AI Bot Filtering

Bot traffic hit 45% of US internet traffic in early 2026 (Cloudflare), but the worst of it never visits the site at all. Ghost traffic posts fabricated events directly to GA4’s Measurement Protocol endpoint using the Measurement ID exposed in page source, bypassing the origin server and any CDN defences. That means GA4’s IAB bot filter, Cloudflare WAF rules, and country-level IP blocks are architecturally incapable of stopping it. The only durable fix is moving the source of truth off GA4 and onto a first-party server-side pipeline where every event is authenticated at origin.

HUMAN Security measured a 6,900% increase in AI-agent and agentic-browser requests since July 2025, and a 144.7% surge during Black Friday to Cyber Monday 2025 specifically targeting e-commerce sites. If your WooCommerce GA4 is showing rising sessions and flat purchases since October 2025, this is probably why. ChatGPT Atlas and Perplexity Comet are already walking … Read more

AI bot traffic grew 187% through 2025 while human traffic grew just 3.1%, and on March 24, 2026 OpenAI killed in-chat Instant Checkout and started routing ChatGPT shoppers back to merchant storefronts. ChatGPT-User, PerplexityBot, and Meta-ExternalAgent now hit WooCommerce product and checkout pages dozens of times per week, counted as real sessions in GA4. Robots.txt and GA4 regex filters miss undeclared bots. The fix is filtering known AI user-agent strings at the server-side event pipeline — before bot sessions ever reach GA4, Google Ads Smart Bidding, or Facebook CAPI.