Impressions but no clicks in Google Search Console: is it bots, or is it your own rank tracker?

What does Google Search Console actually record, and what can it never see?

Search Console measures Google, not your website. That single sentence resolves most of the confusion in this topic. Google defines the metric precisely: an impression is counted whenever an item appears in the current page of results, whether or not the item is scrolled into view, as long as the user did not need to click to see more results. The event being recorded happens on a Google results page. It does not happen on your server, and your server is never consulted.

Google draws the boundary explicitly in its own documentation comparing the two tools, noting that Search Console focuses on activity that happened before a person arrived at your website from Google Search. Analytics starts where Search Console stops. This is why a flood of bot traffic hammering your origin can be perfectly visible in your edge logs and your analytics while leaving no trace at all in the Performance report. The two datasets are not two views of one thing. They are two different things.

The obvious objection is Crawl Stats, which is fed by real requests to your server. It does not rescue the theory either, because Google scopes it narrowly: the report shows you statistics about Google’s crawling history on your website. That is Googlebot, not the internet. There is no report in Search Console that shows you third-party bots hitting your origin, because that is not what Search Console is for.

One more definition matters, and it is the one that trips people up. Google notes that a link must get an impression for its position to be recorded. If your result sits on page three and the user never leaves page one, nothing is logged at all. So an impression at position 40 is not nothing. It means a results page containing your link was genuinely served. The question is who, or what, it was served to.

Do bots show up in Google Search Console impressions?

Yes, and this is where the popular explanation breaks down. The commonly repeated version says Search Console cannot show bot activity at all. That is half right and it fails in a way that matters. John Mueller of Google addressed it directly when a site owner reported a suspicious spike, saying sometimes it can be from bots, and we do not necessarily filter all of that out in Search Console. He followed up three days later to add that Google does try to filter them, but that they are sometimes still visible.

The distinction that survives contact with the evidence is about where the bot goes, not whether it is a bot. A bot that requests pages from your web server never touches a Google results page, so it cannot create an impression. A bot that requests a Google results page is doing the exact thing an impression measures, so it creates one for every site listed in the response. Rank trackers, keyword tools, SERP APIs, and AI crawlers all live in that second category. They are not attacking anyone. They are reading a results page, which is what results pages are for.

This is the structural reason the most popular version of the attack theory cannot work. A campaign designed to suppress your click-through rate would have to generate impressions without clicks. To do that, it must scrape Google and never visit you. It would therefore leave nothing in your server logs, nothing in your analytics, and no IP addresses to trace. If your evidence for a Search Console anomaly is a list of suspicious IPs hitting your origin, you are looking at two different populations and calling them one. We know this because we made that exact mistake, in public, and we will get to it.

What did our own zero-click data actually look like?

We pulled 16 months of Search Console data for one of our properties: 430,197 impressions against 607 clicks, a site-wide click-through rate of 0.14%. Read on its own, that number looks like a site nobody wants. Read properly, it is two completely different populations averaged into one misleading figure.

Here is the control. Our branded query sat at average position 3.2 and returned 433 clicks from 1,182 impressions, a click-through rate of 36.6%. People who go looking for us find us and click, at a rate that would be healthy anywhere. Now the contrast. The query “digital marketing companies naples fl” sat at average position 7.9, on the first page, and pulled 9,260 impressions and exactly zero clicks. Both of those facts are in the same export, over the same period, for the same site. They cannot both describe human beings.

You can estimate how impossible that is without borrowing anyone else’s benchmark. With zero clicks across 9,260 impressions, the statistical rule of three puts the true click-through rate below 0.032% with 95% confidence. At position 7.9 on page one, that is not a low number. It is an absent one. Something was being served our link roughly nine thousand times and had no capacity to click at all.

The query strings gave it away. One of our highest-impression queries across the entire period was the phrase “seo agency naples” wrapped in literal quotation marks, with a trailing space, and the word linkedin appended. It pulled 7,651 impressions at average position 3.6 and zero clicks. Human beings do not search in quotation marks with a LinkedIn suffix and a stray space. That is a tool’s query string. Another query in our top twenty was, verbatim, “instagram for test fullentity as a property manager”, which pulled 1,209 impressions. That is somebody’s test string. It is not a customer.

Why did our impressions collapse on 12 September 2025?

