Detecting AI agent traffic means separating two genuinely different things that most advice lumps together: AI crawlers that identify themselves (GPTBot, ClaudeBot, PerplexityBot) and are easy to spot in server logs, and browser-driven task agents (Perplexity Comet, Claude for Chrome, the now-retired ChatGPT Atlas) that run on real Chromium and look identical to a human visitor in standard analytics. If you only check for the first category — which is what most “how to check AI traffic” guides describe — you’ll miss the second category entirely, and the second category is the one actually filling carts and forms on your site.
“Am I getting AI traffic” is the wrong question — there are two different answers
Most guides answer a single yes-or-no question about AI traffic. The more useful question splits into two, because the fix and the stakes are different for each:
| Category | Examples | How it shows up | Why it matters |
|---|---|---|---|
| Declared AI crawlers | GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, PerplexityBot, Google-Extended, Amazonbot | Identifies itself in the user-agent string; easy to filter in server logs or GA4 referral sources | Mostly benign — this is how your content gets read for citations and AI-answer summaries, not how purchases happen |
| Browser-driven task agents | Perplexity Comet, Claude for Chrome, and until August 2026, ChatGPT Atlas | Built on real Chromium — looks like a generic human Chrome session, not a declared bot, in standard analytics | This is the category actually clicking “add to cart,” filling out forms, and completing checkouts on a visitor’s behalf |
These two categories also move at completely different speeds, and conflating their growth numbers is a common honesty gap in AI-traffic coverage. Ahrefs’ own March 2026 tracker across tens of thousands of sites found that AI chatbot referral traffic — people clicking through from an AI-generated answer — still represents a small fraction of total web traffic for most sites; that’s the “declared crawler and citation” category, and it hasn’t exploded the way headlines suggest. Separately, the security firm HUMAN Security measured a 6,900% increase in AI-agent and agentic-browser requests since July 2025, with a 144.7% surge specifically targeting e-commerce sites around Black Friday and Cyber Monday — but that’s the second category, browser-driven task agents, and it’s a request-volume figure from security telemetry, not a share-of-traffic number you can compare directly to Ahrefs’ referral-click figure. Treat them as two separate trend lines, not one number confirming the other.
Step 1: Check for declared crawlers first — this part is genuinely easy
Search your server access logs (or ask whoever manages your hosting to) for any of these substrings: GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-User, PerplexityBot, Google-Extended, Amazonbot, CCBot, Applebot, meta-externalagent — a fairly complete reference list of these strings is maintained at nohacks.co’s AI user-agent landscape guide. In GA4, filter your referral source dimension for chatgpt.com, perplexity.ai, gemini.google.com, and copilot.microsoft.com — though note that many AI apps, especially mobile ones, strip the referrer header entirely, which means some of this traffic is already hiding in your “Direct” bucket before you’ve done anything wrong. For higher-confidence identification beyond the user-agent string, OpenAI, Google, Perplexity, and Bing all publish machine-readable IP range files you can cross-reference against your logs.
Step 2: Know what that traffic actually tells you
Finding declared crawler visits tells you your content is being read for AI-generated answers and citations — worth knowing if you care whether AI Overviews or a chatbot cites you, but it’s not the traffic that transacts. Don’t treat a rise in GPTBot hits as evidence that AI agents are shopping on your site; it’s a different behavior entirely, closer to a search engine indexing your pages than a customer browsing them. If your interest here is specifically getting cited more often rather than detection itself, that’s a separate goal covered in our guide to writing content AI engines actually cite.
Step 3: Look for the harder category — traffic that won’t identify itself
This is the step almost every basic guide skips, and it’s the one that actually matters if you run a store or any form a customer might complete. Because Comet and Claude for Chrome are built on real Chromium, they don’t send a distinguishing user-agent string the way a declared crawler does — plugin-level and client-side bot filters generally miss them entirely. A few practical signals to look for instead, at the server level rather than in the browser:
- Session shape. Very fast, highly structured browsing — multiple product pages visited in rapid, methodical sequence, followed immediately by an add-to-cart or form-fill action — is a pattern worth flagging even without a definitive user-agent match.
- Platform-fingerprint inconsistencies. Sessions that claim to be a standard Chrome browser but show networking-layer signatures (for example, a CFNetwork or Darwin signature on what claims to be a macOS Chrome session) can indicate an automated agent driving that browser rather than a person.
