How to measure AI agent traffic on your online store

Ask most store owners how much of their traffic comes from AI agents and they will open their analytics and find a number close to zero. That number is wrong, but not because anything is broken. Analytics tools count visitors who run their tracking script, and most AI traffic never does.

This guide explains the kinds of AI traffic a store receives, where each one can actually be seen, and how to build the measurement that tells you whether agents are buying or being turned away.

Why doesn't analytics show AI agent traffic?#

Because page-tag analytics only counts visitors who execute its JavaScript, and most AI clients never do. A crawler fetches the HTML and leaves. An assistant fetching a page for a user often reads the HTML the same way. Even browser agents that do run scripts are frequently filtered out by analytics tools as bot traffic, which is what those filters are for.

What analytics does see is the people who click a link an assistant gave them. Those visits arrive with a referrer or a campaign tag and behave like any other session. They are valuable, but they are the smallest and last part of the story: they only exist for products the assistant could already read, price and recommend.

What kinds of AI traffic does a store receive?#

Assistant referrals, assistant agents, crawlers, and unidentified automation, alongside ordinary people. They behave differently and matter for different reasons.

The distinction between agents and crawlers is the one to protect in any report. An assistant agent may complete a purchase; a crawler never will. Mixing them averages away the conversion problem you are trying to see.

How do you track visitors referred by ChatGPT and other assistants?#

Segment by referrer and campaign tag, and give AI assistants their own channel. In Google Analytics 4 that means a custom channel group.

ChatGPT adds utm_source=chatgpt.com to many links it shares, and assistant visits also arrive with referrers such as chatgpt.com, perplexity.ai, gemini.google.com, copilot.microsoft.com and claude.ai. In GA4, create a custom channel group (under Admin → Data display → Channel groups) with a new channel, "AI assistants", whose condition is a source matching:

chatgpt\.com|perplexity\.ai|gemini\.google\.com|copilot\.microsoft\.com|claude\.ai

Place it above the default Referral channel so these visits are not counted there. Then compare the channel's conversion rate, revenue per session and landing pages with search and email. If AI-referred visitors land on product pages and convert worse than search visitors, the problem is usually on the page: a price that differs from what the assistant quoted, or a variant that is not preselected.

How do you see agents that never run your analytics?#

In your CDN or bot manager, and in server logs, where every request is recorded whether or not it runs JavaScript.

• CDN and bot manager dashboards. Cloudflare, Akamai, DataDome and others classify verified bots and signed agents and can break traffic down by them. This is the quickest place to see agent volume and, just as important, what action the product took: allowed, challenged or blocked.
• Server or edge logs. Filter by user agent tokens such as ChatGPT-User, Claude-User and Perplexity-User, and by the presence of a Signature-Agent header. Logs show the status code each request received, which is where refusals become visible.
• API logs. If you expose UCP, ACP or MCP endpoints, agents that use them never touch your pages. Count them separately.

How do you tell a real agent from an impostor?#

Verify the signature where there is one, treat a user agent alone as a claim, and treat a signature that fails to verify as worse than no signature.

Anyone can send ChatGPT-User in a user agent header. A request that carries a Web Bot Auth signature can be checked against the operator's published keys; most bot managers do this for you and mark the request as a verified agent. Our explainer on Web Bot Auth shows how.

Rank the evidence accordingly:

1. Verified signature. The operator is who it says it is. Highest confidence.
2. Declared user agent, plausible behaviour. Probably the agent it names. Medium confidence; some operators also publish IP ranges you can check against.
3. Behaviour only. Automated, unidentified. Low confidence.
4. Signature present but invalid. Someone tried to claim an identity they could not prove. Lower confidence than a request that claimed nothing.

One exception: if the operator's key directory cannot be reached, a signature cannot be checked. That is an outage, not a forgery, and should not be counted as an attack.

What should you measure?#

How many agents arrive, how far each kind gets through the purchase, and what your stack answers them at each step. Four numbers cover it:

• Agent sessions by kind, week on week. The trend matters more than the level.
• Reach rate by stage. Of the agent sessions that viewed a product, how many reached the basket, checkout and payment? A cliff at one stage points to one cause.
• Refusals by path. Count 403, 429 and challenge responses to agents on product, basket and checkout URLs. A refusal on /checkout that does not happen on /products is a bot rule, not a bug.
• Orders from agent sessions, and their conversion compared with people.

A rising count of agent visits with a flat order count is the signature of a store that agents can find but cannot buy from. Our post on why AI shopping agents get a 403 at your checkout covers the usual cause.

How do you build an agent funnel from your logs?#

Map each request to a stage of the purchase, record the outcome where you know it, and aggregate by kind of client. The shape of an event is simple:

{
  "ts": "2026-10-19T10:00:00Z",
  "path": "/products/trail-shoe",
  "method": "GET",
  "status": 200,
  "user_agent": "ChatGPT-User/1.0",
  "session_id": "s-1",
  "stage": "product_data",
  "outcome": "success"
}

Ship events like this from your edge, log drain or reverse proxy. Map paths to stages with a small table: product URLs to reading the details, /cart to the basket, /checkout to checkout, the order confirmation to payment. Classify the client using the evidence ranking above. Then count sessions per stage per kind of client, day by day.

Two practical rules save a lot of confusion later. Record the outcome when you know it, and exclude days with no recorded outcomes from any baseline: a log shipper that silently stops sending outcomes otherwise looks exactly like conversion collapsing. And version your classification rules, so that a change in how you classify traffic is not mistaken for a change in the traffic. tragent's monitoring ingests events in this shape and does both.

Frequently asked questions

Why does Google Analytics show so little AI traffic?

Analytics counts visitors who run its JavaScript. AI crawlers and most agents fetch pages without running it, and browser agents are often filtered as bots. Only people clicking through from an assistant appear reliably.

How do I track traffic from ChatGPT in GA4?

Create a custom channel group with an AI assistants channel whose source matches chatgpt.com and other assistant domains, placed above Referral. Many ChatGPT links also carry utm_source=chatgpt.com.

Where can I see AI agents that don't show in analytics?

In your CDN or bot manager's analytics and in server or edge logs, which record every request and the status it received, whether or not it ran JavaScript.

How do I know a request is really from ChatGPT?

Check its Web Bot Auth signature against OpenAI's published keys, which most bot managers do automatically. A user agent string alone can be copied by anyone.

What is a good metric for AI agent readiness?

The share of agent sessions that reach each stage of the purchase, alongside the responses your stack returns to them. Agent visits rising while orders stay flat means agents are being turned away.

Sources

1. [GA4] Custom channel groups — Google Analytics Help
2. Overview of OpenAI crawlers — OpenAI for Developers
3. Verified bots — Cloudflare docs
4. HTTP Message Signatures for Bots — IETF Web Bot Auth working group

Written by the tragent team and checked against the sources listed above on October 19, 2026. See how we write and correct posts in our editorial policy.