I recently put a new website online on a .com domain. It is not advertised, and the number of "real" users is basically zero. It is secured via cloudflare. Since linked with the .com domain, the number of requests is very high despite the 91 unique visitors (data point every hour):

enter image description here

63% of the requests are from Germany, which is unrelated to the website, but not only: enter image description here

As a result, my sessions database is huge and I need to clean it every day.

I used the "under attack mode" from cloudflare, which shows visitors a JavaScript challenge when the site is visited (activated before 7pm on the graph), and it seems to make no change.

Are such stats typical on a newly registered domain, and is there something to do about it?


Edit Oct 22: Finally, the traffic got quiet with no intervention (data point every day): enter image description here


Yes and you are not the first. Here what is happening:

  1. your website is new and a lot of bots will jump to visiting it and do analytics and collect if data.
  2. you have good numbers of pages which will increase your website visiting by bots.
  3. bots is most likely yandex.com , and we know yandex are famous with killings new website but their time should be short.

Here what you can do. Updating your hosting plan will help but its not the only way. You can optimize your website code. First make sure you add your javascript and css in files not in your html page so they can be cached by cloud, that will help alot.

Remove white spaces from your html pages. Optimize your website image's so they can be faster in download.

  • Thanks! Currently the website can handle it and is not slow. I just need to empty the django_sessions database table very often as I use a free database with limited size. But if you tell me that it is just temporary I can live with it.
    – seb007
    Oct 15 '20 at 7:51
  • When I try to analyze the traffic, I notice that neither Google Analytics nor Matomo can see any track of these requests, so I guess that these requests are empty and do not even hit any html page. Would indexing bots do that?
    – seb007
    Oct 16 '20 at 19:59
  • I think Google Analytics show only Unique Visitors. and a real person not bots. Oct 16 '20 at 21:30

If you can access the web logs, I'd take some samples and see if pretty much it's all bots. They typically identify themselves as "Yandex Bot" or "Google Bot" or something with "bot" in it. If that's the case, it makes identifying the traffic easy, so you could write a rule in Apache or Fail2Ban to handle that traffic specially (e.g., to restrict or ban that traffic).


I cloud say that in 90% cases I've seen this is related to bad bots trying to use XML-RPC to post spam in your website.

I use Cloudflare firewall rules to eliminate them, in some rare cases it's a sign that the website is infected by malware. If you are not familiar with logs and reading them just install Wordfence and check live traffic tab to see from where they come and what are they hitting in your website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.