What Share of Short Link Clicks Are Bots? Real Data

You posted a link, the shortener says 412 clicks, and your analytics saw 38 sessions. Somebody asks what the real number is, and every answer online is either about web traffic in general or a range with no source behind it. That gap is not an accident: almost every tool in the chain throws the evidence away.

The counter most tools refuse to show you

Google Analytics filters known bots by default using Google research plus the International Spiders and Bots List maintained by the Interactive Advertising Bureau, and its own documentation is blunt about what you get back: you cannot disable known bot traffic exclusion or see how much known bot traffic was excluded. Email platforms do the same. Mailchimp's bot filtering identifies most bot activity and hides inaccurate data from your reports without removing it from your account, and warns you to expect metrics to drop significantly once you switch it on. Helpful, honest, and numberless: you are told the noise was removed, never how loud it was.

Shorteners behave the same way, with one difference: a short link is one URL shared into dozens of contexts, so the noise arrives from everywhere at once. If you are picking a tool on this basis, the vendor comparison for bot filtering covers who exposes what. This page is about the number itself.

What this page measures

Flyn keeps two tallies per link: human clicks and filtered bot hits. Because the second is stored next to the first instead of discarded, the ratio can be computed across a whole population of links rather than estimated. Everything below comes from that, computed on 2026-09-10: no modelling, no extrapolation, no sampling, just two integers per link, summed.

The method matters more than the headline, because a headline is only quotable if you can see exactly what it counts.

Tap to enlarge

The two counters and the window

Every request is screened by user agent before anything is counted. Known crawlers, link-preview fetchers, headless browsers, HTTP client libraries, uptime monitors and blank user agents increment the link's filtered tally and nothing else: no stored row, no retained user agent. Everything else counts as a human click and stores one row. On a live link both branches then get the same 302, so the classification changes the counter and not the redirect. Dead links are the documented exception: an expired or disabled link answers a recognised crawler with a 410 rather than the page a person would see. That screening is explained end to end in the guide to reading your traffic quality split, and it runs on every link on every plan.

The window is links created between 2026-07-19, the day the filtered counter shipped, and 2026-09-10. That start date is the point of the exercise: the filtered tally has no timestamp, so a link created earlier would carry a human count covering its whole life and a bot count covering only part of it. Restricting the population to links born after the counter existed makes both tallies cover the same lifetime for every link in the set.

The choices, one by one

The clean cohort is the one to quote: an owner who is not banned and not an internal Flyn account, a link that is not disabled and not password protected. The rest are reported separately below, because mixing them produces a number that describes nothing.

Across 12,525 clean links, Flyn counted 338,024 human clicks and 36,735 filtered bot hits: 374,759 requests in total, a bot share of 9.8%. For context, Imperva's 2026 report puts automated traffic at more than 53% of all web traffic in 2025, up from 51% the year before, and Cloudflare data reported in June 2026 put it at 57.3% of worldwide HTTP requests to HTML content, while Cloudflare Radar, the company's own public dashboard, showed bots at 34.7% for the four weeks to 2026-09-10. Both Cloudflare figures are right and they measure different denominators: the 57.3% counts only requests that returned an HTML page, while Radar's headline counts every HTTP request, and one person opening one page also pulls in the images, scripts and API calls that dilute the share. Short links screened by user agent come in below all of them, which is what you would expect from a method that only catches bots that announce themselves.

Tap to enlarge

Every cohort side by side

Why banned owners read lower than clean links

Look at the second row. The 380 links owned by accounts that were later banned pulled 511,052 human clicks, more raw volume than the entire clean population, and only 2.5% of their hits were screened as automated. A filter that worked on intent would light that row up. A filter that works on user agent does not, because the traffic driven at those links arrives wearing ordinary browser strings.

So the abuse cohorts are not cleaner, they are better disguised. That inversion is why every percentage here should be read as a minimum, and why a low filtered count is never evidence that a link's traffic is real. If a link of yours is in that state, what happens to a disabled link and the link safety rules matter more than its bot share.

A single site-wide percentage is the least useful form this data can take, because bot hits are not spread evenly. To see the real distribution, take every clean link that received at least one hit (3,967 of them), compute its own share, and line them up.

Tap to enlarge

Across the whole population: median 7.7%, 75th percentile 37.0%, 90th percentile 75.0%

Half of all links sit at or below 7.7% bots, very close to the population figure. Then it climbs fast. One link in four is at or above 37.0%. One in ten is at or above 75.0%, meaning three of every four hits were screened as automated. There is no single normal value for a short link, only a ladder, and where a link sits depends on how it was shared and how much real traffic it got. Read this ladder as a description of what a shortener's links look like, not as a yardstick for your own: nine in ten of these links never cleared 100 hits, so most of the rungs are small integer ratios. The yardstick version, restricted to links with real traffic, is two headings down.

This is why a raw click count is a bad denominator. At a 37% bot share, dividing by human clicks, not raw clicks changes conversion rate and cost per click by more than a third. Same for email, where security scanners fetch every URL in a message before a person sees it: see why bot clicks inflate newsletter CTR.

