Updated 16 September 2026
01 · why the numbers move on their own
Why the numbers move on their own
GA4's bot filtering works from the IAB known-spiders list, matched on the user agent string. That catches declared crawlers, which is genuinely most of the volume, and it is the reason the feature works at all.
It does not catch anything that does not declare itself. A headless browser sends a normal Chrome user agent because it is a normal Chrome. An automation framework sends whatever string it was told to send. Neither is exotic any more: both are a few lines of setup.
The result is not a wrong total so much as a wrong shape. Sessions with no scroll, no engagement and a hard exit sit in the same bucket as people, and every rate computed from that bucket drifts in a direction that looks like a content problem.
02 · automated clients botscope tracks by name
Automated clients Botscope tracks by name
Each has a documented operator and a verification method. The default policy is the catalogue default; you can override any of them per site.
| Bot | Operator | Default policy | Verifiable |
|---|---|---|---|
| AI Search | Cloudflare | Observe | By user agent |
| AIWebIndex-Agent | Lyrenth | Observe | By user agent |
| Amazon Kendra | Amazon | Observe | By user agent |
| Amazonbot | Amazon | Observe | By user agent |
| Amzn-SearchBot | Amazon | Observe | By user agent |
| Anchor Browser | Anchor | Observe | Signed requests |
| Anomura | Direqt | Observe | By user agent |
| Applebot | Apple | Observe | By user agent |
| Atlassian (Rovo AI) | Atlassian | Allow | By user agent |
| atlassian-bot | Atlassian | Observe | By user agent |
Read live from the Botscope crawler catalogue. Default policy is the catalogue default; every agent can be overridden per site.
03 · separating the two populations
Separating the two populations
- 1 Connect the site. Requests are classified server-side, so nothing depends on a script running in the visitor’s browser.
- 2 Leave it in observe mode and read a week. Observe records what would have happened without changing any response.
- 3 Compare the automated segment against your analytics for the same window. The gap is what GA4 was counting as people.
- 4 Decide per agent. Search crawlers stay allowed, and the rest get a policy you choose.
04 · what this does not do
What this does not do
It does not retroactively clean historical GA4 data. Nothing can: those sessions were recorded without the signal that would have separated them.
It does not identify an automated client that has never been seen anywhere, has no documented operator, and behaves exactly like a person. Anything claiming otherwise is describing a detector that also flags people.
Questions
Does this change my GA4 data?
No. Botscope classifies traffic at your origin and reports on it separately. Your GA4 property is untouched, historical data included.
Will it block Googlebot?
Not unless you tell it to. Search crawlers default to allow, and Googlebot is verified by reverse DNS rather than by its user agent, so an impostor claiming to be Googlebot does not inherit that permission.
Do I need to change my DNS?
No. Botscope runs at your origin through an agent or a platform integration. Nothing is re-pointed and no traffic is proxied through us.
What happens on the free plan?
Every feature, 100,000 events a month, no card. Capacity is bought in blocks on top of that if you need more.
See which of these reach your site
Free plan, no card: 100,000 events a month with every feature on. Nothing is blocked until you turn enforcement on.