Methodology
AI crawlers vs AI referrals: what your analytics can and cannot see
One is a program reading your text. One is a customer. Most tools count them in the same row, and every tool — this one included — has a blind spot it should be telling you about.
6 min read
The only question that matters: is this a person?
Everything else in this post follows from getting that one right.
Two things reach your website with an AI company’s name attached, and they have almost nothing in common.
- A referral is a human who clicked a link in an assistant’s answer. They have a browser, opinions and a credit card.
- A crawler is a program fetching your HTML. It has none of those things and never will.
Put them in the same row and you have a number that describes nothing. Worse, you have a visitor count with programs in it — and visitors are the denominator of nearly every other figure you look at. Conversion rate, bounce rate, pages per session: contaminate the visitor count and all of them move, quietly, in the flattering direction.
Each AI company runs three crawlers, and they do different jobs
Rolled into one 'bot hits' number they say nothing. Separated, they describe a funnel.
| Job | OpenAI | Anthropic | What it means |
|---|---|---|---|
| Training | GPTBot | ClaudeBot | Your text is being read as material for a model. |
| Search index | OAI-SearchBot | Claude-SearchBot | Your page is entering an index the assistant can cite from later. |
| On demand | ChatGPT-User | Claude-User | Somebody is asking the assistant about your page right now. |
That is the crawl → cite → click sequence, and it is genuinely useful: a rise in training fetches means something different from a rise in on-demand fetches, and only the second one is downstream of a human being interested in you. A product that reports a single “AI bots” total has thrown that distinction away before you ever saw it.
Not every operator publishes three
OpenAI and Anthropic are the tidy cases. Elsewhere the set is genuinely shorter, and it is worth knowing which gaps are real rather than assuming a list is incomplete:
- Perplexity publishes
PerplexityBotfor its index andPerplexity-Userfor on-demand fetches, and no separate training crawler — it says its index crawl is the training input. Google-ExtendedandApplebot-Extendedare training opt-out tokens rather than crawlers in their own right. The actual indexing in both cases is done by a general search crawler, which is not an AI-operator signature and is not attributed to an assistant.Bytespider,CCBot,cohere-ai,meta-externalagentandAmazonbotare each their operator’s single published fetcher.
The distinction matters because “this operator has one fetcher” and “we only bothered to list one of this operator’s fetchers” look identical from outside — and the second one produces exactly the silent miscount described below. So in our classifier the short sets are recorded as deliberate, each with its reason, and a test fails if an operator is added with an unexplained gap.
We got this wrong, and it is instructive
Until August 2026 our own crawler list had all three OpenAI fetchers and only one of Anthropic’s. The consequences were worse than a gap: Claude-User matched nothing and was counted as a human direct visit, inflating the visitor number every report is built on, while Claude-SearchBot fell through to the generic bot rule and landed in “automated, but we cannot say whose”. The visible symptom was that the product could only ever name ChatGPT — which is the best explanation we have for a founder telling us his AI traffic “said ChatGPT even though it was probably Claude”. An incomplete list does not fail loudly. It produces a confident, wrong answer.
An on-demand fetch is not a visit, however tempting it is to count one
The most defensible-looking mistake in this whole area.
ChatGPT-User fetches your page because a person asked about it. There is a human at the other end. It is enormously tempting to call that a visit — it is the closest thing to demand that a crawler ever produces.
It is still a program, and Coruve records it as one. The reason is not pedantry: “is this a person?” is the question the traffic-type field answers, and it is the field that dozens of queries throughout the product use to separate humans from machines. Inventing a third, in-between category would have quietly moved these fetches into the human side of every one of those queries — every visitor count in the product changing as a side effect of an honesty feature.
So the job the fetcher was doing is recorded in its own right, and the person-or-not answer is left alone. You get the crawl-cite-click detail without the visitor number moving underneath you.
How confident is the tool, and does it tell you?
There are exactly three ways to know something here, and they are not equal.
Coruve labels every AI classification with how it knows. These are the three buckets, in the product’s own words:
| Bucket | What it means |
|---|---|
| Verified | The visit carried a cryptographic signature that we checked against the AI company's own published key. This is proof, not a guess. |
| Inferred | The visit said it was an AI assistant — through its browser identification or the site it came from. Almost always true, but both of those are just text a visitor can type anything into. |
| Unattributed | Automated traffic we can see is not a person, but could not match to any AI product. Some of this is AI; some is ordinary bots. |
The three are never added together. Not in a report, not in a CSV column, not in a headline figure. The moment you sum them, the strongest number inherits the weakest number’s trustworthiness, and the sentence worth being believed about — “this part is proven” — stops being true.
This is the question to put to any vendor selling you AI-traffic reporting: not “how much AI traffic do I have” but “how do you know, and does the screen tell me?”
The verified tier, and the honest state of it
“Verified” means a request carried a cryptographic signature that was checked against the AI company’s own published key. That is proof rather than opinion, and it is the strongest thing anyone in this field can offer.
