The million SaaS Browser visitors who never were

On paper, SaaS Browser is having a splendid autumn. The site, a directory of software companies that I also own, drew 1.2m active users in the 28 days to mid-October, according to Google Analytics, up 176% on the period before. It is also, for the most part, fiction. The visits happened. The visitors did not.

The bots that got past the guards#

SaaS Browser sits behind Cloudflare with Super Bot Fight Mode switched on. The bots arrive regardless. A modern scraper drives a real copy of Chrome, sends the headers a person's browser would send and runs the page's JavaScript. To a firewall, and to an analytics script, it is a visitor. Imperva, a security firm, reckons that bots made 51% of all web traffic in 2024, the first year in a decade in which machines outnumbered people.¹ AI companies hungry for training data explain much of the rise, and a site with many pages in many languages is a feast.

Why nobody knows their human traffic#

I moved all of my sites from Google Analytics to Privatus Analytics this month. It sets no cookies, needs no cookie banner and hands no record of my readers to an advertising company. Privacy is a human right.² But the move did not, at first, change the picture. The live view showed 298 visitors on the site at once.

Every row was desktop Chrome, and almost none arrived from another website. A visitor in Singapore read Spanish lists of software, one after another. It is possible that Singapore harbors a sudden passion for Spanish software directories. It is not likely. Then I ticked one box, "Likely humans only".

The 298 became 14, fewer than one visitor in 20. The filter is strict (it also leaves out visits marked "unsure") and a live count is a snapshot. But no reasonable allowance turns 14 into 298.

Of witches and dashboards#

For three centuries educated Europeans believed in witches. There were manuals, courts and expert witnesses, and records survive of more than 43,000 people tried in 21 countries.³ The evidence was abundant because the process was built to produce it. Web analytics has the same shape. The tool counts whatever runs its script, calls the total people, and the total is believed because it is a number on a screen.

The cost is real. Divide real sign-ups by a crowd that is 95% software and a healthy page looks broken. A channel that sends bots looks cheap per visit, so campaign budgets go to the wrong place. An A/B test fed with bots takes longer and may crown the wrong winner (my own homepage test scored only one visit in three as likely human).

Counting people, not requests#

I tried several other analytics tools and none could separate the bots from the people, so I built Advanced Bot Detection. When a visit begins, a machine learning model weighs some two dozen signals, among them the browser and operating system, whether the details of the request agree with one another and whether the time zone fits the country. It learns from both sides: bots that walk into honeypots, links no person can see, and people on signed-in pages of my own sites. Because each site's honeypots catch its own bots, the model sharpens itself for every site. Each visit is labeled "likely human", "unsure" or "likely bot", and none is deleted.

Privacy, and what the GDPR says#

The score is worked out in memory and only the label is kept. The IP address, the User-Agent, the headers and the time zone are discarded, except for honeypot hits, which no person can make (the docs set out exactly what is stored). The GDPR does not mention bots, but it lets a business process data for its legitimate interests, and Recital 47 says:⁴

A program that pretends to be a person is, in my view, committing just such a fraud. It passes off a fake audience as a real one, and leaves the site owner to pay for it and plan around it. Recital 49 says the same of what is "strictly necessary and proportionate" for network security. Those two words set the limit, and keeping a bot's address while discarding everyone else's is how I try to respect it. (This is my reasoning, not legal advice. See the GDPR page.)

The honest number#

SaaS Browser's real audience is a small fraction of what Google Analytics reported. That is humbling to publish, but it is the first figure for the site I can act on. Advanced Bot Detection is part of the Pro plan (see pricing). A smaller number that is true is worth more than a large one that is not.

References#

1. Imperva, "2025 Imperva Bad Bot Report: How AI is Supercharging the Bot Threat", April 2025. https://www.imperva.com/blog/2025-imperva-bad-bot-report-how-ai-is-supercharging-the-bot-threat/

2. United Nations, "Universal Declaration of Human Rights", 1948, Article 12. https://www.un.org/en/about-us/universal-declaration-of-human-rights

3. Peter Leeson and Jacob Russ, "Witch Trials", The Economic Journal, 128(613), 2018, pages 2066 to 2105. https://doi.org/10.1111/ecoj.12498

4. Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation), Article 6(1)(f) and Recitals 47 and 49. https://eur-lex.europa.eu/eli/reg/2016/679/oj