Agent traffic in your analytics: a field guide
How to tell agent traffic from crawlers and people in your logs, why most of it is invisible by design, and what is actually worth measuring when the interesting event is a non-event.
Max Kruger
You want a number for how much agent traffic you get. You are not going to get a good one, and understanding why is more useful than any dashboard you could build.
Accurate as of July 2026.
Start with the bad news
Most agent traffic is undetectable, and not because anyone is hiding.
Claude for Chrome, Copilot Actions and Perplexity's Comet browser all drive the user's own browser, with their IP, their cookies, their session. There is nothing distinctive to log. That traffic is not merely hard to classify, it is genuinely indistinguishable from the person, because in a meaningful sense it is the person: they asked for it, it happened in their browser, under their session.
When we compiled our agents directory, five of the nine agents we tracked published no user agent at all. Microsoft publishes none whatsoever for Copilot Actions.
So any figure you produce is a floor, not a total. Treat it accordingly, and be careful presenting it to anyone who will read it as complete.
What you can identify
A meaningful minority does declare itself. These are the tokens that appear in operators' own documentation:
| Token | Operator | What it is |
|---|---|---|
| Google-Agent | Google | Agents on Google infrastructure acting on a user request |
| ChatGPT-User | OpenAI | Fetch triggered by a specific user request |
| Claude-User | Anthropic | Fetch because a user asked Claude about a page |
| Perplexity-User | Perplexity | Fetch to answer a question just asked |
Note the -User convention. It is the closest thing to a signal that a person is waiting, and it is the line you should care about far more than the operator's name.
Crucially, separate these from the crawlers, which are a different event entirely:
| Token | Operator | What it is |
|---|---|---|
| GPTBot | OpenAI | Training crawler |
| ClaudeBot | Anthropic | Training crawler |
| PerplexityBot | Perplexity | Search crawler |
| OAI-SearchBot | OpenAI | Search index |
| OAI-AdsBot | OpenAI | Ad landing page validation |
Two warnings. Google-Agent's desktop user agent string is malformed in Google's own documentation, with the token sitting inside the KHTML, like Gecko parenthetical. Match on the substring Google-Agent, never on a structural parse. And CopilotBot appears in third-party bot directories and in no Microsoft source. If it is in your filters, it is matching nothing.
Do not trust the string
A user agent is a claim, not proof. Anything can send ChatGPT-User.
For traffic that matters, verify:
- Published IP ranges. Google, OpenAI, Anthropic and Perplexity all publish JSON files of their prefixes. Anthropic added this in 2026, having previously declined to.
- Signed requests. Under Web Bot Auth an agent signs its requests and publishes keys at
/.well-known/http-message-signatures-directory. When we fetched these directly, four were live and valid: Google, OpenAI, Browserbase and You.com.
If you verify signatures yourself, two traps: check the content type rather than the status code, because several hosts return 200 with an HTML page at that path, and note that a directory can be empty. Shopify serves a valid directory containing zero keys.
Also note Google's own caveat: only a subset of Google-Agent requests are signed today, and it recommends continuing to use IP and user agent alongside signatures. Signature-only logic drops legitimate traffic.
Referrals are a different signal
Distinct from agent traffic and often confused with it: a person who arrives because an AI assistant recommended you. That shows up as an ordinary human session with a referrer like chatgpt.com or perplexity.ai.
This is worth tracking separately. It measures whether assistants are sending you people, which is a different question from whether agents can use your site. Both are useful; conflating them produces a number that means nothing.
What to actually measure
Given that the total is unknowable, measure things that are robust to that.
Declared agent hits over time, split from crawlers. The absolute number is a floor. The trend and the composition are real. A sudden drop in ChatGPT-User after a deploy is a signal worth having.
Response codes served to declared agents. This is the most actionable metric on the list. If a meaningful share of your agent traffic is getting 403 or 429, your bot rules are doing something you probably did not intend. Most people have never looked at this, and it is usually the first genuine finding.
Hits on /.well-known/ucp. A clean proxy for discovery attempts, and a low-noise one. Watch both the volume and the status you return.
Agent-referred human sessions. Tracked separately, as above.
Whether your own checks pass. Not analytics exactly, but the only measure that tests the contract rather than a side effect of it. Everything above is observational; a scheduled check is a test.
Two things you cannot measure
Worth naming so you do not go looking.
The agent that was blocked and gave up. It appears as one 403 among all your legitimate ones. Nothing distinguishes it.
The agent that read your page, misunderstood it, and recommended a competitor. That is a 200 with correct HTML. There is no signal at all.
Both are the same underlying problem: the interesting event is a non-event, and you cannot count things that did not happen. That is why the answer here is deliberate checking rather than better dashboards. Analytics tells you about traffic that arrived. It cannot tell you about the customer who quietly did not.
A reasonable setup
- Classify by user agent against operators' documented tokens, and keep agents separate from crawlers
- Verify the ones that matter by IP range or signature
- Alert on the status codes you serve to declared agents, not just on their volume
- Track hits and status on your well-known path
- Track assistant-referred human sessions as a separate series
- Run a scheduled conformance check, and treat a change in result as the alert
Steps three and six are the ones that will actually tell you something. The rest is context.
Read next
- AI crawlers vs AI agents — the distinction your classification depends on
- How Cloudflare bot rules affect AI agents — the most likely reason for those status codes
- Why agent access breaks silently — why analytics alone cannot cover this