74%
of requests were attacks and scanners, mostly hunting for WordPress logins on sites that don't run WordPress.
The 286,000 WordPress probes →Not all your traffic is human
See who's really visiting your site.
Real people, search engines, AI crawlers, fake bots and attacks, sorted from what actually reaches your server. Works alongside Google Analytics, not instead of it.
Early access is free. We'll only email you about Humansift.
- No cookies
- No consent banner for our script
- IP addresses never stored
- 0People
- 0AI
- 0Search & tools
- 0Bots & scripts
- 0Attacks & fakes
Recognises more than 100 bots by name. The ones marked ✓ are checked against the addresses their owners publish.
We pointed Humansift at our own five websites first
400,425 requests in 15 days. Here's who sent them.
3.2×
as many pages loaded by ClaudeBot as by Googlebot. AI crawlers read more of our sites than search engines did.
Which AI reads your site →1 in 6
requests calling themselves Googlebot were fake, and more than half of "ChatGPT" requests.
How to spot a fake crawler →<10%
of visitors could have been people at all. Everything else was software: attacks, scripts, crawlers and bots.
The full breakdown →Try it on your site · free, no sign-up
Don't take our word for it.
Test your own site.
Three checks you can run right now, on the same engine as the product.
See it for yourself
Two weeks of our traffic.
Now sift out everything that isn't human.
–daily visitors shown
Possible people
Show the numbers
| Day | Attacks & fakes | Bots & scripts | Search & tools | AI | Possible people |
|---|---|---|---|---|---|
| 2026-10-02 | 3743 | 457 | 195 | 125 | 797 |
| 2026-10-03 | 4261 | 323 | 172 | 175 | 636 |
| 2026-10-04 | 3391 | 395 | 171 | 88 | 287 |
| 2026-10-05 | 4379 | 447 | 293 | 165 | 458 |
| 2026-10-06 | 3934 | 473 | 267 | 123 | 420 |
| 2026-10-07 | 5258 | 465 | 407 | 76 | 514 |
| 2026-10-08 | 4365 | 490 | 252 | 90 | 523 |
| 2026-10-09 | 4270 | 693 | 255 | 137 | 505 |
| 2026-10-10 | 4222 | 630 | 423 | 339 | 412 |
| 2026-10-11 | 2366 | 610 | 366 | 92 | 296 |
| 2026-10-12 | 3663 | 498 | 273 | 164 | 431 |
| 2026-10-13 | 3250 | 551 | 365 | 236 | 519 |
| 2026-10-14 | 2617 | 564 | 585 | 272 | 430 |
| 2026-10-15 | 2040 | 491 | 295 | 223 | 372 |
Daily visitors (one address and browser on one day) to our own five sites, 2–15 October 2026, from server logs. "Possible people" is an upper bound: with the tracking script, Humansift splits it into people who interacted and those who didn't.
Analytics counts visits.
Humansift counts people.
Your SEO tools show how the web sees your site. Google Analytics shows what runs its tag. Humansift shows what actually reaches your server, and checks who sent it.
| What you can see | Google Analytics | SEO suites | Humansift |
|---|---|---|---|
| Real people, apart from automated browsers | Counts many bots as users | – | Checked by behaviour |
| Googlebot's real crawl of your pages | Never sees it | Their own crawler | Every fetch, verified |
| AI crawlers and assistants, per page | Never sees them | – | GPTBot, ClaudeBot, Perplexity… |
| Fake crawlers and attacks | Never sees them | – | With alerts |
| Keywords, backlinks, rankings | Via Search Console | Their strength | Your Search Console, side by side |
How it works
Three sources. One honest answer.
Your server logs
Every request, including bots that never run JavaScript. Upload a file, send them to our API, or use our Cloudflare Worker if you don't have server access.
203.0.113.9 - - "POST /xmlrpc.php" 200 66.249.66.1 - - "GET /guides/" 200 Googlebot ✓
A tiny, cookie-free script
It reports a page view and the first real interaction (a scroll, tap or keypress). Scripts that never interact don't pass as people.
<script src="https://humansift.com/t.js" defer></script>
Identity, checked
Googlebot, Bingbot, GPTBot, ChatGPT and Perplexity are checked against the addresses their owners publish. Impostors show up as fake crawlers.
Googlebot verified "Googlebot" fake · cloud server
What you get
Built on what only your server sees.
People, without the noise
Visitors who scrolled, tapped or typed, per page and per source. The number your marketing should be judged on.
AI crawlers and assistants
Which pages GPTBot, ClaudeBot and Perplexity read, and when ChatGPT fetches a page because someone asked about you.
Googlebot's real crawl
Pages Google hasn't fetched in 30 days, crawl wasted on errors and redirects, and how fast new pages get picked up.
Fake crawlers and attacks
WordPress probes, .env hunters, login floods and card testing, with alerts when they spike.
robots.txt and sitemap watch
A loud alert the moment someone ships Disallow: / or a stray noindex, before search traffic drops.
Paid-ad click check
Clicks from Google, Meta and Microsoft ads split into people and bots, per campaign.
Speed for real people
Server time and page speed measured on real visitors' requests, not one lab test.
Reports for agencies
Branded client reports, scheduled emails, and CSV feeds for Looker Studio and Google Sheets.
Alerts that matter
Know before your traffic drops.
Humansift watches your site around the clock and emails you when something changes that analytics would only show weeks later, as a dip in a chart.
- Search access. robots.txt or a noindex suddenly blocks Google, or your sitemap breaks.
