# Your Analytics Are Lying: How to Segment Bot Traffic Out Before You Trust a Number

Source: https://botbulwark.com/blog/2026-11-07-segment-bot-traffic-analytics.html

[Home](../index.md) / [Blog](index.md)


**Short answer:** If you read blended traffic numbers without removing bots, you are optimizing for machines. Split genuine from invalid traffic first, and the conversion rate you have been chasing usually turns out to be a different number entirely.

## GIVT and SIVT are not the same problem

The ad industry splits invalid traffic in two for a reason. General invalid traffic is the easy kind: known crawlers, spiders, and data center traffic that a standard list can name. It inflates session counts and depresses conversion rates, but it does not pretend to be human, and it is straightforward to filter. Sophisticated invalid traffic is the hard kind: bots that rotate residential IPs, move a mouse, scroll a page, and pass the checks that catch the easy kind.

Practitioners refuse to collapse the two into one number because the defenses are different. GIVT is a list problem, solved by keeping the list current. SIVT is a behavior problem, solved by watching what the visitor does, not what it claims to be. A store that reports a single bot percentage is hiding the only distinction that decides what to do next.

## The three cuts that expose the bots

First, cut by duration and depth. Sessions that last zero seconds, never scroll, and never add to cart are not shoppers having a bad day. They are machines checking whether the page loads. Second, cut by revenue. A traffic source that delivers thousands of sessions and zero orders over a month is not a marketing channel with a conversion problem. It is a bot source, and the money spent feeding it is the leak.

Third, cut by shape. Real traffic spreads across devices, geographies, and hours. Bot traffic clusters: one device type, one narrow geography, one hour of the day, thousands of sessions. Google Analytics filters the known bots automatically, but the sophisticated ones need server-side signals, request rates, header order, and TLS fingerprints that analytics never sees. The three cuts together give you a bot share you can defend in a meeting, instead of a feeling.

## What to do with the number once it is clean

Split the metrics before you trust them. Conversion rate by source, by device, and by new versus returning visitors will each tell a different story than the blended number, and the story that matters is the one that moved. A blended conversion rate that looks stable while revenue per session falls usually means the traffic mix shifted toward low-intent sessions, not that the store got worse.

Then stop buying against the dirty number. Ad spend aimed at a blended conversion rate buys bot sessions at the same price as human ones, and the platform is happy to sell them. Set the segment first, then the target. The clean number is almost always lower than the number you have been reporting, and that is the point: a lower number you can trust beats a higher number that includes machines.

Keep reading: [Why Real Users Fail CAPTCHA and Bots Pass It](https://botbulwark.com/blog/2026-11-07-real-users-fail-captcha.md), [Headless Browsers vs Real Browsers: How Bot Detection Tells Them Apart](https://botbulwark.com/blog/2026-11-07-headless-browsers-bot-detection.md).

## Frequently asked questions

### What is the difference between GIVT and SIVT?

GIVT, general invalid traffic, is traffic from known crawlers, spiders, and data centers that can be identified with a standard list. It is recoverable waste: it inflates sessions but does not pretend to be human. SIVT, sophisticated invalid traffic, is fraud that mimics human behavior, rotating IPs, faking mouse movement, and passing simple checks. The two need different defenses, which is why the industry refuses to collapse them into one number.

### Does Google Analytics filter bots automatically?

Google Analytics 4 automatically filters traffic from known bots and spiders, using the IAB list of known crawlers. That covers the GIVT layer. It does not catch sophisticated bots that mimic human behavior, rotate residential IPs, or run real browsers. For those, you need server-side signals and a bot management layer, not an analytics setting.

### How much of my traffic could be bots?

It varies by store and channel, so quote your own number, not the internet's. Measure it: segment sessions by known-bot filters, then look at the share with zero-second duration, no scroll, and no revenue. That share is your bot load, and it is the only number that matters for your decisions.

### Can I just block all bots?

No. Search crawling, price comparison, research, and uptime monitoring are legitimate bot traffic, and blocking them all would remove your store from search results and break your own monitoring. The goal is to block abusive bots while letting useful ones through, which is a classification problem, not a ban.

[Get a free bot-traffic audit](mailto:hello@botbulwark.com?subject=Free%20free%20bot-traffic%20audit)