How a bot differs from a person on your site

A robot on a site is a program that arrived with a purpose. A person is a visitor who opened the page themselves. Reports do not contain one sign that always separates the two. Yandex Metrica says outright that some robots imitate a person, and it does not publish the behavior rules.

For advertising, that matters more than the definition. A search crawler can walk the site and cost you nothing. An empty click that stayed in spend can come from software or from a living person. Where the payment for that click begins is covered in what ad click fraud is. This piece is about why the label “robot” in Metrica cannot be read as “this visit took the budget”.

Metrica’s robot is a program, and there are two kinds

The Metrica guide defines robots as programs that crawl a site for a purpose: to index pages, or to check that the site answers. Some introduce themselves in the User-agent string. Others mask themselves so analytics will not single them out. Metrica looks for both, using behavior and technical signals.

Robots that gave a name are dropped from ordinary statistics at once. Their names are in the Robots report: Reports, Monitoring, Robots. Behavior rules appear there as a separate line and are not spelled out. That line has no name. A Yandex Ads news post of 23 September 2021 adds why the masking kind matters to statistics: such programs can inflate visits and imitate target actions, including a form, a cart and a repost. The same post says Direct’s antifraud is a different tool, and a change to Metrica’s robots does not change how that tool works.

A person without JavaScript can land in the robot row

The Robots report has a rule, “Filtered for lack of JS and Referer”. The guide explains the mechanism. The tag is JavaScript plus an invisible image inside noscript. If JavaScript did not run, the page view goes through the image, and the page address goes in the Referer header. No script and no header, and Metrica counts the view as a robot.

A program is not the only visitor who can land there. A browser with JavaScript off and no Referer produces the same row. The reverse is also true. A program that runs the script and sends an ordinary header does not fall under this rule. The label on the report row is the result of a rule, not the visitor’s passport.

Metrica can also class as robots the visits to addresses that are missing from the tag settings, in the Address and Additional address fields. That is configuration, not fraud. Before you read a robot share as an attack, check that the tag lists the domains where you actually receive people.

You will not be given the behavior rules

The report does not itemize behavior rules, so you cannot copy them into a table and audit visits by hand. Metrica is built that way on purpose. A program that masks itself is adjusting to any list you could publish. A manual test of the form “did not move the mouse, therefore a bot” replaces that list with your guess.

A living person who was paid to click does move the mouse. Direct describes those users separately from software: a task for money, a real hand, a real browser. That case is covered in who clicks your ads. Looking only for “does not look human” misses the party that is human.

Direct looks for different robots

The Metrica guide has a short note: Metrica and Direct use different systems for deciding who is a robot. The 2021 news post says the same about Direct’s antifraud. It is a separate tool, and a change in Metrica’s robot detection does not change its work.

In practice it looks like this. A visit can be a robot in Metrica and cost nothing in Direct. A search crawler does not become a paid ad click. A visit can pass Direct’s antifraud, stay in spend, and still look odd on the site. The share of such visits is the robotness metric, and it cannot be read as the ad bill. How that share is built is covered in robotness in Yandex Metrica.

Traces of a paid empty click, rather than of any robot on the site, are collected in signs of click fraud.

On the page, several observations are taken together: what the visitor did, which browser environment they sat in, which network they came from, how often similar requests arrive, and whether the ad click hangs together. One observation does not become the decision. The result is to let the visitor through, to ask the browser to solve a short computational task, or to refuse the visit. If the check does not answer, the visitor is let through. An outage should not lock out a real person. Some automated visits still get through. The check does not stamp “bot or human” with the force of a verdict.