Half of all short links run under 8% bots and one in ten runs over 75%. Quoting an average to describe your link is like quoting average rainfall to decide whether to take an umbrella today.

672 links where bots outnumbered people

672 of the 3,967 links with traffic, 17% of them, recorded more filtered bot hits than human clicks. 253 recorded bot hits and zero human clicks: created, shared or indexed somewhere, fetched by automation, never opened by a person. If you have seen a short link with a count you cannot explain and no sessions downstream, this is the likely explanation, and filtered hits are tallied separately so you can tell the two apart. The detection playbook is in the guide to click fraud prevention.

The ladder to judge your own link against: 100 hits or more

That first ladder describes the population, and the population is mostly links that barely moved: 3,676 of the 3,967, or 92.7%, took fewer than 100 hits in total, and the median link on it took six hits all told. A link sitting exactly on the 7.7% median is typically one screened hit out of thirteen. Small integer ratios make a poor yardstick, so here is the same computation, same window, same cohort rules, restricted to the clean links that carried real traffic. There were 293 of them with 100 or more total hits when this second ladder was computed, two more than the 291 in the size table below, because the counters keep running.

Tap to enlarge

The shape survives and the numbers do not. On links with enough traffic to mean anything the median is 4.8%, the 75th percentile 16.1% and the 90th 33.6%, less than half the all-links figure at every rung. Use this ladder for the audit once your link clears 100 total hits, and the size buckets in the next section until it does. The all-links ladder is a description of the population, not a benchmark, and this page previously used it as one.

Two structural facts explain almost every strange bot share you will see on a single link: concentration and size.

Tap to enlarge

The top 1% of links carry half of it

Rank the 3,967 clean links with traffic by filtered bot hits and the top 1% carry 49.3% of every bot hit in the population; the top 10% carry 83.1%. Bot traffic on short links is not a tax applied evenly. It is a small number of links that something keeps hammering, usually because they were published somewhere crawled hard, pasted into several chat platforms that each unfurl a preview, or scraped into a feed. For most links the automated share is small and boring. For a few it is the majority of the counter.

Bot share falls as real traffic arrives

Read it bottom up. Once a link is genuinely working, past a thousand hits, bots are 6.4% of its traffic and fade into the background. Below a hundred hits they are a quarter of everything. Automated fetches are roughly fixed per share event, a preview here, a crawler there, a safety scanner, while human clicks scale with how well the campaign does. So bot share is mostly a measure of how little human traffic a link got, which is the opposite of how most people read it.

The honest version of this research is the limitation section, so here it is in full rather than as a footnote.

User-agent screening only catches bots that announce themselves

Flyn classifies a hit as automated when the User-Agent header matches a known crawler, preview fetcher, headless runtime, HTTP library or monitor pattern, or when it is blank. That is a self-declaration, and a self-declaration is trivially falsifiable. Playwright, one of the automation runtimes on that pattern list, exposes a context option whose entire documented description is specific user agent to use in this context, so a script that wants to look like Chrome looks like Chrome in one line. MDN's reference on the header notes that it identifies a particular user agent and can therefore be used for fingerprinting, which is the same property read from the other side: it is a label the client picks. Google's own guidance on verifying Googlebot exists, in its words, because spammers or other troublemakers are accessing your site while claiming to be from Google, and the two checks it recommends are a reverse DNS lookup and a match against Google's published IP ranges. Neither one reads the user agent.

Tap to enlarge

Flyn does not do reverse DNS, IP reputation or behavioural scoring in the redirect path. So a scraper sending a stock Chrome string, a click farm driving a real browser and residential-proxy traffic are all counted as human clicks. 9.8% is the share of hits that admitted what they were. The true share is higher by an unknown amount, and the banned-owner row at 2.5% is direct evidence of how much the method misses.

What the counter cannot tell you

The filtered tally is a single integer per link, and the user agent is discarded once the hit is classified, so it cannot be split by bot family. This page cannot tell you how much of that 9.8% was a chat app unfurling a paste versus Googlebot versus an uptime monitor, and any page claiming a per-crawler breakdown from this counter is making it up. Related but separate: AI crawlers like GPTBot and ClaudeBot land in the filtered tally as bots, while a human arriving from an AI assistant is a real click in its own referral channel, a distinction covered in the AI assistants channel breakdown.

What other shorteners report, and why the numbers differ

Our 9.8% is far below the figures a competitor will hand you, so here they are, named. Short.io tells its readers in a March 2026 guide that bots will consistently be over 99% of your traffic, with no sample, window or method published behind it. Linkly illustrates its help page on inflated clicks with a single dashboard in which 3,674 clicks are shown and 9.8k bots were filtered out, roughly three quarters of that one link's raw traffic. Neither of Linkly's two bot help pages, read on 2026-09-10, puts a percentage on its own population. Neither claim is a measurement of a population: one is an assertion, the other is one screenshot of one heavily fetched link. Both are compatible with what we found, because our own ladder has a top decile: 253 clean links in this window took bot hits and no human clicks whatsoever, and the worst link with real traffic ran 99.4% bots. A single exposed link can be almost entirely automated. A whole population of links, most of them small, is not.