- Timing anomalies against known spikes. If your session count rises while conversions stay flat, and the timing lines up with a period security researchers have already flagged for agent activity (holiday shopping windows have been the pattern so far), that’s worth investigating rather than attributing to a traffic-quality problem with your ads.
None of this is available from client-side analytics tools alone — it requires event collection at the server level, which may mean a conversation with whoever manages your hosting or storefront platform rather than a GA4 dashboard change you can make yourself this afternoon.
Step 4: Decide what to do with what you find — don’t jump straight to blocking
Once you can actually see this traffic, the decision about what to do with it is the same one covered in our guide to AI shopping agents and small business risk: stay out of it entirely, become discoverable without allowing agent-completed checkout, or go fully agentic — and that decision should follow from what you actually measure here, not from an industry adoption statistic that may not describe your store. If you decide any of this traffic isn’t wanted, that’s also where the legal footing established in the Amazon v. Perplexity case, covered in the same guide, applies: you’re not obligated to treat an unidentified automated visitor as a customer you must serve. Whichever browsing agent you’re specifically weighing — Perplexity’s own tools included — is worth understanding on its own terms before deciding how to treat its traffic, the same way our broader guide to AI agents for business recommends evaluating any agent before letting it act unsupervised.
Step 5: Recheck this periodically — the list of agents changes fast
ChatGPT Atlas, one of the browser agents in the “hard to detect” category above, stopped working entirely in August 2026, less than a year after launch — covered in our piece on what replaced it. Whatever detection list you build today will be out of date within months as new agentic browsers launch and others shut down. Treat this as a quarterly check, not a one-time setup, the same way you’d periodically review an AI usage policy rather than writing it once and filing it away — and the same discipline applies to any tool you weren’t already actively vetting, the concern at the center of our piece on shadow AI for small business.
Who doesn’t need to do any of this yet
If your site has no cart, no checkout, and no form a visitor could meaningfully complete — a portfolio, a simple content site, a blog — the second, harder-to-detect category of agent traffic has very little practical relevance to you. Declared crawler traffic is still worth a glance if you care about AI-answer citations, but the server-level fingerprinting work described in Step 3 is only worth the effort for sites where an agent completing an action actually changes an outcome for your business.
How do I know if AI bots are visiting my website?
Check your server logs or GA4 referral sources for known AI crawler substrings like GPTBot, ClaudeBot, and PerplexityBot — this catches declared crawlers easily. Browser-driven task agents like Perplexity Comet and Claude for Chrome are much harder to catch this way, since they run on real Chromium and look like ordinary human traffic.
Why doesn’t Google Analytics show ChatGPT or Perplexity traffic properly?
Many AI apps, especially on mobile, strip the referrer header before sending a visitor to your site, which means that traffic lands in your “Direct” bucket instead of being labeled as AI-referred. Browser-driven agents add a second problem: since they run on real Chromium, GA4 has no distinguishing signal to separate them from a human using Chrome.
What’s the actual difference between an AI crawler and an AI browsing agent?
A crawler like GPTBot identifies itself and reads your content to generate answers or citations elsewhere — it doesn’t act on your site. A browsing agent like Perplexity Comet or Claude for Chrome drives a real browser session to click, fill forms, and complete purchases on a person’s behalf, and it generally does not identify itself as a bot at all.
Should I block AI agent traffic once I find it?
Not automatically. Whether to block, allow with limits, or fully support this traffic is a business decision that depends on whether it’s already converting for you, not a default technical response — the three realistic positions are laid out in our guide to AI shopping agents linked above.
Is AI-referred traffic actually a big part of most websites’ traffic yet?
For referral clicks from AI-generated answers, no — independent tracking as of March 2026 still found this a small fraction of total traffic for most sites. Browser-driven agentic traffic is growing much faster by some security measures, but that’s a different category measuring a different behavior, not the same trend.
How often should I recheck my site for AI agent traffic?
At least quarterly. The list of active agentic browsers has already changed once this year with ChatGPT Atlas’s shutdown, and new agents continue to launch, so a detection setup built once will drift out of date within months.
Shurah is the founder of AI Tools Daily, tracking pricing, licensing and policy changes across AI tools so readers can make decisions without wading through marketing claims themselves.
