GA4 Bot Traffic Test: 1,000 Fake Visitors, 0 Filtered

Skip to main content

Clickport

Login<br>Start free trial<br>Pricing

Product

Intuitive Dashboard<br>Real-Time Analytics<br>Session Tracking<br>Engagement Tracking<br>Goal Conversions<br>Filtering & Segments<br>Conversion Funnels<br>User Flows<br>Privacy First<br>Bot Protection

Solutions

For agencies<br>For SaaS<br>For e-commerce<br>For affiliates<br>For bloggers<br>For publishers<br>Google Search Console<br>Bing Webmaster Tools<br>WordPress<br>Shopify<br>Tracker install<br>SPA tracking<br>Custom Events<br>API reference<br>vs Google Analytics<br>vs Matomo<br>vs Cloudflare

Resources

How It Works<br>Blog<br>Updates<br>Documentation<br>UTM Builder<br>GDPR Checker<br>GA4 Data Loss Estimator<br>GA Legal Status<br>About<br>Contact<br>Status<br>Security

Show article contentsHide article contents

51% of web traffic is now bots

Our test: 1,000 bot sessions, 5 scenarios

Round 1: Known bot User-Agent strings

Round 2: Default headless Chrome

Round 3: Stealth bots from cloud servers

Round 4: Referrer spam

Round 5: Stealth bots from residential IPs

Final scorecard: GA4 0% vs Clickport 80%

Why GA4's bot filtering fails

How Clickport's 6-layer bot detection works

What bot traffic does to your business decisions

What we learned

We sent 1,000 fake visitors to a site running GA4. GA4 flagged none of them. Not one.

So we ran the whole thing as a controlled experiment. Five rounds of bots, from the obvious to the sophisticated, on a site running both GA4 and Clickport side by side. Here is what each tool counted.

Key Takeaways

GA4's built-in bot filter uses the IAB known-bot list, which only catches bots that self-identify. In our test of 1,000 bot sessions across 5 scenarios, GA4 filtered zero.

51% of all web traffic is now automated, with bad bots alone accounting for 37% (Imperva 2025). AI-driven bot creation has pushed simple bot traffic up from 40% to 45% of all bad bot activity.

Clickport's 6-layer detection system (webdriver signals, UA patterns, datacenter IP blocking, spam referrer lists, viewport checks) caught 80% of our test bots before they reached the database.

Round 5's stealth bots on residential proxies fooled both tools. No client-side analytics tool catches these. 200 of 1,000 got through.

GA4's data deletion only strips parameter text. Event counts stay permanently. Zero property-level bot filters means inflated numbers are irreversible.

51% of web traffic is now bots

Before the results, look at the scale of the problem. It is bigger than most people think.

Start with the Imperva 2025 Bad Bot Report, the most comprehensive annual study on bot traffic. Bad bots alone account for 37% of all internet traffic, up from 32% in 2023. Good bots, the search engine crawlers and monitoring tools, take another ~14%. Human traffic? Just 49%. Less than half the web is people.

The other studies land in the same place. Akamai's research puts total bot traffic at 42%, with 65% of those malicious. Cloudflare's 2025 Year in Review found non-AI bots alone generated 50% of requests to HTML pages, 7% more than human traffic. The bots are already on top, and that is before you count the AI ones.

AI is what changed the math. DoubleVerify reported an 86% year-over-year increase in general invalid traffic in the second half of 2024, with AI scrapers like GPTBot, ClaudeBot, and AppleBot accounting for 16% of GIVT from known-bot impressions. Akamai saw a 300% surge in AI bot activity year over year. Triple the bots, one year apart.

Cloudflare CEO Matthew Prince said it plainly at SXSW on March 14, 2026: bot traffic will exceed human traffic by 2027.

And the bots keep getting better at hiding. Barracuda's threat research classified 49% of detected bots as "advanced," built to mimic human browsing. Imperva found simple bots grew from just under 40% to 45% of all bad bot traffic, because AI tools make a convincing bot trivially easy to build. The cost of faking a human went down. The volume went up.

Global web traffic composition (2024)

Bad bots

37%

Good bots

14%

Human traffic

49%

Source: Imperva 2025 Bad Bot Report

So here's the question that matters. If your analytics tool can't tell a bot from a person, which numbers on your dashboard can you trust? Your traffic is inflated. Your engagement rates are watered down. Your A/B tests are polluted. Your marketing decisions rest on fiction. The dashboard looks confident, and it's wrong.

Our test: 1,000 bot sessions, 5 scenarios

The setup was simple. A fresh Astro site on Vercel with five pages: a homepage, three content pages, and a contact page. Both GA4 (via gtag.js) and Clickport's tracking script were installed. We turned off Vercel's own bot protection so both tools saw the raw traffic.

The bots ran on Puppeteer on Node.js 20. Each scenario faked a different level of sophistication. And every bot session behaved like a person: 50% scrolled the page, 30% clicked an internal link and moved to a second page, and all of them paused between 2 and 8 seconds between actions. In plain terms, these were not...