Bots do not add noise. They add bias.
The instinct about automated traffic is that it is random junk, so it roughly cancels out and only matters at large volumes. That is wrong on both counts. Bot traffic has an extremely consistent shape — one page, no referrer, no engagement, perfect regularity, from a small number of sources — and a consistent shape applied to a metric is not noise, it is bias. It moves every number in the same direction every day.
Noise makes a metric less precise. Bias makes it confidently wrong, and confidently wrong in a direction you can predict once you know what the traffic looks like.
This matters more for product analytics than web analytics. An inflated pageview count is a number that is too big; a corrupted funnel or cohort is a conclusion that is wrong. What follows is the direction each metric moves.
What breaks, and which way
Retention goes up, not down
This is the one that surprises people, and it is the most damaging because the distortion looks like good news. A retention cohort asks whether the people who first appeared on day 0 came back on day 1, day 7, day 30. An uptime monitor comes back every single day, indefinitely, without fail. It is the most loyal user you will ever have.
So automated traffic does not flatten your retention curve, it props it up. On a small or early-stage user base, a handful of monitors and crawlers with stable identities can hold the tail of the curve visibly above where your real one sits — and a retention curve that flattens out at a healthy-looking floor is exactly the signal teams use to decide they have found product-market fit. There is no error bar on that chart telling you which part of the floor is machines.
Conversion rate falls
Bots enter the top of the funnel and never convert, so they inflate the denominator of every conversion rate while leaving the numerator alone. The rate drops in exact proportion to how much automation you have. The giveaway is a conversion rate that declines steadily while the absolute number of conversions is flat or growing — a pattern that sends teams looking for a broken checkout when the checkout is fine.
Funnels get a wide mouth and a normal throat
A funnel tracks people across ordered steps. Automation almost always enters at step one and stops, so the first step inflates and every subsequent step stays honest. The step-one-to-two drop-off looks catastrophic and every later step looks fine, which points your attention at the wrong part of the product. The deeper the funnel, the more localised the damage — and the more convincing the false diagnosis.
Bounce rate rises and session duration falls
A monitor loading one URL and leaving is a bounced session with near-zero duration, repeated every minute of every day. That establishes a permanent floor under your bounce rate and a ceiling over your session duration that no amount of product work can move, because the traffic producing it is not looking at the product.
User flows gain edges that no human walked
Path analysis is built from transitions between pages. A scraper enumerating your sitemap produces transitions that correspond to nothing a person would do — a sequence following URL order, or a fan-out from one page to fifty. Those edges are indistinguishable from real ones in the graph, and because they are systematic rather than random, they can outweigh genuine paths that only a few hundred people took.
Your profile list fills with people who are not people
Anything that derives a person from activity will derive one from a bot too. A crawler that visits daily materialises as an anonymous profile with a long, tidy history, and it will sit in your list of users, your segment counts and your active-user numbers looking exactly like an engaged visitor.
Why filtering per-hit is the wrong shape
Detection happens per request: a user agent, an origin network. Sessions and people are groups of requests. Those two facts collide, and the collision is where most naive bot filtering goes wrong.
Consider a session with three pageviews where only the third is flagged. This is ordinary, not exotic — the detection signal can differ between requests, a deploy can land mid-session, a device can change network. If your filter deletes flagged rows, you keep the first two hits as a surviving session. That session now has a bounce it did not have, an exit page that is not where the visit ended, and a duration missing its tail. You have not removed the bot; you have manufactured a new, fictional human session out of its remains.
The correct rule is that a session is judged as a unit: if any part of it is automated, the whole session is automated. That is a slightly aggressive rule, and it is the right one — a session is a single continuous visit, and a visit is either a person or it is not.
The same logic does not apply to a raw event list. Looking at a timeline of individual events is not a judgement about a session, so filtering row by row there is correct and expected. The two surfaces will legitimately disagree about a straddling session, and a tool that hides that disagreement is being less honest than one that explains it.
The asymmetry that should decide your default
Suppose you have to guess wrong in one direction. Which way should you err?
- Wrongly excluding real traffic under-counts visibly. The number is lower than you expected, someone notices, someone investigates.
- Wrongly including automated traffic over-counts invisibly. The number is higher than reality and nobody questions a number that looks good.
Only one of those failure modes gets caught. So exclusion should be the default and it should apply to every metric, not just visitor counts: a monitor’s pageview is as wrong in a pageview total as it is in a unique-user count. The thing that makes an aggressive default safe is being able to reverse it — which is the entire argument for tagging traffic instead of deleting it. A tag you can query is a decision you can revisit; a deletion is a decision you have to trust forever. Tools differ sharply here, and it is worth knowing which kind you are running.
What to do about it
- Exclude by default, everywhere. Not just in visitor counts. Every metric that automated traffic touches is wrong by the same mechanism.
- Check what was removed, on a schedule. If your tool records why something was flagged, look at the breakdown monthly. A new pattern appearing at volume is either a bot campaign or a false positive, and both are worth knowing about.
- Never compare across the date you turned filtering on. Traffic from before it existed was never marked and reads as human forever. Any period-over-period comparison spanning that date is measuring the filter.
- Point your own automation somewhere else. CI suites and uptime checks against production are self-inflicted and the easiest bot traffic to eliminate: give them a staging target or a project of their own.
- Treat retention with the most suspicion. It is the metric where automation flatters you, which makes it the one you are least likely to question. If your curve has an unusually flat tail on a small user base, look at who is in it.
None of this makes bot traffic disappear — automation using a stock browser from a residential address is not catchable by any signal a free analytics tool has. The goal is narrower and achievable: remove the automation that does identify itself, know how much you removed, and stop letting the rest quietly set the shape of your curves.