Datacenter Traffic Is Not Real Visitors
A large share of what your analytics calls visitors arrives from hosting providers rather than homes and phones. Here is what that traffic is, measured on real sites.
On this page
A visit from a datacenter is a server talking to your server. Real readers arrive from consumer internet providers and mobile carriers, because that is where people are. When a hit arrives from Amazon Web Services, Hetzner, OVH or one of hundreds of similar hosting networks, something is running on a machine in a rack, and in most analytics it gets counted as a visitor anyway.
The interesting question is not whether this happens. It is how much of your traffic it is. We measured our own sites over 30 days, and the answer was uncomfortable enough to be worth publishing.
What Counts as Datacenter Traffic
Every network on the internet has an autonomous system number, an ASN, which is a unique identifier for the organisation that runs it. Your home broadband has one. Your mobile carrier has one. So does every hosting company, and that is the useful part: the network a request came from is knowable, and it says a lot about what sent it.
A person reading a review on their phone comes in through a mobile network. A scraper reading the same page comes in through whichever cloud its owner rented. The two look identical in a pageview report and completely different at the network layer. The ASN is the cheapest honest signal you have, which is why we check every hit against a list of 1,400 or more datacenter networks before anything is counted.
The Numbers From Our Own Sites
Here is what that looks like measured, over 30 days on sites we run.
On one of our affiliate sites: 9,490 human visitors against 12,870 bot hits, so about 58% of everything that touched the site was automated. The click data told the same story from a different angle. Humans made roughly 9,450 tracked clicks and bots fired another 4,070, which is close to 3 in every 10 raw click events. A browser-side counter would have added those 4,070 to the total and called it engagement.
On a small store we run, the ratio was not close. Eleven human visitors in 30 days against roughly 2,770 bot hits, or 99.6% automated. Bots produced about 1,510 click events there; humans produced none at all. Blended into one number, that dead-quiet shop reads like a functioning business. Split apart, it reads like what it is: a site with eleven visitors and a lot of machines. For the wider picture, the Imperva Bad Bot Report has put automated traffic near half of all web traffic for years running.
Why It Reaches Your Reports as Visitors
Standard analytics record a visit whenever their code runs in something browser-shaped, and they do not verify that a person is present. Google Analytics 4 does filter, but the filter is narrow: it excludes known bots and spiders identified from Google research and the IAB International Spiders and Bots List, and it does not show you how much it removed.
That is a list of bots that announce themselves. Googlebot says it is Googlebot; a scraper does not, and the cheapest way to look human is a normal-looking browser user agent sent from a rented server. The traffic you most want excluded is the traffic least likely to be on any list, which is also how referral spam survives in reports for years.
When a Datacenter Hit Is a Real Person
This is the part most bot-blocking advice gets wrong, and it matters more than the impressive numbers above. A datacenter IP is not proof of a bot. People use VPNs for privacy. Employees browse through corporate networks that exit in a datacenter. Some mobile carriers and cloud-based browsers route traffic in ways that look like hosting.
A real person on a VPN is a real person. So we never treat the network alone as a verdict. A datacenter ASN counts against a hit when it arrives as a server-to-server hop with no in-page proof: no browser profile, no interaction, nothing that a genuine browser session produces on its own. When the same visitor has already proved they are human on an earlier pageview, that proof carries forward. The trade-off is deliberate: we would rather keep a VPN user in your numbers than post a cleaner-looking chart.
How We Classify It
The datacenter check is one of six signals DevDome Analytics applies to every hit, server-side, before it counts. The others cover verified crawler user agents matched against 650 or more known signatures, a missing or contradictory browser profile, automation markers such as headless browser flags, script-style clients like curl and Python, and requests for scanner probe paths that no reader ever asks for. Known-abusive address space is checked too, covering more than 15 million IPs.
None of it happens in the browser, which is the point. A browser tag can only see hits that run JavaScript, so the traffic with the least interest in being measured is exactly the traffic it misses. The full breakdown of signals and their limits is in bot traffic vs real visitors.
What It Costs You
Three things, in rising order of annoyance. Your reports lie, so you make content and spending decisions from a number that includes machines. Your click data inflates, which is worse than an inflated pageview because clicks are what you optimise campaigns against.
Then there is the billing question nobody mentions. Analytics plans are usually metered on events, and bots generate events, so automated traffic can push you into a bigger plan for nothing. DevDome meters human pageviews only, and bot hits do not count against your allowance. A related trap: a wave of datacenter hits on URLs that no longer exist right after a site move is normal crawler behaviour, and the fix is a proper set of bulk redirects rather than a panic about traffic loss.
What to Do About It
Measure before you act. Until the human and automated numbers sit side by side, every intervention is guesswork. Getting the split visible is the first step and the one most sites skip; what percentage of traffic is bots covers what a normal share looks like.
Then decide, calmly. Filtering, keeping automated hits out of your visitor counts, is low-risk and reversible: it changes nothing about what a bot can do, only whether it pollutes your numbers. Blocking is a separate call for specific abusive sources, and it needs care so Googlebot and other crawlers you depend on keep working. Start with the honest number, and the rest becomes a normal decision rather than a fight with your own dashboard.
Disclosure: DevDome publishes this blog and makes the products it mentions. We describe what they do rather than promise results.
Key takeaways
- Datacenter traffic arrives from hosting networks such as AWS, Hetzner and OVH, where readers do not live.
- On one of our affiliate sites, about 58% of all hits over 30 days were automated; on a small store it was 99.6%.
- Google Analytics 4 excludes only known bots from the IAB list and does not show you how much it removed.
- A datacenter IP on its own is not proof of a bot, because real people use VPNs and work networks.
- Measure the split first: filtering your reports is low-risk, blocking is a separate decision.
Sources
- Google Analytics 4: bot filtering — known bots from the IAB list are excluded, and the excluded volume is not reported
- Imperva (Thales) Bad Bot Report — annual measurement of automated versus human traffic across the web
- Cloudflare Learning: what is an autonomous system (ASN)? — how networks are identified, which is what a datacenter check reads
Links last checked August 12, 2026.
Frequently asked questions
What is datacenter traffic?
It is traffic whose network operator is a hosting or cloud provider rather than a consumer internet provider or a mobile carrier. Every network on the internet has an autonomous system number, and those numbers identify who runs it. Real readers arrive from ISPs and mobile networks; servers arrive from AWS, Hetzner, OVH, DigitalOcean and hundreds of others.
Is traffic from a datacenter always a bot?
No, and treating it that way would delete real people from your reports. Corporate VPNs, privacy VPNs, some mobile carriers and cloud-based browsers all route real human traffic through hosting networks. That is why we treat a datacenter network as one signal among several rather than a verdict on its own.
Why does Google Analytics not filter this out?
Google Analytics 4 automatically excludes traffic from known bots and spiders, identified using Google research and the IAB International Spiders and Bots List. That covers declared crawlers that identify themselves honestly. It does not cover the automated traffic that is trying not to be recognised, and you cannot see how much was excluded.
Should I block datacenter traffic?
Not as a blanket rule. Blocking a whole class of networks catches real visitors on VPNs and can catch tools you rely on. Start by separating it in your reports so your numbers reflect people. Blocking is worth considering for specific abusive sources once you can see who they are, and legitimate crawlers like Googlebot should always be left alone.