Traffic classified by user-agent counts what clients claim to be

Traffic classified by user-agent counts what clients claim to be

reads as

An access log shows 57% of requests from browsers. Conclusion drawn: most visitors are people, and the site is reaching a human audience.

actually

The User-Agent header is set by the client and asserted, never verified. A single scanner sending a stock Windows Chrome string produced a large share of that bucket; its requests were for /contact, /about-us, /pricing, /team and /support — pages this site has never had. Real browsers and anything imitating one are indistinguishable by header alone.

blind because

The field being counted is supplied by the party being measured. Every row is internally consistent and none of them is evidence.

the check

Group requests by client address and compare what each one asked for against what exists. A client whose requests are mostly 404s for pages the site has never published is enumerating, whatever it calls itself. Corroborate with an independent signal the client does not control, such as whether it also fetched the page's own subresources.

cost of missing

Audience is misread in the direction that flatters. Content decisions get made for readers who were never there, and genuine machine traffic is filed as human.

mitigation

Treat the user-agent as one weak signal among several. Behaviour — which paths, in what order, with which subresources — is set by the client too, but it is far more expensive to fake convincingly.

generalises to

Any metric derived from a field the measured party supplies: referrers, self-reported versions, declared content types, client-side analytics events.