Bot and Agent Traffic

Bots browse your collections, never buy, and quietly drag your numbers down. Dynasort now recognizes them and leaves them out of your Insights by default, and it never lets them influence your sort order.

Overview

A growing share of storefront traffic is automated: crawlers, scrapers, price monitors and page-rendering services that load your pages in a real browser. They add sessions and product views but never add to cart, so in any analytics tool they make conversion and add-to-cart rates look worse than your shoppers really are. One collection can look like it suddenly stopped converting when the only thing that changed was a bot discovering it.

This is not a single-store problem. The same bots visit every store Dynasort runs on, and they are hitting Shopify stores and the web as a whole. In October 2026 one rendering farm alone produced more than 180,000 sessions across 85 of the stores we serve in a single week, and not one of them added a product to cart.

Three kinds of traffic

Dynasort sorts every storefront session into one of three groups.

Traffic	What it is	Counted in Insights (default)	Used for sorting
People	A shopper in a browser. Visitors who arrive from ChatGPT, Perplexity or other assistants by clicking a link are people.	Yes	Yes
Shopping agents	Assistants that browse and buy on behalf of a real person, such as ChatGPT’s agent.	Yes, as part of Shoppers	Yes
Bots	Crawlers, scrapers, monitors and page-rendering services.	No	Never

How Dynasort tells them apart

The short version: agents shop, bots don’t. An agent exists to find or buy something for a person, so over time its traffic produces carts and checkouts. A bot never does. Because Dynasort sees every store it runs on, it can judge a device by how it behaves across the whole network, not just on your store.

Each session is checked against these signals, strongest first:

1. Declared identity. Visitors that name themselves in their user agent are classified directly. Crawlers such as Googlebot, Bingbot and Sogou, headless browsers and monitoring tools are bots. Assistants that fetch pages for a person (ChatGPT-User, Claude-User, Perplexity-User and similar) are shopping agents.
2. Signed agents. Some agents sign their requests with Web Bot Auth. Signatures from known shopping-agent operators, such as ChatGPT, count as agents. A signature alone does not, because rentable headless-browser services sign their requests too.
3. Meta’s own network. Traffic from Meta’s servers is ad review and link checking, including automated add-to-carts, so it is always a bot.
4. Shopping. A session that adds to cart or reaches checkout is never a bot. It is a person, or a shopping agent when it comes from a hosting network.
5. Impossible browsers. A real browser window can’t be bigger than its screen. Dynasort allows for rotated tablets and for the 8 pixels a maximized Windows window overhangs, and on phones only checks width, because Android reports window height in device pixels. Square desktop screens of 800 pixels or more, such as 1280x1280 or 1600x1600, are headless-browser defaults that no real monitor uses.
6. Fleet fingerprints. Twice a day Dynasort groups the last 7 days of sessions by device fingerprint (browser, screen size, window size and language) across every store. A fingerprint with at least 200 sessions and zero carts, where the stores it visited would normally have produced 10 or more carts from that many shoppers, is marked as a bot. Its earlier sessions are reclassified automatically.
7. Busy addresses. One IP address with 100 or more sessions in a day and no cart or checkout is a bot when it sits on a hosting network or its sessions average under 3 seconds. Mobile carriers that share one address across many phones are left alone because their sessions look like real browsing.
8. Hosting networks. A session from a cloud or hosting provider that views no products and leaves within a couple of pages or a few seconds is a bot. Home and mobile internet providers never trigger this rule.

Everything else counts as a person.

The known limit

A shopping agent that browses without buying, and doesn’t identify itself, looks exactly like a scraper, so Dynasort counts it as a bot. We think that is the right call: it produced no shopper outcome. As more agents sign their requests, more of them will be recognized directly.

Your setting: Traffic in Insights

Go to Settings > Traffic in Insights to choose which sessions your Insights count.

• Shoppers (recommended). People plus shopping agents. Bots are left out. This is the default.
• People only. Leaves out bots and shopping agents.
• All traffic. Counts every visit, bots included, like raw pageview tools.

The section also shows how many bot and shopping-agent sessions Dynasort found on your store in the last 7 days.

When you change the setting, Dynasort rebuilds your Insights with the new choice. This usually takes a few minutes; until it finishes you’ll see the default numbers.

Sorting is not affected

This setting only changes what Insights shows. Sorting never uses bot visits, so your sort order is the same whichever you pick.

What you’ll see in Insights

At the top of Insights, the Traffic quality card tells you which sessions the numbers count and how many bot sessions were left out for the selected timeframe, with a link to change the setting.

When a collection’s traffic jumps without carts following, the card also shows a warning. Dynasort flags a collection when its sessions at least tripled week over week, with 300 or more sessions this week, its add-to-cart rate fell by two thirds or more, and at least 60% of its visitors arrived with no referrer and no campaign (UTM) tag. Campaigns don’t trigger it: an email blast or a paid social push brings a wave of browsers too, but they arrive tagged. Untagged surges are how bot traffic Dynasort hasn’t identified yet usually looks. If you see the warning, let us know and we’ll check.

The performance timeline shows a Bot filtering on marker on the day filtering started, and a marker whenever you change the Traffic in Insights setting.

History

Days from October 6, 2026 onward are filtered. Earlier days stay exactly as they were recorded. Expect a step up in conversion and add-to-cart rates on that date in your timeline: that is the bots leaving, not a change in your shoppers.

Privacy

To recognize hosting networks and busy addresses, Dynasort looks at the network a visit comes from. We never store a shopper’s IP address. For each session we keep only:

• the country
• the network owner, such as a mobile carrier or a cloud provider
• the IP address with its last part removed (for example 203.0.113.x)
• a scrambled version of the full address that is created with a new random key every day and cannot be traced back

The daily keys are deleted after two days, so the scrambled values can’t be linked across days.

Country and network data come from DB-IP (IP Geolocation by DB-IP, licensed under CC BY 4.0).

Tips

• Compare Insights with GA4 on the same collection: a large gap in sessions with a similar number of carts is usually bot traffic Dynasort removed.
• If a collection is flagged for a spike and you didn’t run a campaign, it’s worth a look. Tell us and we’ll check whether it’s a new bot.
• Use A/B Testing results with confidence: they’re measured on shoppers, so bots can’t tip a test.