Detection depth is the other half of the gap, and it does not run in our favour. Linkly documents screening that goes past the user agent: it verifies major crawlers against the networks they genuinely operate from, and it weighs whether a request arrived from a cloud hosting provider such as AWS, Google Cloud or DigitalOcean together with how the request behaves. Flyn does none of that in the redirect path. On identical traffic a filter like that should return a higher bot count than ours, so Linkly's numbers are not comparable with the ones on this page and should be expected to sit above them. That is the honest reading of a low figure published by the party being measured: 9.8% is what a user-agent screen can see, not what is there.

Three more caveats, plainly. This is one shortener's customer base, not a census of short links. The window is 54 days, so seasonality is invisible. And these are counters, not logs: they can be summed and divided, but not re-segmented after the fact by country, device or referrer the way stored click events can.

If you came here to work out what your own dashboard is telling you, this is where the research maps onto the product.

The filtered count sits next to the click count

Every Flyn link shows its human click count and its filtered bot count separately, on every plan including the free one, which is why this research was possible at all. Reading your own split takes one paragraph: open the link, compare the filtered number to the human number, and place the ratio on the ladder above. The full walkthrough of the card is in which clicks came from ChatGPT, and the count definitions are in unique versus total clicks and link analytics. Segmenting those human clicks by geo, device and referrer sits on the paid plans.

What a human click stores, and what a filtered hit does not

A hit classified as human stores one row: country, city, device, operating system, browser, referrer, a hashed IP, any UTM values on the short URL, and a timestamp. No advertising identifier, and as of 2026-09-10 the redirect sets no cookie. An automated hit stores nothing; it adds one to the filtered tally and the user agent is discarded. On a live link both branches get the same 302 with Referrer-Policy: strict-origin-when-cross-origin, and the classification stays inside Flyn: nothing in the hop marks a hit as filtered, which is part of why a shortener's count and your own server-side analytics never reconcile line for line. To sanity check the hop itself, use the redirect checker, the URL expander or the click counter tool.

Tap to enlarge

One more number worth having: of the 338,024 human clicks on clean links, only 590 were QR scans. QR is a rounding error here, so do not let a scan-heavy campaign stand in for short links generally. Scan tracking is its own measurement problem.

Run this on any link, using the published distribution as the yardstick rather than a rule of thumb.

Tap to enlarge

The five checks

1. Get both numbers, not one. Write down human clicks and filtered hits for the link. If your tool only gives you a total, you cannot do this audit and you should say so in the report rather than guess.
2. Compute the share as filtered divided by the sum of both. Not filtered divided by human clicks, which inflates it, and not filtered divided by total clicks if total already excludes bots.
3. Check the size bucket before anything else. Under 100 total hits the share is noise. Compare it to the 21.4% and 28.4% bucket figures, not to the 9.8% headline and not to the ladder.
4. At 100 hits or more, place it on the ladder below before you react to it. That ladder is built from the 293 clean links that cleared 100 hits, not from the whole population.
5. Recompute every downstream rate on human clicks. Conversion rate, cost per click, CTR: all of them move once the filtered hits come out of the denominator. The click tracking guide and UTM audit guide cover how to keep those denominators consistent once you have cleaned them.

That last row is the one people skip. A link with 40,000 clicks and 12 filtered hits does not have a clean bill of health; it has traffic that is not declaring itself. Pair this audit with the detection methods if the stakes are financial, and with short link safety if you are the one being sent the link.

Cite this page, but cite it with its expiry date in mind. Four things would move it, and three of them are likely within a year.

The things that move it

First, detection depth. Adding IP reputation, reverse DNS verification or behavioural checks would raise the measured share immediately, because traffic currently counted as human would land in the filtered tally instead. Worth remembering whenever a vendor publishes a higher figure than this one: a bigger bot percentage can mean a better filter rather than a worse internet.

Second, the agentic shift. Cloudflare's 57.3% of HTML requests and Imperva's 53% of web traffic are both trending upward, driven by AI agents fetching pages on a person's behalf, and short links sit directly in that path. Whether an agent following a link for a human counts as a bot is a genuinely open question. Third, population mix: a shift in who signs up moves the ratio. Fourth, window length: a full year would show seasonality that 54 days cannot.

The measurement is scheduled to re-run quarterly on the same cohort definitions, so later figures can be compared against these rather than replacing them. Until then: 9.8% of all hits on clean links, a median of 7.7% per link across the whole population and 4.8% on the links that cleared 100 hits, a 90th percentile of 33.6% on that same high-traffic set, and the top 1% of links with traffic carrying 49.3% of the bot hits. Every one of those is a floor, because detection is user-agent screening only. Measured on 2026-09-10.

This page reports a measurement, not a compliance or fraud determination, and nothing here is legal advice.