GoKawiilBlogger's server-side rules reclassify most 'browser' traffic as bots—without JavaScript
A blog operator built network and header-based rules on a Cloudflare Worker to sort incoming traffic without relying on JavaScript, and found that 277 of 372 requests bearing browser User-Agent strings were actually not genuine browsers—74.5% of the total. Comparing this edge-based counting with Cloudflare Web Analytics page loads over two days revealed persistent gaps between the two measurement methods, exposing bugs in the HTML-acceptance check and missing provenance markers, both since fixed.
GoKawiil's interpretation of the reporting above, not reported fact.
The experiment shows that User-Agent strings alone are unreliable proxies for real readership, since automated clients, crawlers, and AI assistants can mimic browser headers. As AI agents increasingly fetch web content on behalf of users, site owners need more rigorous, multi-signal detection methods to distinguish genuine human traffic from bots, rather than trusting simple analytics counts.
- 74.5% of browser-labeled requests were reclassified as non-browser via header and network analysis.
- Comparing edge page views to a separate analytics counter exposed systematic discrepancies rather than resolving them.
- Signature verification can identify specific bots and crawlers but cannot measure actual human readership.
High Performance Browser Networking (O'Reilly, Ilya Grigorik) — If you're digging into request headers, navigation semantics and what actually happens between a client and your edge worker, this O'Reilly book is the classic deep dive into HTTP and browser networking behavior. It's exactly the background that makes header-based bot classification rules feel less like guesswork and more like engineering.
See High Performance Browser Networking (O'Reilly, Ilya Grigorik) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: gkoreli.com — Goga Koreli, 2026-09-07
Published there as: “Bot Detection Without JavaScript: What My Blog Measured”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.