A real surge and a bot flood both look like a traffic spike, and the size of the spike tells you nothing. The shape does. Real visitors arrive from many IPs, browse varied pages, and hesitate. Bots arrive in bursts, hit the same endpoint, and never browse. The first thing to check is not how much traffic you got, but how it behaved.
Real visitors browse. Bots aim.
A real visitor arrives from one IP among thousands, lands on the product page, checks the size chart, looks at a second colorway, and hesitates. A bot arrives in a burst with hundreds of others, hits the checkout endpoint, and never browses. The difference is not the volume. It is the spread: many IPs and varied pages for people, few IPs and one endpoint for bots.
Dwell time is the quietest tell. Real buyers pause. Bots move at machine speed between requests, and even the sophisticated ones that pause do so on a fixed interval. Plot request timing across a thousand sessions and the bots form a pattern while the humans scatter.
Volume event vs latency event
A real surge is both a volume event and a latency event: traffic rises and the site slows, because real browsers request images, scripts, and stylesheets. A bot flood is often a volume event only. Traffic triples while latency stays flat, because the bots request one endpoint and skip the rest. Or the reverse: latency spikes while volume looks normal, because a small number of bots hammer a heavy endpoint.
Watch the two together. Volume without latency, or latency without volume, points at automation. Volume and latency rising together points at people.
The click-spike warning sign
Search traffic can lie the same way. In November 2026, several sites saw Google Search Console click spikes of two to six and a half times their normal volume, at positions 12 to 54, with click-through rates of 45 to 100 percent and mobile traffic flat. A real ranking gain moves position first and clicks second. A click spike with no position change and no mobile lift is a bot signature, not a breakthrough.
The same check applies to a drop. If the spike has no matching cause, a ranking gain, a press mention, a social post, treat it as automation until the shape proves otherwise.
What to do in the first ten minutes
Do not trust the spike, and do not kill it either. Throttle the suspicious endpoints, put the checkout behind a queue, and watch whether the traffic behaves like people once it is slowed down. Real buyers wait in a queue. Bots abandon it or multiply their entries, and either reaction confirms the diagnosis.
Log everything. The shape of this spike is the signature you compare the next one against, and the next drop will have one.
Keep reading
Related guides on this site: a first-timer's guide to salvage auctions how digital dashes hide rolled-back odometers how salvage titles get washed across state lines More from Bot Protection For Auto Marketplaces.
Frequently asked questions
How fast can you tell a bot flood from a real surge?
Minutes, if you watch behavior instead of volume. Real visitors spread across IPs and pages and hesitate before checkout. Bots cluster on one endpoint and move in bursts. The shape of the spike separates them faster than any single metric.
Do bots ever browse like real visitors?
The sophisticated ones do, visiting a few pages and pausing between requests. But they still cluster: the same endpoints, the same order, the same timing. Browsing that follows a script looks like a script once you compare enough sessions.
Why does mobile traffic matter in the check?
Because real shoppers buy on phones. A surge with flat mobile traffic and a desktop spike is a bot signature. Mobile is also where the hesitation shows up: real buyers scroll, zoom, and go back, and bots do none of it.
What is a safe spike?
There is no safe number, only a safe shape. A spike that spreads across IPs, pages, and devices is demand. A spike that concentrates on one endpoint from few IPs is a flood, at any size.