A sudden spike in website traffic, traced to its source

The dashboard shows a sudden spike in website traffic at 03:40 this morning, and the same minute is recorded in a second place that most people never open. Whether the spike appears in both is the first thing to establish. The analytics tag sees browsers that ran its JavaScript. The server or CDN log sees every request, browser or not. A spike that shows in the log and not in the tag is a crawler. A spike in the tag and not in the log is not traffic at all but a tag problem or forged hits. A spike in both is people, and the referrer will say which people.

Where the two records live

The tag's record is the dashboard. The other record is the access log on the host (a hosting panel's raw log download, or access.log on a server you run) or the edge analytics of the CDN in front of the site, which counts requests before they reach the origin. Pull the same day from both before reading anything else. Two independent counts of one day settle more than any single dashboard.

Shape one: a crawler

A bot fetching thousands of pages appears in the log as one or a few IP addresses, a user agent string that names itself or names nothing, dozens of requests per second, and no request for the analytics script. The tag sees none of it, because crawlers do not run your JavaScript. If the dashboard is flat and the host is warning about load, this is the shape. The fix is a rule at the CDN or in robots.txt for the agents that honour it, and a rate limit for the ones that do not.

Shape two: referral spam and forged hits

Ghost referrals hit the tag's collection endpoint directly, never loading the page. In the dashboard they show as visits from a domain you have never heard of, one page, zero seconds, often one country. In the log there is no page request to match them. Google Analytics 4 filters known spam sources, per Google's own documentation, and other tools drop hits without a matching page load. The tell is a referrer whose site, when you open it, has no link to yours.

Shape three: a real mention

A link from a news site, a newsletter, a forum thread or a social post arrives in both records with the referring domain intact, and it lands on one page. Open the referrer. If a browser policy trimmed the referrer to its origin, you will see the site and not the thread; the referrer glossary entry on this site explains what survives trimming. Mentions decay over days, and the page that received one is the page to give a next step to before the wave passes.

Shape four: AI-assistant referrals

Visits from an AI assistant carry a referrer such as chatgpt.com when the assistant links out, and arrive as direct traffic when it does not. The signature is a rise on a specific old page with no other natural source of direct visits. This site's guide to AI traffic in analytics covers separating the two, and the AI traffic glossary entry names the assistants that identify themselves.

Shape five: the tag fired twice

A deploy that added the snippet a second time, a tag manager container publishing alongside a hard-coded script, or a theme update that duplicated a template all double the pageviews overnight. Visitors stay flat, pages per session doubles, and the log shows nothing unusual. Open a page with the browser's network panel and count requests to the analytics endpoint on a single load. Two is the diagnosis.

Shape six: an untagged campaign

A newsletter sent without UTM parameters lands in direct, a paid campaign with a broken tag lands in organic or direct, and both look like a spontaneous surge. The log and the tag agree, the referrer is empty, and the timestamp matches a send. Check what marketing went out that hour before checking anything else.

The one chart that sorts them

Put the tag's daily visits and the log's daily page requests on one chart for the two weeks around the spike. The shapes separate: crawler lifts the log line only, spam and double firing lift the tag line only, people lift both. Then split the tag line by referrer for the spike day.

A control page

Pick a page that did not spike and check its lines moved as usual. If every page rose by the same factor at the same minute, the cause is instrumentation. If one page rose alone, the cause is a source pointing at that page.

Deciding whether to keep it

A crawler is a cost. Spam is noise to filter and exclude from the reports. A mention or an AI referral is an audience worth a next step on the landing page. A double-firing tag corrupts every downstream figure until it is fixed, and the fix date belongs in the record.

The part no record recovers

Which prompt produced an AI referral, which post in a trimmed-referrer thread carried the link, and how many visitors a consent banner hid from the tag are not recoverable from either record. The spike's date and its diagnosis belong in the annotation on the chart, where the person reading the line next quarter will find them.