behave. A "click" that arrives 40 milliseconds after the link was created, from a data-center IP address, with no cookies and no screen size? That's not a person. People don't click that fast, and people don't browse from server farms.

Now the honest caveat, and it matters. A bot that lies is much harder to catch. Anyone can send a fake user agent claiming to be Chrome on a Mac — it's a text field, not a passport. A scraper that copies a real browser's signature and routes through residential IP addresses will slip past signature lists and most behavioral checks too. The sophisticated ones are genuinely difficult to distinguish from humans, because imitating a human is the entire point of their design.

Which is why filtered numbers are best read as a floor on the truth, not the whole truth. Filtering removes the bots that identify themselves, which is most of them by volume — the preview fetchers and search crawlers alone account for an enormous share of machine clicks. What remains is your real traffic plus whatever managed to lie convincingly. That's still a far more honest number than the raw count. Just remember it's your best estimate, not a certified head count.

What your numbers look like before and after

Let's make this concrete with a campaign you've probably run a version of. An email blast to 5,000 subscribers, plus the same link posted to LinkedIn and X on the same morning.

Raw numbers, end of day one:

Channel	Raw clicks	After bot filtering
Email	610	340
Social	290	245

Look at what happened to email. Nearly half of it evaporated. That's not a fluke, and it's not your tool being aggressive. Email is the channel where machine clicks pile up the most, because corporate email security scanners open every link in every message before a human ever sees the inbox. Send to 5,000 addresses and a meaningful chunk of them sit behind a scanner that clicks your link within seconds of delivery. One send, hundreds of instant "clicks", zero humans.

Social gets inflated too, mostly by preview fetchers rendering the little link card, but the damage is smaller. A post gets previewed once per platform, not once per recipient.

Now watch what this does to a decision. On raw numbers, email got 610 clicks and social got 290, so email looks like it's beating social two to one. Next quarter's budget follows that ratio. On filtered numbers it's 340 versus 245, which is a much closer race, and once you factor in what each channel costs you to run, the ranking might genuinely flip.

Same campaign, same day, opposite conclusion.

That's the real cost of bot clicks. It's not that the totals are too big, it's that they're too big unevenly, and the unevenness always flatters email.

There's a useful side effect once you filter, too. Your click counts start landing much closer to what Google Analytics reports for the same campaign, because GA never saw most of those scanner hits in the first place. It won't close the gap completely, and there are other reasons the numbers disagree, but bot inflation is usually the biggest single chunk of it.

So when you compare channels, compare filtered numbers or don't bother. The raw ones aren't just noisy. They're biased.

Judging any analytics tool by its bot handling

Once you know bots exist, you can't unsee them. Every click count you look at, in any tool, now carries the question of whether anything filtered it. So when you're evaluating a tracker, whether it's built into your email platform or a dedicated tool, there are three questions worth asking.

First, does it filter bots at all? Plenty of tools don't. They count every request that hits the link, preview fetchers and all, because a bigger number looks better on the dashboard. If the docs don't mention bot filtering anywhere, assume it doesn't happen.

Second, can you see what was filtered? This one matters more than people expect. A tool that says "we removed 340 bot clicks from this campaign" is showing its work. A tool that silently adjusts the numbers is asking you to trust a black box, and you have no way to sanity-check whether it filtered too little or too much. Transparency here is like an itemized receipt versus a total scrawled on a napkin. Both give you a number. Only one lets you argue with it.

Third, does filtering happen before or after your reports? Some tools count everything, then let you apply a bot filter as an afterthought, a checkbox you have to remember every time. That means every export, every screenshot, every number someone pastes into a slide defaults to the inflated version. Filtering should happen before the click ever reaches your reports, so the clean number is the only number anyone sees.

For what it's worth, this is how we built Acturity. Known bots and preview fetchers get filtered before counting, so the click analytics you see are people by default, not Slack unfurling your link for the ninth time. The raw number was never the interesting one anyway.