I thought I had 1,087 visitors and 26 leads. 41% were bots and 23 leads were one bot.

I run projectcostestimator.com, a free website-cost calculator with a 9-engine pricing model and an open CC BY 4.0 dataset. This week I sat down to figure out why a site with "decent" traffic was making $0 - and found out most of my dashboard was fiction. Here's exactly how, with the queries, because you probably have the same problem and don't know it. The numbers I believed GA4 said 1,087 sessions in 28 days. My leads table said 26 captured leads. Growth looked like +350%. I'd spent weeks optimizing titles and CTAs against those numbers. The first crack I cross-checked one thing: Google Search Console clicks vs GA4 organic sessions, same window. GSC said 122 Google clicks. GA4 claimed 150 google/organic sessions - more visitors than Google says it sent me. That's structurally impossible for real organic traffic. The gap was the tell. After excluding one traffic slice, GA4 dropped to 108 - within 4% of GSC, which is the normal drift you expect from consent banners and people leaving before the tag loads. So ~40 "organic" sessions were something arriving with a Google referrer that Google never actually sent. Finding the fleet I pulled the raw lead rows and grouped by user-agent and IP hash - two columns already sitting in the same row I'd never looked at: - 23 of my 26 "leads" shared one byte-identical user-agent across 45 distinct IPs. - Sessions from that fingerprint hit 16 pageviews per session at 54 seconds - a page every 3.3 seconds. - 41% of all GA4 sessions came from that one Chrome-on-macOS fingerprint. It wasn't a lead flow. It was a single bot with a residential-IP pool, and it had quietly moved from my hero form to my API-key endpoint mid-week. My "26 leads, why is it stuck at 26?" investigation had been interrogating a bot's cadence. The real number, after excluding it and two friends who tried the site: zero genuine leads. Not 26. Zero. What I changed in the code - A strict lead counter. A user-agent shared across ≥5 distinct IP hashes is a fingerprint, not a person. Report the strict count alongside the naive one - never silently redefine the metric. - A daily reconciliation guard. If GA4 organic ever reads above GSC clicks again, something's inflating it - alert. Two independent sources that must agree, checked automatically. - Blocked the abuse vector. The API-key endpoint was emailing anyone unconditionally - including carrier SMS gateways ( n*****@tmomail.net arrives as a text message). It was a free anonymous relay with my domain as sender. Now it refuses gateways and requires a real bot check. The lesson Your analytics number is not your business number until you've validated identity, not just movement. I spent weeks asking "why isn't this metric growing" when the question was "is this metric even real." A counter that goes up on anything other than a stranger choosing to give you their email is not measuring your business. If you have a young site with "surprisingly good" traffic and no revenue, do this today: cross-check GSC clicks vs GA4 organic for the same window, and group your leads by user-agent × IP. It takes ten minutes and it might delete most of your dashboard. Mine deserved it. The calculator itself is real and the math checks out - I rebuilt the pricing engine independently and it matched to the dollar. If you want to see what an honest cost estimate looks like (no signup, no lead-capture-before-value), it's at projectcostestimator.com, and the rate dataset behind it is open under CC BY 4.0. Top comments (0)