👥 Real Traffic Audit

Everything this audit does, you can set up and check yourself. Get your server logs, set up Search Console and Google Analytics, then count your real visitors with a few commands — no account needed.

1. Download your server access logs

Your access log is the record your web server keeps of every request. Most hosts keep the current log plus older ones compressed as .gz files. Download all of them for the fullest picture — this audit reads them all at once, including .gz files and .tar.gz archives.

Load them into this audit: drop all the files — or a single .tar.gz — into the box at the top of this page, add your domain and, if you know it, your server's IP address, then click Analyse log.

2. Set up Google Search Console

Search Console shows how often Google shows your pages in its results (impressions) and how often people click them. It's free.

1. Go to search.google.com/search-console and sign in with the Google account you want to use.
2. Click Add property. Choose Domain and type your domain without https or www (for example example.com). This covers every version of your site in one property.
3. Google shows a TXT record. Copy it, add it as a new TXT record in your domain's DNS settings (at your domain registrar or DNS host), then click Verify. DNS changes can take from a few minutes to a few hours to apply.
4. If you can't change DNS, choose URL prefix instead, enter your full address (for example https://example.com/) and verify by uploading Google's HTML file to your site's main folder.
5. Open Sitemaps, enter your sitemap's address (often sitemap.xml) and click Submit.
6. Check Performance → Search results for impressions, clicks and the searches people used. New data can take a day or two to appear.

3. Set up Google Analytics (GA4)

Analytics counts visitors whose browser runs its tracking code. Set it up once per website.

1. Go to analytics.google.com, click the gear icon (Admin), then + Create → Property.
2. Enter a property name, your time zone and currency, answer the business questions and click Create.
3. Choose Web, enter your website address and a stream name, and click Create stream. Copy the Measurement ID (it starts with G-).
4. Add it to your site. Most website builders and CMS plugins have a box for the Measurement ID. Otherwise add Google's tag to the <head> of every page. If you have visitors in the UK or EU, only load it after they accept cookies — use a cookie-consent banner.
5. Use a separate property for each website. If two sites share one Measurement ID, their visitors are added together and your numbers look far higher than they are.
6. Check it works: open your site in another tab, accept cookies, and look at Reports → Realtime. You should appear within a minute.
7. Leave out your own visits: go to Admin → Data streams, open your stream, Configure tag settings → Show more → Define internal traffic, and add your office or home IP address (and your server's). Then go to Admin → Data collection and modification → Data filters, open Internal Traffic and set it to Active.

Compare them with your server log here: sign in, use Connect Google Analytics and Connect Search Console at the top of this page, choose your property, and analyse your log again. Google data is only shown for websites you have verified you own.

4. Count your real visitors yourself, without this audit

You can get the main numbers from your logs with a few standard commands. On a Mac or Linux, use Terminal. On Windows, install Git for Windows and use Git Bash. Put all your log files (including the .gz ones) in one folder, open the terminal in that folder, and paste these one at a time.

First, a list of words that mark bots and tools, used by the commands below:

BOTS='bot|crawl|spider|slurp|curl|wget|python|headless|lighthouse|monitor|preview|scan'

Total requests — people, bots and everything else:

zcat -f access* | wc -l

Likely people — visitors that aren't bots and loaded a style sheet or script, as real browsers do:

zcat -f access* | grep -aviE "$BOTS" | awk '$7 ~ /\.(css|js)(\?|$)/ {print $1}' | sort -u | wc -l

Likely people per day:

zcat -f access* | grep -aviE "$BOTS" | awk '$7 ~ /\.(css|js)(\?|$)/ { split(substr($4,2,11),d,"/"); m=index("JanFebMarAprMayJunJulAugSepOctNovDec",d[2]); printf "%s-%02d-%s %s\n", d[3], (m+2)/3, d[1], $1 }' | sort -u | awk '{print $1}' | uniq -c

People who arrived from a search engine:

zcat -f access* | grep -aviE "$BOTS" | awk -F'"' '$4 ~ /(google|bing|duckduckgo|yahoo|ecosia)\./ {split($1,a," "); print a[1]}' | sort -u | wc -l

Most-read pages (not counting images, styles and scripts):

zcat -f access* | grep -aviE "$BOTS" | awk '$9 == 200 && $7 !~ /\.(css|js|png|jpe?g|gif|svg|webp|ico|woff2?)(\?|$)/ {print $7}' | sort | uniq -c | sort -rn | head -20

Missing pages (404s) and how often they were asked for:

zcat -f access* | awk '$9 == 404 {print $7}' | sort | uniq -c | sort -rn | head -20

AI crawlers and search engine crawlers:

zcat -f access* | grep -oiE 'GPTBot|OAI-SearchBot|ChatGPT-User|ClaudeBot|Claude-User|PerplexityBot|Perplexity-User|Bytespider|CCBot|Amazonbot|meta-externalagent' | sort | uniq -c | sort -rn
zcat -f access* | grep -oiE 'Googlebot|bingbot|DuckDuckBot|Applebot|YandexBot|Baiduspider' | sort | uniq -c | sort -rn

Requests from your own server — replace the address with your server's IP:

zcat -f access* | grep -c '^203.0.113.10 '

These give close but rougher numbers than the audit. The audit also leaves out your own and your team's addresses, visitors that hammer the site, admin logins and attack probes, and it matches the results against Google Analytics and Search Console for the same dates.