Field notes · July 2026

ChatGPT visited our site 117 times last month. It sent us zero clicks.

We build a small SaaS that measures how often AI assistants mention a brand. At some point the obvious question hit us : what does our traffic look like ? So we pulled 30 days of origin nginx logs (we sit behind Cloudflare with a near-zero cache ratio, so the origin sees almost everything), classified every user agent, and cross-checked against real-user monitoring.

158,000 requests. 4,734 unique IPs. About 20 human visits.

The zoo, by the numbers

The "human-looking" browsers ? 29,000 requests from 2,824 IPs. Our RUM beacon, which only fires in real browsers, counted about 20 visits over the same period. Almost every Mozilla/5.0 in our logs is a bot wearing a mask.

Five things that surprised us

1. ChatGPT visits your site live, in the middle of conversations.

ChatGPT-User is not a crawler filling an index. It fires when someone asks ChatGPT a question and the model decides to fetch a page to answer. We got 117 of those. Our site was consulted inside conversations we will never see.

2. Nobody clicks through - yet.

Referrer analysis over 30 days : Google sent ~70 clicks, Twitter ~80, Hacker News 30, Bing 40, Reddit 30. chatgpt.com sent exactly zero. AI assistants read us hundreds of times and sent us nobody. The asymmetry is the whole story of AI-era publishing : you feed the answer machine, the answer machine keeps the user.

3. Your "unique visitors" metric is a bot census.

Our proxy dashboard proudly showed 2,030 unique visitors. Real humans measured by RUM : ~20 visits. If you make decisions on proxy-level uniques, you are optimizing for scrapers.

4. Vulnerability scanners now impersonate AI crawlers.

A chunk of the requests wearing GPTBot and ClaudeBot user agents were hunting /.env, /.git/HEAD, secrets.json and firebase-adminsdk.json. The theory writes itself : sites are starting to allowlist AI bots in their WAF rules, so scanners dress up as them. Verify AI crawlers by their published IP ranges, never by user agent alone.

5. What AI crawlers actually read is boring and instructive.

robots.txt (512 hits), the sitemap (310), the homepage, our pricing page, and our methodology page. They walk the front door. If your robots.txt, sitemap and core pages are a mess, that mess is your AI presence.

What we changed after reading our own logs

• We keep AI training bots allowed. For a small B2B product, being in the training data and the answer indexes is distribution, not theft. Your call may differ ; make it consciously instead of by default.
• We stopped looking at proxy-level "unique visitors" entirely. RUM or nothing.
• We treat spoofed AI user agents as scanner traffic in our own analytics.
• Hashed static assets now ship immutable cache headers, because 99.8% of requests were reaching the origin for no reason.