This is the check that ends the argument, and anyone can run it on their own data. For years, Google accepted a URL parameter, &num=100, that returned 100 search results on a single page. It was the backbone of the SEO tooling industry, because one request could tell a rank tracker where a site sat anywhere in the top 100. Around 10 to 12 September 2025, Google stopped honoring it.

Our data for those days needs no interpretation. On 11 September we recorded 1,091 impressions at an average position of 37.1. On 12 September, 667 impressions at position 28.4. On 13 September, 474 impressions at position 18.3. Comparing the sixteen days before to the twenty days after: impressions fell 44.7%, from 1,116 per day to 617 per day, and average position “improved” by 14.6 places, from 35.9 to 21.3.

Nothing about our website changed on 12 September 2025. We did not publish, delete, redirect, or fix anything. What changed is that tools could no longer harvest positions 11 through 100 in a single request, so those impressions stopped existing. The position improvement is the tell: it is mechanical, not editorial. When the deep phantom entries stop being counted, the average of what remains gets better automatically. Nobody’s rankings moved.

This was not unique to us. It hit the entire industry on the same day, and it prompted a public reassessment from analysts who had spent a year explaining rising impressions and flat clicks as a shift in user behavior. Brodie Clark, who had helped popularize that framing, revisited it directly and concluded that GSC data has unfortunately been polluted with a lot of bot impressions over the past year. That is the honest read, and it is worth sitting with: a widely accepted industry narrative turned out to be a measurement artifact.

Apply that to the attack theory and it collapses. An adversary running a coordinated suppression campaign against your site does not stand down at 44.7% strength on the exact day Google deprecates a URL parameter, in perfect synchrony with every other site on the internet. Only tooling behaves that way. Tooling did.

Is your own rank tracker inflating your own impressions?

This is the part that cost us some pride. While investigating who was generating our zero-click impressions, we read the source of our own rank tracker. It calls a SERP API with a request body specifying a depth of 100 results, a desktop device, and a United States location, and the comment at the top of the file says it checks Google position for all tracked keywords daily, for every site we track.

That is not a subtle clue. That is the mechanism, written by us, running on a schedule, against the exact keyword set that shows up in our zero-click impressions: “digital marketing companies naples fl”, “naples seo expert”, “seo services naples fl”. Every one of those is a term an SEO agency tracks for itself. We were, at minimum, contributing to the phantom impressions we had been treating as evidence of hostility.

The device split confirms it from another angle. Across 16 months, desktop accounted for 621,086 impressions at a 0.24% click-through rate, while mobile accounted for 133,293 impressions at 0.40%. Mobile converts at nearly twice the rate on a fraction of the volume. For a local services business, a desktop share above 80% is not normal human behavior, and mobile is not mysteriously better at clicking. The desktop bucket is diluted with machines, because scrapers run desktop. Our own tracker literally specifies desktop in the request.

We are not claiming our tracker produced all of it. We cannot separate our own requests from Moz, from Search Atlas, from a competitor’s tracker, or from AI Mode fan-out queries, and we are not going to pretend otherwise. What we can say is that the class of traffic is identified, the mechanism is confirmed in code, and at least one of the callers is us. Before you conclude that someone is doing this to you, check whether you are doing it to yourself. It is the cheapest test available and it costs you nothing but the willingness to look.

How do you tell a scraper from a real attack?

The single most useful discipline here is to match your denominator to your position band. Near-zero click-through is only an anomaly if your position says it should be higher. A site-wide click-through rate is an average across every query you rank for, and most sites rank for far more deep queries than shallow ones. Compare that blended average against a benchmark for positions 1 to 3 and you will produce an anomaly out of thin air, every single time.

It is worth knowing how little published data exists past the first page. Advanced Web Ranking, which maintains one of the most-cited click-through studies in the industry, compiles a fresh CTR curve every month for the top 20 results. The top 20. Backlinko’s study of 4 million results found that only 0.63% of Google searchers clicked on something from the second page. There is no credible published click-through figure for position 40, because there is nothing there worth measuring. If a page ranks at position 40 and receives no clicks, that is not evidence of anything except position 40.

The curve is also not as tidy as the benchmarks imply. Seer Interactive, working from their own Search Console data, observed positions 15 and 16 out-clicking positions 5 and 6 on their site, which is the opposite of the smooth decay everyone assumes. Their broader 2026 analysis of 2.43 billion impressions found organic click-through at 3.82% without an AI Overview present and 2.36% with one. Bands, not curves. Treat any single number with suspicion, including ours.

