Build a Bot Baseline: Weekday and Weekend Patterns Are Not the Same Traffic

A single average bot share hides the pattern that identifies automation: bots keep office hours or ignore weekends entirely. How to baseline bot traffic by hour and day before judging any spike.

Human traffic has a week. It dips in the small hours, swells at lunch and in the evening, and changes shape at the weekend. A surprising amount of automated traffic has a week too, but a different one: some operations run on schedules set in another time zone, some run flat out around the clock because nobody pays their electricity bill by the hour, and some go quiet at weekends because the operator does.

An index built on daily averages cannot see any of that, and so it keeps misreading Tuesday. This post sets out a baseline method, bot share by hour of day and day of week, that turns the vague sense that traffic looks odd into a picture with a shape you can compare against, week after week.

What the baseline reveals

Compute bot share, however your tooling classifies it, in hourly buckets for a month, then lay the seven days over each other. Human driven invalid traffic, the misclicks and internal testing and known crawlers, follows the human curve at a roughly constant share. Scheduled automation stands out as geometry: a block of elevated share from 02:00 to 05:00 your local time that repeats to the minute, a share that doubles at weekends when human volume halves but the machines do not, a ramp that starts exactly on the hour, every hour.

That last pattern, share rising at weekends, fools teams repeatedly. Absolute bot volume is flat; the human denominator fell. A store that reports only volume concludes the weekend is clean, while its conversion rate and analytics for Saturday describe a store where bots were a third of the room.

Using the baseline to judge events

With a baseline in hand, a spike stops being a vibe. Compare any incident, a launch, a sale, a suspected attack, against the same hours on the same weekday in the baseline: the excess over expected share, in the hours it persisted, is the size of the event, and its shape, spiky and vertical versus a step change that stays, separates a scraper run from a credential stuffing campaign from a marketing success. Each of those wants a different response, and the baseline is what lets you choose in the first hour instead of the postmortem.

Refresh the baseline quarterly, not weekly: it must be stable enough to be a reference, and it should be rebuilt after any change in how traffic is classified, because a new detection rule redraws the past it is compared against.

Related reading: Glossary, About, How to Tell If Bots Are Skewing Your Store Analytics.

Frequently asked questions

Why does bot share rise at weekends if bot volume is constant?

Because share is a ratio. Human traffic falls at weekends on many stores while scheduled automation runs unchanged, so the same absolute bot volume becomes a larger fraction. Reporting volume alone hides this; reporting share alone overstates it. A baseline tracks both.

What time patterns most strongly suggest automation?

Exact repetition: activity starting on the hour, blocks at identical times daily, steady volume through the local night, and no weekend variation where your human traffic clearly varies. Humans are rhythmic but sloppy about it. Schedules are not.

How long a period should a bot baseline cover?

A month of hourly data is the practical minimum, enough to show each weekday several times and smooth out one off events. Refresh quarterly, and rebuild it whenever your detection or classification rules change, since the baseline is only comparable within one measurement regime.

What do we do with a deviation from baseline?

Size it first: excess share, hours persisted, and which pages or endpoints it touched. The target decides the response, login and checkout concentration suggests credential or card testing, catalogue concentration suggests scraping, site wide suggests a blunt crawl. The baseline tells you something happened; the distribution tells you what.