Trending
Most bot traffic does not announce itself. It arrives looking like a slightly odd visitor, blends into your normal logs, and only becomes obvious when something breaks. The good news is that you do not need a security team or an expensive platform to catch it early. You need a handful of numbers, checked consistently, and a rough idea of what "normal" looks like for your site.
This is a beginner's starting point. Seven metrics, why each one matters, and how to build a habit around them without drowning in dashboards.
Request rate is the first thing to watch because bots are usually impatient. A human browsing a shop might load eight or ten pages in five minutes, pausing to read, compare, and think. A scraper might pull four hundred in the same window. Neither number is a problem on its own, but the pattern is.
Track two versions of this metric: requests per IP address and requests per session. Per IP catches the aggressive single-source crawler. Per session catches the smarter bot that rotates through a pool of addresses but keeps one consistent cookie or session token.
Set a threshold you can defend. If your busiest legitimate user makes 60 requests an hour, anything above 150 deserves a look. Adjust as you learn.
The user agent string is the easiest thing for a bot to fake and the easiest thing for you to check. Most automated traffic either lies badly or tells the truth too well.
Three categories are worth flagging. First, the impossible combination: a user agent claiming to be an iPhone running a browser version that never shipped on iOS, or a desktop Chrome string paired with a mobile-only viewport. Second, the stale string: versions that stopped existing years ago, still making thousands of requests. Third, the self-identifying bot: strings containing words like python-requests, curl, or go-http-client, which are fine if you invited them and suspicious if you did not.
Keep a short list of the user agents that hit you most often and review it weekly. Over time you will recognise the regulars, both the welcome ones and the ones you would rather block.
Credential stuffing is relentless and cheap. Attackers take a list of leaked email and password pairs, point a script at your login form, and try thousands of combinations. Your failed-login count is where that shows up first.
Watch two shapes. Account-based: one account accumulating failures from many different IPs, which suggests a distributed attack aimed at a single user. IP-based: one address failing against hundreds of different accounts, which is the classic stuffing pattern.
One failed login is a typo. Fifty failed logins across forty accounts from one address in ten minutes is not.
If you only track one security metric today, make it this one. It is the clearest early signal you will get.
You do not need precise geolocation to use this metric. Country-level data is enough. If your business serves customers in three countries and 70 percent of last night's traffic came from a fourth, that is worth understanding before you assume it is a marketing success.
Geographic concentration also helps you interpret the other numbers. A spike in request rate from a region where you have no customers is a very different story than the same spike from your largest market.
Bots are clumsy. They guess URLs that do not exist, request product IDs outside your range, and hammer forms with malformed data. That produces 404s, 400s, and 500s in patterns a human rarely creates.
Break your error rate down by endpoint rather than watching a single sitewide number. A 404 spike on /search tells you someone is enumerating queries. Repeated 400s on your checkout endpoint suggest automated form submissions. A rising 500 rate on a page that normally never fails might mean a bot is sending payloads your code does not handle.
Ten minutes, once a day, and you will spot most automated probing before it turns into load or abuse.
Humans scroll, hover, and leave. Bots often do not. If your analytics show a rising share of sessions with meaningful page counts but near-zero duration, you are probably looking at automation.
Be careful here. Some legitimate traffic looks robotic: RSS readers, monitoring services, link previews from messaging apps. Before you act, check whether the sessions are coming from services you recognise. The goal is not to eliminate all machine traffic, it is to know which machine traffic you have.
This one is slow-moving, which is exactly why it is useful. A sudden swing toward new visitors, especially combined with a falling conversion rate and steady page views, usually means volume is being added by something that will never buy anything.
Track the ratio daily but judge it weekly. Small fluctuations are normal; a sustained shift is a signal worth investigating alongside your request rate and user agent data.
Checking seven metrics sounds like work. In practice, most of them live in tools you already have. Set up a single dashboard with request rate, top user agents, failed logins, errors by endpoint, and the new-visitor ratio. Add geography and session duration if your platform makes it easy.
Then spend ten minutes each morning doing the same thing: scan for anything outside the normal range, note it in a shared document with the date, and only dig deeper when two or more metrics move together. A single odd number is usually noise. Three odd numbers pointing the same direction is a story.
Start today with just the login failure count and the request rate. Those two will catch more real problems than the other five combined while you build the habit. Once the routine feels natural, layer in the rest.
Photo: olia danilevich / Pexels