Coruve ships with that key list empty, so in practice AI traffic reads as inferred today, not verified. That is deliberate, and the reasoning is worth stating because it is the sort of thing usually left unsaid: populating the list means transcribing public keys published by the AI operators, and a key transcribed slightly wrong is worse than no key at all — it silently verifies nothing while looking exactly like a working trust anchor. An operator can supply real keys through configuration; we will not ship guesses.
One consequence follows from the same principle. When keys are added, they upgrade future traffic only. A request that was never cryptographically checked cannot retroactively be said to have been — evidence is a fact about a request, not a setting you can backdate.
What no script-based analytics tool can see
This applies to Coruve, to Google Analytics, and to every privacy-first tool in the category.
Coruve measures with a small script in your page. So does almost everything else. The consequence is short and rarely printed: a crawler that fetches your HTML without running JavaScript leaves no trace whatsoever. No script, no event, nothing to count.
And most crawlers behave exactly that way. GPTBot, ClaudeBot and the rest request the page and disconnect. So the crawler activity a script-based tool can see is a small and unknowable fraction of the real crawl.
Which forces an uncomfortable conclusion, and we would rather state it than have you work it out later:
- A crawler count is honest. “We saw at least this many” is a floor, and a floor is a real fact.
- A crawler percentage is not. The numerator is a fraction of the crawl; the denominator is a fairly complete count of humans. Dividing one by the other produces a confident-looking number that no script-based collection method can support.
This is why our free checker prints a count rather than a share for crawler activity, on the page where a big percentage would be most persuasive. If you need the true crawl picture, the place to get it is your server or CDN logs, which see every request whether or not a script ran. That is a genuinely different discipline, and no analytics tag can substitute for it.
The referral half is much better off: those are real browsers running real scripts, so measuring assistant referrals is as complete as measuring any other traffic you have.
Two instruments, and neither one replaces the other
If you care about the crawler question, you need both. This is not a product limitation to work around; it is what the two methods physically measure.
| Analytics tag | Server or CDN logs | |
|---|---|---|
| Sees crawlers | Only those that execute JavaScript — a small minority. | Every request, whatever it does afterwards. |
| Sees humans well | Yes. Referrer, behaviour, what they did next. | Poorly. A log line is not a session. |
| Effort | Paste a snippet. | Access to the logs, and something to parse them with. |
| Best for | Which assistants send you people, and whether those people are any good. | How often, and how deeply, AI companies are reading your site. |
Anyone selling you a tag-based tool as a complete answer to “how much is AI crawling my site” is either confused or hoping you are. The two instruments answer different halves, and the honest position is to say which half you cover.
What to do with the distinction once you have it
Three decisions that get easier when crawlers and referrals are separated.
- Decide about training and retrieval separately. Your
robots.txtcan allow or refuse each operator’s crawlers by name, and the three jobs are three different decisions. Refusing training while allowing retrieval is a coherent position: it keeps your text out of the next model while leaving you citable today. Refusing everything is also coherent — but it is a decision to be less discoverable, and it should be made on purpose rather than inherited from a default somebody else set. - Judge referrals as a channel, not as a novelty. Once assistant visitors are counted apart from the machines, they can be compared against your other channels on the things that matter — what they read, whether they come back, whether they buy. That comparison is the whole point, and it is impossible while programs are in the same number.
- Watch the on-demand fetches as an early signal. They rise when people start asking assistants about you, which can happen before the clicks do. It is the nearest thing to a leading indicator in this area — as long as you remember it is a floor.
What you can and cannot conclude
A summary you can hold any vendor to, this one included.
| Question | Can a script-based tool answer it? |
|---|---|
| How many people did ChatGPT send me? | Yes — with the caveat that referrer-less arrivals need the campaign tag to be caught at all. |
| Which assistant sends the best visitors? | Yes. Real browsers, measured like any other channel. |
| Which of my pages get cited? | Partly. Landing pages of referrals, yes. What an assistant read and did not cite, no. |
| How often is my site crawled by AI? | Only a floor, and a low one. Server or CDN logs are the right instrument. |
| Is my content being used for training? | No. A training fetch that runs no JavaScript is invisible here. |
If you want the concepts from the beginning rather than the methodology, start with the complete guide to AI referral traffic. If you want to see the split for your own site, the free AI traffic checker runs on seven days of traffic and prints these caveats next to the numbers rather than underneath them.
Read next
Pillar guide
The complete guide to AI referral traffic
What AI referral traffic is, why it is growing, how referrers and user agents reveal it, how to measure it honestly, and what to do about it.
How-to
How to track ChatGPT referral traffic to your website
What a ChatGPT referral looks like on the wire, why the referrer alone misses some of it, the usual analytics workaround, and how to read it properly.
See which assistants send you people
The free checker reads seven days of your traffic and shows the split, with the caveats attached. No account, and nothing to install to see the answer.