Fake or Bot Traffic When Buying a Website: How to Spot It

Why Traffic Is the Easiest Number to Fake

When you buy a website, traffic is the number that feels the most objective. Revenue can be argued about, add-backs can be debated, but a line going up in an analytics dashboard looks like a fact. It is not. Visitor counts are a seller-provided input, and on a site priced as a multiple of profit, a few thousand extra visits can move the asking price more than any cost-cutting trick.

This guide is a practical routine for separating real visitors from bots, referral spam and bought traffic before you sign a letter of intent. It does not replace a full audit, and no single check is conclusive. The goal is to stack several independent signals until the story either holds together or falls apart.

What "Fake Traffic" Actually Means

Three different problems hide behind the same phrase, and they call for different responses:

• Bot traffic: automated visits from scripts, scrapers or datacenter machines. They inflate sessions and pageviews, but never convert.
• Purchased or incentivized traffic: real humans, or something that looks like them, delivered through paid "traffic packages" or traffic exchanges. It shows up as sessions with no intent behind them.
• Misattributed traffic: real visitors that are labelled wrongly, for example paid ad clicks hiding inside the "direct" bucket, which makes a paid-dependent site look organic.

The first two inflate the numbers. The third distorts the *quality* of the numbers, and it matters just as much, because the price you pay should depend on how durable the traffic source is. If you want the concentration side of the story, read our guide on customer and traffic concentration risk.

Step 1: Read the Shape of the Traffic Graph

Before opening any report, look at the overall curve over the longest period the seller can show.

• Sudden spikes with no matching content launch, press mention or promotion deserve a question.
• Sharp drops may mean a penalty, a lost channel or the end of a paid campaign.
• Growth that is too smooth can also be suspicious. Organic traffic usually has weekly rhythm and seasonality.

Ask the seller to explain each break in the curve. A real owner remembers what they published or changed that month. A vague answer is information.

Step 2: Check the Source Mix

Real audiences tend to arrive through a mix of search, social, direct and referral channels. Look at the acquisition report and ask:

• Is a large share of visits "direct" on a site with no brand and no newsletter? That is a classic hiding place for bots and for untagged paid traffic.
• Do referrals come from sites that actually link to this one, or from domains that look like spam?
• Does the country mix match the market the site serves? A French-language shop with most sessions from a country where it does not ship is a flag.

None of these is proof on its own. Together they tell you where to dig.

Step 3: Look for Bot Signatures in Analytics

Open the engagement metrics and compare segments rather than averages:

• Very short sessions (a few seconds) concentrated in one source or one country.
• Near-100% new visitors from a single source, with no returning users at all.
• Odd bounce or engagement patterns, such as one landing page absorbing most of the traffic with zero scroll or click events.
• Traffic that never converts. Sessions that produce no sign-ups, carts or contact requests while the revenue story depends on them do not add up.

Practitioner guides that cover this topic agree on these basics, and also agree on a limit: no analytics tool is perfectly safe, and any figure can contain an element of manipulation. Treat analytics as a starting point, not as proof.

Step 4: Cross-Check With a Second, Independent Source

The strongest technique is to confront the seller's analytics with data they do not control.

If analytics claims 60,000 monthly visits from organic search while Search Console shows a fraction of that in clicks, one of the two is wrong, and it is probably not Search Console. Ask for read-only access to both before the offer, not after.

Step 5: Read the Server Logs for Datacenter and Crawler Patterns

For sites with meaningful traffic, ask for a sample of raw access logs, or a CDN analytics export. You are looking for:

• A large share of requests from a single IP range or hosting provider, which suggests scripted traffic.
• User-agent strings that identify themselves as crawlers, scrapers or headless browsers.
• Requests that hit pages in perfectly regular intervals.

One practitioner write-up describes simply scanning log lines for user-agent terms such as bot, crawler, spider and scraper as a first pass. That is a useful quick filter, but sophisticated bots disguise themselves, so use it to rule things in, never to rule them out.