- Crawlers. Googlebot goes quiet, or a new fake crawler shows up.
- Attacks. Spikes in attacks, failed logins or card testing.
- Your data. Logs or the script stop arriving, or server errors climb.
robots.txt now blocks Google from all of example.com
The new file has Disallow: / for every crawler. Search traffic stops within days.
Failed logins jumped: 384 attempts from 96 addresses
Someone is trying stolen passwords on /login. Most addresses are cloud servers.
New fake crawler: "GPTBot" from a cloud server
Not in OpenAI's published addresses. It asked for /.env and /config.json.
Googlebot hasn't visited in 3 days
It usually fetches about 40 pages a day. Check Search Console for crawl errors.
Example alerts. Each one says what changed and what to do about it.
Who it's for
Made for anyone who reports on traffic.
Know your real audience.
Stop guessing whether last month's jump was customers or crawlers. See the people, the pages they read and where they came from, in plain words.
- People apart from bots, per page and per source
- A weekly email with what changed
- Alerts when Google stops crawling or something breaks
Protect checkout, and your ad budget.
Card testing and login floods never show in analytics, and bot clicks on your ads cost real money. Both are in your server logs.
- Alerts for card testing and stolen-password floods
- Paid-ad clicks split into people and bots, per campaign
- The slowest pages for real shoppers, not lab tests
Bot-free numbers for every client.
One workspace per client, branded reports on a private link or a schedule, and CSV feeds that drop straight into your Looker Studio dashboards.
- Googlebot's real crawl of every client site
- Branded client reports and scheduled emails
- Clients connect Google through a link you send
See who reads you: people and machines.
AI crawlers read more of our pages than Google did. Find out which ones read yours, which assistants fetch your articles for readers, and what it costs you.
- AI crawlers and assistants, per article
- The bandwidth each crawler costs you
- Ready robots.txt rules to choose who gets in
Your logs, finally readable.
Send logs by API or a Cloudflare Worker, and get verified crawler identity, attack paths and real-user response times without building a pipeline.
- Log API and Cloudflare Worker, no agent to install
- Slowest pages for real people, not lab tests
- Redirect rules for the broken pages real people hit
Private by design.
Humansift was built to count people, not to follow them.
- No cookies. Our script doesn't set any, so it needs no consent banner.
- No IP addresses stored. Visitors are hashed with the day, so nobody can be followed from one day to the next.
- Your Google data stays yours. Read-only access, and only after we confirm the property belongs to your domain.
Works with what you have
No new infrastructure. Set up in minutes.
Traffic in
- nginx logs
- Apache logs
- Cloudflare Worker
- Log upload
- Log API
Script on
- WordPress
- Shopify
- Wix
- Squarespace
- Webflow
- Ghost
- Next.js
- Google Tag Manager
Next to
- Google Analytics 4
- Search Console
Data out
- Looker Studio
- Google Sheets
- CSV feeds
- Email reports
Questions
Asked and answered.
Something else? Join the waitlist and reply to the first email. A person reads every one.
How is Humansift different from Google Analytics?
Google Analytics counts visits that run its tag. That misses everything that doesn't run JavaScript (crawlers, scrapers, attacks) and counts automated browsers that do as users. Humansift reads what actually reaches your server, checks who sent it, and shows your Google Analytics and Search Console numbers next to it.
Do I need access to my server?
No. Server logs give the fullest picture, but you can also send traffic from Cloudflare with a small Worker we give you, upload log files, or start with the tracking script alone. The setup page recognises your platform (WordPress, Shopify, Wix, Squarespace, Webflow, Ghost, Next.js or Google Tag Manager) and shows the exact steps.
Will it slow my site down?
No. The script is under 6 KB, loads after your page, and sets no cookies. Server logs are read separately, so they add nothing to your pages.
Do I need a cookie banner for it?
Our script sets no cookies and we never store IP addresses: each visitor is a hash that changes every day, so nobody can be followed from one day to the next. Check your own legal requirements, but there is no tracking cookie to ask consent for.
How do you know a visitor is a real person?
Several signals together: the browser runs the page and interacts with it (a scroll, a tap, a keypress), it comes from a home or mobile connection rather than a data centre, it shows none of the signs of an automated browser, and it never asks for attack paths. Visitors who load a page but never interact are counted separately as probably people.
Which bots and crawlers do you recognise?
More than 100 by name: search engines, AI crawlers and assistants, SEO tools, link previews, monitors and feed readers. Googlebot, Bingbot, Applebot, GPTBot, ChatGPT, OpenAI search and Perplexity are checked against the address lists their owners publish; others by reverse DNS. Anything claiming to be one of them from the wrong address is flagged as a fake crawler.
Does it replace Ahrefs or Semrush?
No. SEO suites show how the web sees your site from the outside: keywords, backlinks, rankings. Humansift shows what reaches your server. They work well together.
Can I use it for client sites?
Yes. Each client can have their own workspace, and branded client reports go out as a private link or a scheduled email, with your logo and colours. Clients can connect their Google accounts through a link you send.
What does it cost?
Early access is free. Plans for larger sites and agencies will be announced before early access ends, and nobody is charged without choosing a plan first.
What happens to a log I paste into the free audit?
It's sorted in memory and thrown away when the result is sent back. Nothing from it is stored.
Find out who's really visiting.
Early access is opening to a small group first. Agencies and site owners with real traffic go to the front.
Early access is free. We'll only email you about Humansift.