Measurement

Install the TofuBofu AI traffic tag, then read the number it refuses to round up

By Arnav Mukherjee, founder of TofuBofu · September 3, 2026

In August we shipped a bot filter on our AI referral beacon, and the bug behind it was the worst shape a measurement bug can take. A JavaScript-executing crawler had been arriving with an AI referrer, firing the AI beacon, and lifting the AI count while the pageview denominator sat perfectly still. Our own code comment doesn't soften it: that's "the worst direction for an error on this page, because it makes the AI share look larger than it is on exactly the number we point at."

So here's an install guide with the uncomfortable half attached. The install's two copy-pastes and about five minutes of work. The rest of this post is what every AI attribution vendor leaves out of their onboarding: the four leaks that make your AI traffic number a floor, and the four places we made our own product print nothing where a zero would have looked better.

The install is two pastes

Open Integrations in the app's left rail, which is the route /website, then pick the second tab, labelled Tracking. Both snippets live there behind a Copy button. Your Overview page links you straight to /website#tracking while we can see the tag hasn't been installed yet.

Copy what the product hands you. Don't retype the version below, because we build it server-side with your workspace id and the right base URL, and the base URL has teeth: behind Cloud Run's proxy the request comes back as http://, and an http script tag pasted into an https site gets blocked as mixed content, which would leave the whole tag silently doing nothing.

The instruction we ship alongside it: "Add it right before the closing </body> tag on every page, or paste it into Google Tag Manager as a Custom HTML tag." Every page matters. That one tag does two separate jobs, and only one of them is about AI.

Job one runs on every visit: a first-party pageview beacon, AI or not. Job two runs only when the tag recognises an AI engine in the referrer. So the thing you installed to measure AI traffic quietly gives you plain first-party web analytics too, with pageviews, visitors, most-read pages and a daily chart on /traffic. We've never charged for that and we've never sold it either.

The second snippet is the conversion tracker, and it's two lines for a reason:

The first line looks like noise. It's the load-bearing half. The real script loads async, so a fast success page can call tbConversion before the file has landed. The stub queues those calls and the real script drains the queue when it arrives. Drop the stub and an early conversion disappears without a trace, which is indistinguishable from no conversion at all.

Then you call it. Our own instruction, verbatim: "Add this second snippet, then call tbConversion('signup') (or whatever label you like) on your thank-you/success page. It only fires if that same visitor arrived from an AI engine within the last 30 days, nothing fires for a visitor the traffic tag never saw." We dogfood it. Our own booking flow writes the booking unconditionally, then calls tbConversion('booked_meeting') to add the AI-referral attribution on top.

Six engines can reach it, and Grok is one of them

The tag reads document.referrer and matches it against a hardcoded host map: chatgpt.com and chat.openai.com, perplexity.ai, gemini.google.com, claude.ai, copilot.microsoft.com, grok.com and x.com/i/grok. No referrer match, and it falls back to utm_source against the same engine names. Neither one matches, and the tag records nothing further and returns.

Don't read that as the six engines we scan. It isn't. Our referral set is defined once, in one file, as the engines that can send you a human visitor, which puts Grok in and leaves out any engine we test that has no consumer surface pointing back at you. Google AI Mode and Google AI Overviews sit inside the scan and outside the tag, and the reason deserves its own section below.

We also store how each visit was recognised, and we show you the split. A referrer is the engine identifying itself to your server. A utm_source is a parameter anyone can paste into a URL, so it's the weaker of the two, and blending them into one confident total would turn a measurement into a guess. You see which half of your AI traffic the engine confirmed and which half you told us about.

Four leaks, and Google owns the one nobody closes

Leak one: two of the six strip the referrer. Claude and Gemini frequently send visitors with no referrer, so those visits land in your Direct bucket. A Claude-sourced visit with no referrer and no utm_source isn't counted. It isn't counted as a zero either, and the difference between those two matters more than it sounds.

Leak two: Google's AI surfaces are structurally invisible. The comment in our own source is the clearest thing I can give you: "ai_mode and ai_overviews are deliberately absent. Google's AI surfaces send an ordinary google.com referrer, so our tag has nothing that separates those visits from ordinary Google search, and a zero in that row would be the uninstalled-instrument defect: a number printed where there is no measurement." No tag closes that leak. Not ours, not GA4's, not an enterprise suite's. It's a property of what Google sends.

Leak three: the largest slice never clicks. An AI answer resolves the question in place. A buyer reads a recommendation on Tuesday, types your name into Google on Thursday, and arrives as branded search or Direct. No click-based instrument sees that as AI influence, and I've written about the same hole from the GA4 side in tracking AI referral traffic in GA4.

Leak four: conversions live downstream of leaks one to three. The conversion script opens by reading the marker the traffic tag wrote and returns straight away when there's no marker. Our schema comment names the trap for whoever reads it next: it's "an AI-referral attribution tool, not a conversion tracker." It inherits every leak above and adds none of its own, and pitching it as a conversion tracker would have been the easier sale.

Four rules we wrote into the code, and you should demand them elsewhere

Every one of these cost us a nicer-looking dashboard. Ask the vendor you're evaluating which of the four they've made, because the answer separates a measurement product from a confident-looking chart.

Read the tag as a trend, and keep the scoreboard upstream

Here's the line our own Overview card carries, and it's the sentence I'd want on every AI attribution dashboard sold today: "A floor, not a total: an AI visit only counts here when the engine passes a referrer, and several do not. Queries is the leading indicator." Trend the floor, don't total it. A floor that doubles tells you something real. A floor you present to your board as a total tells them something false, and you'll be the one correcting it later.

The reason to instrument now isn't the current volume, which for most B2B firms is small. G2's 2026 AI Search Insight Report surveyed 1,076 B2B software buyers in March 2026 and found 51% begin vendor research with an AI chatbot more often than with Google, while 80% still touch Google somewhere in the journey. Those two numbers describe a channel that's already deciding shortlists and hasn't yet shown up in anybody's referral report at full size. Instrument it while it's small and you'll recognise the inflection when it happens.

And keep the real scoreboard upstream of the tag. Whether an engine names you at all is measurable today, on every engine, with no leaks, because we ask the engines directly instead of waiting for a visitor to survive four of them. Traffic confirms after the fact. Presence is the thing you can change on Monday.

Frequently asked questions

Sources and further reading

• MDN: Referrer-Policy: the mechanism behind leak one, and why a sending site chooses how much of the referrer survives
• Google Search Central: AI features and your website: Google's own documentation on its AI surfaces, which describes no separate referrer or report for them
• G2 2026 AI Search Insight Report: n=1,076 B2B software buyers, March 2026, the source of the 51% figure above