Step 6: Reconcile Traffic With Revenue

Traffic is only valuable if it translates into money. Build a simple reconciliation for the last twelve months:

• 1. Take monthly sessions from the traffic source you trust most.
• 2. Take monthly orders, subscriptions, leads or ad impressions from the revenue source.
• 3. Compute the implied conversion rate or revenue per thousand sessions for each month.
• 4. Look for months where the ratio collapses or jumps without an explanation.

A content site monetized with display ads should see revenue move with pageviews. A store should see orders move with sessions. When traffic doubles and revenue does not move, either the new visitors are not real or they are not valuable. Our quality of earnings guide covers the revenue side of this reconciliation in more depth.

Step 7: Understand What the Marketplace Actually Verifies

Platforms differ in how much of this they do for you. Flippa, for instance, states that its verification team checks that stated page views, user traffic and traffic sources are accurate, and that it compares seller financials with bank records and metrics pulled from platforms such as Shopify, Stripe and Google Analytics. It also marks reviewed listings with a "Vetted by Flippa" icon and applies an expert financial review to assets above a stated price threshold.

That is useful, but it is the platform describing its own process. Read the exact scope of any badge on the listing, find out what is not covered, and keep your own checks for anything you are about to pay for. For a wider look at how verification works on both sides of a deal, see proof of funds and NDAs and our list of red flags in an online business listing.

What To Do When Something Looks Off

Finding a problem is the start of a negotiation, not necessarily the end of the deal. Here is a rough framework:

• Small, explainable anomalies (a one-off spike tied to a viral post): note it, adjust nothing.
• A measurable share of bot or junk traffic that does not drive revenue: exclude it from your valuation base and ask the seller to explain why it is in their numbers.
• Revenue that depends on traffic you cannot verify: lower the offer, move part of the price into an earn-out, or ask for a longer transition period.
• Evidence of deliberately purchased traffic: this is a trust problem as much as a numbers problem. Many buyers walk away.

If you would rather have an independent view on how durable a site's organic and AI-search presence really is, a SEO + AI-visibility audit can check that part for you before you commit.

A One-Page Checklist

• Ask for read-only access to analytics and Search Console, plus a stats export for at least 12 months.
• Review the traffic curve and ask for an explanation of every break.
• Inspect source and country mix against the site's real market.
• Segment sessions by source and look for short, non-returning, non-converting clusters.
• Cross-check with Search Console and, if available, server logs.
• Reconcile monthly traffic with revenue or leads.
• Confirm what the marketplace's verification covers and what it does not.
• Write down every anomaly and the seller's answer before you make an offer.

FAQ

How can I tell if a website's traffic is fake before buying?

Combine several signals: an unexplained traffic curve, a suspicious source or country mix, very short non-converting sessions, a gap between analytics and Search Console, and traffic that does not move revenue. No single check is conclusive.

Is Google Analytics enough to verify traffic?

No. It is a seller-controlled tool and can contain manipulated or misattributed data. Use it with read-only access, then confirm it against Search Console, server logs and revenue records.

What percentage of bot traffic is acceptable?

There is no universal threshold, because some automated traffic exists on every site. What matters is whether the bot share drives your valuation base. Value the business on traffic that converts, not on raw sessions.

Can I ask the seller for server logs?

You can ask, and a transparent seller will usually provide at least a sample under an NDA. A refusal is not proof of fraud, but it removes one of your best verification tools, so price that uncertainty in.

Does a marketplace verification badge mean the traffic is real?

It means the platform reviewed the listing according to its own process. Read what exactly was checked, and run your own checks on what you are paying for.

Ready to Look at Real Deals?

Now that you know how to stress-test a traffic claim, browse deals across marketplaces, filter by the profile that fits you, and set up deal alerts so new listings that match your criteria reach you first. This article is general information and not legal or financial advice.