Why Your Click Counts Are Wrong (and How to Fix Them)

Open your link analytics and the number looks healthy. But a chunk of those "clicks" were never a person. Search-engine crawlers, security scanners, link previewers, and outright bots request your URLs automatically, and if your analytics counts every HTTP hit as a click, your numbers are silently inflated.

This matters for three reasons: you can't measure real ROI, you can't see real trends, and you can't spot abuse. Here's what's really hitting your links, how to filter it, and how to report only clicks that represent people.

What's inflating your counts

A "click" you see in analytics can come from several non-human sources:

1. Search-engine crawlers. Googlebot, Bingbot, and others fetch short links to discover and index the destination. Every crawl looks like a click.
2. Link preview / pre-fetch. Messaging apps (WhatsApp, Slack, iMessage) and social platforms request the URL ahead of time to render a preview card. These requests happen even when nobody clicks.
3. Security scanners. VirusTotal, phishing scanners, and link-safety tools probe every link. If you share links on any public channel, expect a wave of these.
4. Spam and malicious bots. Scrapers, click-fraud bots, and abuse scanners hammer short URLs.

In some channels, non-human traffic can be a third or more of all requests. If you ignore it, every report is optimistic.

How filtering works

The goal is to separate requests that look like a person from automation. The main signals:

1. User-Agent

The fastest filter is the User-Agent header. Legitimate crawlers identify themselves:

Googlebot, Bingbot, DuckDuckBot, Slurp, YandexBot

Link previewers and tools are also recognizable:

WhatsApp/2.23, Slackbot-LinkExpanding, TelegramBot, Twitterbot,
LinkedInBot, facebookexternalhit, Discordbot

Filtering these by string is easy and cheap. The catch: bots can lie about their User-Agent, so this alone isn't enough — but it removes the honest ones instantly.

2. IP reputation / cloud ranges

A lot of automated traffic comes from cloud and hosting providers (AWS, GCP, Azure, DigitalOcean). Real users rarely come from those ranges. If you filter or flag requests from known datacenter IP ranges, you remove the bulk of scanner and abuse traffic.

3. Behavioral patterns

A person clicks and moves on; a bot often:

• Requests the same URL many times in seconds
• Never executes JavaScript (if your analytics relies on it)
• Shows up at unnatural, flat rates around the clock

Patterns like "X requests from the same IP in under a minute" or "no JS beacon" let you classify a request as bot-like even when the User-Agent looks normal.

What the platform can do (and what yas.sh does)

A URL-shortener platform sits in a great spot to filter, because it sees the raw request before the redirect. A good platform:

• Records whether a request is bot-like using the signals above.
• Flags bot clicks so they don't pollute aggregate reports.
• Lets you exclude or include bot traffic in your views.

With yas.sh, click events are tagged as bot or non-bot at capture time, and aggregates default to non-bot counts so your headline number is people, not automation. You can still inspect the raw stream if you need it.

How to report honestly

Filtering changes the number you show the world. To keep reports honest:

1. Report non-bot clicks as your headline. That's the number that represents human engagement.
2. Keep a separate "all requests" view if you need raw traffic for security or infrastructure analysis.
3. Disclose the method. A footnote like "automated traffic excluded" makes the number defensible and builds trust — useful for AdSense, ads, and stakeholder reports alike.
4. Watch for spikes. A sudden jump in raw requests with flat human clicks is a red flag for scanning or abuse — investigate before you worry about the funnel.

A practical example

You share a short link in a newsletter. Raw analytics shows 1,000 requests. After filtering:

• 120 came from WhatsApp preview fetches
• 80 from security scanners probing the link
• 40 from a crawler
• 30 from a repeat-request bot

That's 270 requests that aren't people — your real count is ~730, not 1,000. Reporting 1,000 overstates email performance by nearly 40%.

The takeaway

Raw request counts are not click counts. Filter by User-Agent, IP reputation, and behavior, and report human clicks as your headline. It's more honest, it's better for decisions, and it's expected by anyone who reviews your numbers — including ad networks that scrutinize traffic quality.

If your analytics lets you separate bot and human traffic, use it. The number that survives is the one you can stand behind.