Real Traffic Audit Tutorial: Who Really Visits Your Website?
If your website statistics say thousands of people visited last month but the phone barely rang, you are not imagining things. A large share of what visits any website is software: search engines, AI tools, monitoring services, scanners and sometimes the website itself. This tutorial assumes no technical knowledge. It explains what a server log is, who besides people visits a site, why visitor counts disagree, and then walks you through your first Real Traffic Audit, ending with a glossary of every term you will meet and simple next steps.
What a server log is, in plain English
Your website lives on a computer called a server, usually rented from a hosting company. Whenever anyone or anything asks that computer for a page, a picture or any other file, it hands the file over and jots down a note about the request. Those notes pile up in a plain text file called the access log.
Think of it as the till roll in a shop. Your analytics dashboard is like a member of staff standing at the door counting customers, which works well until people walk past without being noticed, or a delivery driver, a window cleaner and a meter reader all get counted as shoppers. The till roll does not guess. It lists every single transaction, with a time and a description, whether it was a customer or not.
Each note in the log contains roughly the following:
- an IP address, which is the internet address the request came from;
- the date and time;
- the page or file that was asked for;
- a status code showing whether it worked (200 means fine, 404 means not found, 500 means the server broke);
- the referrer, meaning the page the visitor came from, if their browser said;
- the user agent, a label each browser or program sends describing itself.
Nobody reads these by hand; a busy log runs to many thousands of lines a day. The Real Traffic Audit reads them for you and turns them into plain answers.
Who visits a website besides people
It surprises most owners to learn how much of their traffic is automated. None of the following is unusual, and most of it is harmless or even helpful.
| Visitor | What it is doing | Good or bad? |
|---|---|---|
| Search engine crawlers | Reading pages so they can appear in Google, Bing and DuckDuckGo results. | Good. You want these. |
| AI crawlers and assistants | Collecting pages for AI models, building AI search indexes, or fetching a page because someone asked ChatGPT, Claude or Perplexity about it. | Depends on your goals; often useful. |
| Monitoring and testing tools | Checking the site is up, or measuring how fast it loads. | Useful, but they can pollute statistics. |
| Link-preview bots | Building the little preview card when your link is shared in a chat app or social network. | Harmless. |
| Scrapers and scanners | Copying content, or testing for well-known weaknesses. | Unwanted, but every site gets them. |
| Your own server | Your site asking itself for pages, for example to make PDFs or refresh a cache. | Normal, but it should not count as a visitor. |
The audit puts all of these into their own groups before it counts anyone as a person, which is why its people figure is usually much smaller than the number you are used to seeing.
Why the real number matters to a small business
A visitor number is only useful if it helps you decide something. If it is inflated, the decisions go wrong quietly. You might believe a page is popular when it is mostly being read by tools, judge an advertising campaign by a figure padded with bots, or wonder why so many visitors produce so few enquiries when the honest answer is that most of them were never people.
The reverse happens too. With a proper cookie banner, some genuine visitors decline tracking, so analytics can also miss people that your server definitely served. A server log sees both kinds of error, which makes it a useful second opinion.
A realistic count lets you work out a believable enquiry rate, compare months fairly and spot pages that real customers actually read. It also shows you which errors your customers ran into and whether AI tools are reading your site, two questions that are hard to answer any other way.
Is it safe to use?
Your log contains the internet addresses of everyone who visited, and in the UK and EU those addresses count as personal data. The audit is designed so that this information never leaves your computer. Your own web browser opens the file, does all the counting itself and forgets everything when you close the tab. Nothing is sent to aiwebpageseo or anyone else.
You do not need an account to run the log analysis. An account only comes into it if you later want to place your Google Analytics and Search Console figures beside the log, and even then you sign in on Google's own page and give read-only permission, which you can withdraw whenever you like. Once you have finished, delete the log files you downloaded, since they hold the same personal data.
Your first audit, step by step
Step 1
Ask for or download your access log
Log in to your hosting control panel and look for a section called Logs, Raw Access or Statistics. In Plesk it is under your domain's Logs; in cPanel it is Metrics → Raw Access. If you cannot find it, email your hosting company and ask for the raw access log files for your domain in combined log format. If you use Wix, Squarespace or Shopify, logs are not available, so stop here and use Google's tools instead.
Step 2
Put the files somewhere easy to find
Save everything you downloaded into one new folder on your desktop so you can find it again.
You may see names such as access_ssl_log or files ending in .gz; these are
normal, so do not rename or unzip them. If you were offered both an access log and an error log, you
only need the access log. Older files simply cover earlier days, so include them all for a fuller picture.
Step 3
Drop them into the audit
Open the Real Traffic Audit on a laptop or desktop computer. Drag every file from your folder onto the box that says to drop your access log here, or click the box and pick them. You will not see anything upload, because nothing is uploaded; your browser reads the files where they are. If the files are large, give it a little time and leave the tab open while it works.
Step 4
Type your domain and, if you can, two addresses
Enter your website address in the domain box, for example example.co.uk.
If your host has told you your server's IP address, put it in the server box, and search "what is my
IP" from your own office or home and put that in the box for your own IPs. These are optional, so leave
them empty if you are unsure; the audit still runs, just with slightly less tidy results.
Step 5
Press Analyse log and read one number
Click Analyse log and wait for the report. At the top you will see likely real people, meaning the number of different visitors in your log that behaved like a person using a web browser. Write that number down with the dates it covers. For a first run, that is the main thing to take away, so resist reading every section at once and making changes straight away.
