Fake Googlebot Traffic: Your Visitor Log Is Full of Liars

Somewhere in your website’s visitor log there’s a bot wearing a name tag that says “Googlebot.” It isn’t Googlebot. It’s a scraper from a server farm you’ve never heard of, and it’s been helping itself to your pages like a free sample tray at Costco.

Google’s Gary Illyes said it out loud this week: bots pretending to be Google got worse, and he thinks AI is the reason. Here’s what that means for a small business site, and what’s actually worth doing about it.

The short version

• Anyone can put “Googlebot” in their request header. The name proves nothing; Google’s own verification method uses IP addresses and DNS.
• Fake crawlers are mostly hunting for content to feed AI models, and robots.txt won’t stop a bot that’s already lying to you.
• Most small sites don’t need to panic. A decent host or CDN firewall handles the heavy lifting, and real Googlebot should never be blocked.

Why are bots pretending to be Googlebot?

Because pretending to be Googlebot gets you in the door. Almost every site on earth rolls out the red carpet for Google’s crawler, so a scraper that wears the costume gets fewer blocks, fewer rate limits and fewer questions.

In a recent interview covered by Search Engine Roundtable, Illyes said impersonation has gotten worse, and when asked why, his answer was short: “I think it is AI.” Companies are hungry for text to train their own models, and your service pages, blog posts and FAQ answers are exactly the kind of tidy, human-written stuff they want. He also mentioned setting up honeypots and catching requests that claimed to be Googlebot from IP addresses that had nothing to do with Google.

So that bot isn’t there to rank you. It’s there to read you, copy you and leave without saying thanks. Rude as hell, frankly.

Can’t robots.txt just keep the fake bots out?

No. Robots.txt is a polite sign on the door, not a lock. Illyes called it a suggestion rather than an enforceable restriction, which is the most diplomatic way possible of saying “liars don’t read signs.”

I wrote about this a couple weeks back in my post on robots.txt and AI crawlers, and it holds up even better now. Honest crawlers read the file and follow it. A bot that’s already faking its identity isn’t going to stop and say, “Oh, they’d prefer I didn’t. My bad.” If you want the real AI crawlers to skip training on your stuff, Google-Extended in robots.txt is still the right tool for that (Googlebot keeps crawling for Search either way). For the impostors, enforcement happens somewhere else.

How do I tell real Googlebot from a fake?

You check where the request actually came from, not what it calls itself. Google lays out the method on its verify Google’s crawlers page, and it’s less scary than it sounds.

Take the IP address from your server log and do a reverse DNS lookup. A real one comes back with a name ending in googlebot.com, google.com or googleusercontent.com. Then do a forward lookup on that name and make sure it points back to the same IP. If both match, it’s Google. If the “Googlebot” lives on some random hosting company’s address, it’s a guy in a Googlebot Halloween costume.

For bigger sites there’s an automatic version: Google publishes its crawler IP ranges as JSON files, and firewalls can match against them. That’s the part you want your host or CDN doing for you, because nobody runs a small business by hand-checking DNS records over breakfast.

Does a small business website need to worry about this?

Mostly no, and I’m not going to pretend otherwise to scare you into a security package. Illyes himself said small sites usually don’t need to act on this right away, and hosted platforms like Shopify already have protections in place.

Where it does bite is in the stuff you can see. I see this pattern all the time: a site owner opens their analytics, sees traffic spiking, gets excited, and then wonders why the phone isn’t ringing. Some of that “traffic” is bots. Fake crawlers can also hammer a cheap shared server hard enough to slow the site down for actual humans, which is a real pain in the ass when the actual humans are the ones holding credit cards.

The fix usually isn’t a new plugin. It’s making sure your site sits behind a decent firewall (Cloudflare or your host’s version), that it’s set to verify known bots instead of trusting user-agent names, and that nobody accidentally blocks the real Googlebot while swatting at the fakes. That last one happens more than you’d think. Block real Google and you’ve basically unplugged your own sign.

What should I actually do this week?

Short list, no drama:

• Ask your host or web person whether bot verification is on in your firewall or CDN. It’s usually a toggle, not a project.
• Look at your analytics with bot filtering on, and stop celebrating traffic that doesn’t call, book or buy.
• Keep your robots.txt honest and simple, with Google-Extended handled the way you want for AI training.
• If your site slows to a crawl at random hours, have someone check the server logs for “Googlebot” visits from non-Google IPs.

If none of that makes sense, that’s fine. It’s the kind of boring plumbing I handle for clients as part of website care and builds, so they can go back to running a business instead of reading DNS records.

Questions people ask

Will blocking fake Googlebot hurt my SEO?

Not if you block by verification instead of by name. Real Googlebot comes from Google’s published IP ranges and passes the DNS check, so a properly set firewall lets it through and only stops the impostors. The danger is blocking anything that says “Googlebot,” which takes out the real one too.

Is fake bot traffic messing up my analytics?

It can. Many bots never run the tracking script, but some do, and server-side stats count nearly everything. If your numbers jumped and your leads didn’t, assume part of that jump isn’t people.

Do I need a security plugin for this?

Usually not as a first step. A firewall at the host or CDN level stops bad traffic before it ever touches WordPress, which is better than a plugin that has to wake up your server just to say no. Plugins are a backup, not the main lock.

The bot worth having

Funny thing is, I’m not anti-bot. I’m anti-bots that take and give nothing back. The useful kind does real work for a business: finding people who are actually asking for what you sell, writing to them like a human, and following up so leads don’t die in an inbox. That’s the idea behind the outreach assistant I build and run for other businesses, and you can see how it works in the Autobot case study.

Fake Googlebots are going to keep showing up in costume. Let the firewall check IDs at the door, and put your energy into the visitors who can actually hire you. If you want a second set of eyes on your site’s setup, start a project with me, or grab the ChenzoBot Starter below for $50 a month and let a bot that’s actually on your side do some of the work.