How HumanKey counts visitors — and why it differs from Cloudflare and Google Analytics

Why this post exists

We get the same question from publishers and operators every few weeks: "Cloudflare says 100,000 visits last month, Google Analytics says 60,000, and your dashboard says 45,000. Which one is right?"

The honest answer is all three — but they're answering different questions. We wrote this to make the difference legible without making any of the three sound wrong, and to help decide which number to use for which decision.

This is operator-side context, not a sales pitch. The ratios we cite are typical values from real customer data; your specific traffic mix may shift them.

What each tool actually measures

Cloudflare counts edge requests. Every HTTP hit to your domain — every page, every asset, every bot probe, every retry of a failed connection — increments the counter. CF's number is the closest to "raw demand on your infrastructure." It includes hits that never reached a working browser and never executed any JavaScript.

Google Analytics (GA4 and earlier) counts pageviews and sessions where the GA JavaScript snippet executed and successfully reported back. GA's number reflects "users who loaded a page and ran our analytics code without ad-block, consent rejection, or script-blocking interference." It excludes most bots by design but not all, and it's now delivered with sampling on most accounts above a moderate volume threshold.

HumanKey counts JS-executable user sessions on pages where our snippet loaded, the user consented (where consent applies), and we successfully classified the visit as either human or non-human traffic. Our number reflects "real, classifiable end-user sessions."

Three different definitions of "visitor." Three different counts.

Why the ratios drift

For most publishers we work with, the typical ratios look like this:

• HumanKey ≈ 0.4–0.7 × Cloudflare — because CF includes asset hits, bot traffic, and connection retries that we either can't observe (asset hits don't load our snippet) or actively classify out (bots aren't counted as human visitors).
• HumanKey ≈ 0.8–1.1 × Google Analytics — because we measure the same population (JS-executable sessions) but with different filters: HK excludes bot-classified visits more aggressively than GA, and GA samples on high-traffic accounts.
• GA ≈ 0.5–0.75 × Cloudflare — same direction as HK/CF, slightly less aggressive filtering.

If your ratios sit far outside these bands, that's worth investigating. Common explanations: an unusual share of API traffic versus page traffic (CF ≫ HK), heavy bot ingress that GA isn't filtering (GA closer to CF than expected), or our snippet failing to load on a subset of pages (HK ≪ GA).

We deliberately don't claim our number is "more correct." It's more specific: it answers a narrower question (real user sessions, classified) than the other two.

When each number is the right one

Use Cloudflare's number when you're sizing infrastructure, reasoning about origin load, evaluating CDN bandwidth costs, or measuring DDoS pressure. It's the count that maps to actual server work.

Use Google Analytics' number when you're comparing to industry benchmarks, talking to ad networks who use GA-style counting, or doing year-over-year comparisons within GA itself.

Use HumanKey's number when you need to know how many real end-user sessions hit your content, how the human/bot split looks for AI-crawler reporting, or when your reporting workflow depends on consent and bot-classification work being done before the count.

For most editorial and product reporting, the right number is the one your stakeholders are already calibrated against. Switching reference systems mid-year invalidates trend comparisons. Pick one, document the choice, stick with it.

What we measure deliberately — and what we don't

We measure JS-executable sessions, classify each as human or specific bot type, and surface that in the dashboard. We do this with hashed IP addresses (SHA-256 with a daily-rotating salt — never raw IPs), truncated user agents, and consent-aware logging.

We do not count:

• HTTP requests at the edge (CF does this; we don't replicate it).
• Sessions where our snippet didn't load (network errors, ad-block, snippet-disabling extensions).
• Anonymous fingerprinting beyond the consent boundary — we'd rather under-count than over-collect.

That last one is the most common source of "but Cloudflare says more." It's deliberate. If it makes our number lower, we're comfortable with that trade.

A note on bot traffic

The biggest source of disagreement we see between the three tools isn't human counting at all — it's bot traffic. CF includes most bots in raw counts (filterable in their dashboard, but not by default for top-line numbers). GA filters known bots but lets through anything sophisticated enough to load and execute JavaScript without obvious tells. HumanKey runs an explicit classifier and reports human versus non-human as separate buckets.

For publishers reporting to advertisers or to internal stakeholders who care about humans-only counts, the gap between "filtered" and "classified" matters. We publish the classification methodology in our public audit dashboard; how aggressive a filter your team needs depends on what you're using the number for.

Practical guidance

If you're staring at three different numbers for the same period, the steps that help:

1. Pin the date range identically across all three tools. GA's "last 30 days" and CF's "October" can disagree by 2–3 days at the edges.
2. Strip API and asset hits from CF. The CF dashboard has filters; use them before comparing to GA or HK.
3. Check our human-versus-bot split. If our human count is much lower than GA's session count, that often means GA is letting some sophisticated bots through.
4. Document which number drives which decision. A short internal note ("CF for capacity, GA for ad-buying, HK for editorial humans-only") prevents repeated debates.

We aren't trying to win the comparison. We're trying to make our piece of it clear.

---

This post reflects how HumanKey counts visitors and how that count typically relates to Cloudflare and Google Analytics. Specific ratios depend on your traffic mix; we publish our classification methodology in the public audit dashboard at humankey.io. For questions about a specific drift on your account, the contact form routes to support.