• Check your branded query first. If people searching your name are clicking normally, nobody is suppressing you. Ours converts at 36.6%.
• Check the position band, not the site average. Match the denominator to the depth or you will invent an anomaly.
• Read the query strings. Quotation marks, trailing spaces, tool suffixes, and test strings are machines, not customers.
• Check the device split. A desktop share above 80% on a consumer or local business is scrapers, not people.
• Check 12 September 2025. If your impressions fell off a cliff that week, a large share of your history was &num=100 tooling.
• Check your own rank tracker before you accuse anyone. Depth-100 daily requests are the exact mechanism.
• Check whether your evidence populations match. Server-log IPs cannot explain a Search Console impression anomaly.

What would it actually take to prove a CTR manipulation attack?

We want to be careful here, because the honest answer is uncomfortable for a security company to give: proving this is very hard, and attribution is harder still. We are not going to tell you it is impossible, and we are not going to tell you we can do it for you with a dashboard.

The mechanical requirements are strict. A suppression campaign has to generate impressions without clicks, which means scraping Google and never visiting your site. So your server logs cannot contain the evidence, by definition. Your analytics cannot contain it either. What you would need is a sustained, statistically significant click-through deficit isolated to a specific position band, holding while your branded queries stay healthy, surviving the &num=100 test, persisting after you account for your own tooling and every commercial tool tracking your category, and correlating with nothing else that changed. We did not have that. Almost nobody who believes they have it actually does.

One check does have a documented answer, and it is worth knowing. If you suspect something is impersonating Googlebot against your origin, Google publishes the way to settle it: verify the request by reverse DNS lookup or against Google’s published crawler IP ranges, which they maintain precisely because spammers claim to be Google. Note the older advice that Google does not publish its crawler IPs is now out of date. That check is real, and it is also unrelated to your Search Console impressions, because a crawler at your origin cannot create one.

Attribution is a further leap, and it is the one we would urge you hardest not to take. Naming a competitor as the source of impressions you cannot even prove are hostile is not a security finding. It is a legal exposure, and it is beneath the standard we hold ourselves to. Google will not adjudicate it for you either. The product experts in Google’s own forums have been saying so for years to people in exactly this position.

The useful posture is narrower and more honest. You can detect automated traffic to your origin, you can contain it at the edge, and you can produce verifiable evidence of what you served and to whom. That is what RankShield is built to do, and to be clear about scope, it does none of it inside Google Search Console, because nothing can. Search Console is Google’s record of Google. Your edge is your record of you. Keeping those two straight is most of the discipline.

Where does RankShield actually help with this, and where does it not?

Start with the honest half. RankShield does nothing about the scraper impressions in your Search Console report, because nothing can. Those events happen on Google’s servers, they belong to Google, and no product you install on your website can see them, filter them, or remove them from your Performance report. Any vendor who tells you otherwise is selling you a dashboard that cannot see the thing it claims to fix.

What RankShield works on is the other population, the one Search Console is structurally blind to: automated traffic that actually reaches your origin. That traffic is real, it is most of the internet’s volume rather than a fringe (roughly a third of HTTP requests are bots per Cloudflare Radar), and unlike SERP scrapers it costs you money: wasted ad clicks, card testing, checkout abuse, and origin load. It is also the only population where you can produce evidence, because it is the only one that touches your server and leaves a record.

That work happens on three surfaces, and which one you need depends only on where your traffic lands. RankShield edge protection runs at Cloudflare’s network and screens requests before they reach your server, which is the right layer for volumetric floods and origin load. The Shopify fraud protection app works inside the store, where the money is, on card testing, checkout abuse, and ad-spend waste. The WordPress security plugin covers ranking and ad-spend attacks on a WordPress site with a live dashboard. They are the same detection running in three places, not three different products.

One more scope limit worth stating, since this post is about misreading evidence. Screening traffic that claims to be Googlebot is genuinely useful, and Google gives you the method to settle it, but a crawler at your origin still cannot create a Search Console impression. So if you deploy any of this expecting your zero-click impressions to fall, they will not. Different population, different instrument. What you get instead is a record of what actually hit your site, which is what you needed in the first place when you went looking for an attacker and found your own rank tracker.