Gjoko Bozhinov

When 10K "Users" Showed Up Overnight (And None Were Real)

Recently, traffic on my hobby project suddenly exploded — from a few hundred daily visitors to nearly 10,000.

At first, I was excited. Maybe a post went viral? Maybe I finally hit some SEO gold?

But then I checked the analytics.

Almost all the visits came from Windows 7 users. Suspiciously outdated systems. After a bit of digging (and a chat with a friend who had the exact same issue), it turned out — they weren't users at all. They were bots.

What Happened

Some aggressive crawlers and fake user agents are still pretending to be on Windows 7 or even older OS versions.

They hit your pages thousands of times a day, skew your analytics, and waste server bandwidth.

If you're on a free or hobby-tier hosting plan, that can slow down or even crash your site.

How to Catch It

If your traffic suddenly spikes without any new content or marketing push, start by checking your analytics:

  • Look at operating systems — If a large chunk comes from Windows 7 or older, that's a red flag.
  • Inspect user agents — Many bots fake Chrome on Windows 7 strings.
  • Check behavior metrics — 100% bounce rate, zero engagement, weird session times.

How to Stop It

If you confirm bot traffic, you can filter or block it:

  1. Block Old Operating Systems — Block old OSes (like Windows 7 or below) in your Edge Config or Next.js Middleware.
  2. Add Detection Rules — Add bot detection headers or rate-limiting rules.
  3. Filter Analytics — Use analytics filters to exclude those sessions for cleaner data.

Example: Next.js Middleware Solution

import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

export function middleware(req: NextRequest) {
  const ua = req.headers.get('user-agent') || ''
  
  // Block Windows 7 (NT 6.1) and older systems
  if (ua.includes('Windows NT 6.1')) {
    return new NextResponse('Blocked', { status: 403 })
  }
  
  return NextResponse.next()
}

Lesson Learned

Traffic spikes aren't always good news. Sometimes they're just bots pretending to be users. If your numbers look too good to be true — they probably are.

Keep an eye on your analytics, filter aggressively, and don't let bots eat your resources.