Step 6
Look at three sections only
Open What People Read to see which of your pages genuine visitors chose, Where People Came From to see whether they found you through search, social media or an AI assistant, and Errors Real Visitors Hit to see any broken pages they landed on. Those three tell you most of what matters for a small site. Save the PDF report, then come back to the other sections another day.
What not to worry about on your first run
- Attack probes in Security Events. Automated programs try well-known addresses, such as WordPress login pages or hidden settings files, on every website in existence. Seeing them is normal and does not mean you have been hacked. What would deserve a closer look is someone you do not recognise reaching your admin area, or accounts appearing that you did not create.
- Lots of Direct / none. Plenty of genuine visitors arrive without their browser saying where from: they typed your address, used a bookmark or tapped a link in an email or app.
- A low confirmed people number. Confirmed means the visitor also filled in a form or used a feature. If your site is mainly information, few people do that.
- A big gap with Google Analytics. That gap is usually the whole point of running the audit, and the fixes page explains how to close it.
- The same household or office counted once. The audit counts internet addresses, so colleagues sharing one connection appear as one visitor.
Glossary
| Term | Meaning |
|---|---|
| Access log | The server's running record of every request it answered. |
| Bot or crawler | A program that visits web pages automatically. |
| CDN | Content delivery network: a service that keeps copies of your files around the world. Anything it serves from its copies never reaches your server's log. |
| Combined log format | The common layout of access logs used by Apache, nginx, Plesk and cPanel, and the one the audit reads. |
| Confirmed people | Visitors who also submitted a form or used a feature. The strictest count. |
| Headless browser | A web browser run by a program with no screen, often used by testing and monitoring tools. |
| IP address | The internet address a request comes from. Personal data under UK GDPR. |
| Likely people | Visitors whose browser loaded a page with its images, styles or scripts without hammering the site. |
| Live fetch | An AI assistant fetching your page because a person asked it about that page. |
| Referrer | The page a visitor came from, when the browser reports it. |
| robots.txt | A small file on your site that tells well-behaved crawlers what they may read. |
| Status code | A three-digit result for each request: 200 worked, 301 moved, 404 not found, 5xx server error. |
| User agent | The name a browser or program gives itself when it asks for a page. |
What to do next
Once you have your first number and a feel for the report, pick one small improvement rather than trying to tackle everything. Good first choices are fixing a broken page that real visitors keep reaching, or telling Google Analytics to ignore your own visits. The Real Traffic Audit Fixes page covers each of those in order of importance.
If you would like to see a full report before running your own, the example report walk-through shows one for a made-up business. When you want the detail behind each section, read the complete guide.
Finally, ask your host how long they keep logs. If it is only a few days, download them on a regular day each month, or ask whether they can keep them longer, so your next audit covers a meaningful stretch of time.
1. Do I need to be technical to use the Real Traffic Audit?
No. The hardest part for most people is finding the log file, and your hosting company can help with that if you ask for the raw access logs for your domain. After that you drag the files onto the page, type your website address and press a button. The report uses plain headings such as Real People and What People Read, and you can ignore the more technical sections until you are comfortable.
2. Why does my website get so many visits from bots?
Because the internet is full of software that reads websites for a living. Search engines need to read your pages to list them, AI services gather pages to answer questions, monitoring tools check that sites are up and scanners look for weaknesses on every address they can find. A small site with modest human traffic can easily receive more automated requests than human ones. Most of it costs you nothing and needs no action.
3. Are bots bad for my website?
Most are not. Search engine crawlers are how people find you on Google and Bing, and AI crawlers can lead to your business being mentioned in AI answers. Link-preview bots make your shared links look good. The ones worth watching are scanners probing for weaknesses and scrapers that hit the site very hard. The main practical harm from harmless bots is that some of them get counted as visitors in analytics, making your numbers misleading.
4. My host does not offer access logs. What can I do?
First ask their support directly, because logs are often available on request even when they are not shown in the dashboard. Ask for the raw access log files for your domain in combined log format. If you are on a website builder such as Wix, Squarespace or Shopify, server logs are not provided at all, so use Google Search Console and Google Analytics instead. Some hosts only keep a few days, so download them regularly.
5. Is my visitors' privacy protected when I run the audit?
Yes. The log file is opened and analysed by your own web browser and is never uploaded to aiwebpageseo or anywhere else. When you close the tab, the analysis is gone. That matters because the IP addresses in your log are personal data. The one thing left for you to do is tidy up afterwards: delete the downloaded log files from your computer once you no longer need them, as they still contain those addresses.
6. How often should a small business run the audit?
Once a month is plenty for most small sites, ideally on a log covering the whole previous month. That gives you a steady series of figures to compare, and catches new broken pages or unusual security events within a few weeks. Run it again sooner after a big change, such as a redesign, a new advertising campaign or moving host, so you can see whether real visitors behaved differently afterwards.
7. What is the difference between a visitor and a page view?
A page view is one page being loaded once. A visitor is the person, or in the audit's case the internet address, doing the loading. One visitor who reads five pages produces five page views. The audit's headline counts unique visitors, not page views, because the question it answers is how many different people came. What People Read then shows which pages those people looked at, which is a better guide to popular content than raw page views.
Real Traffic Audit Fixes explains what to do about each finding, from your own server and bots inflating analytics to broken pages real visitors hit, AI crawler choices and security events.
Open Real Traffic Audit Fixes →