Our analytics said we had traffic. Search Console said we had twelve impressions.

On five separate days between 22 and 29 September 2026 we recorded the Organic Search line on this site's own Google Analytics 4 property as 6, then 12, then 15, then 18, then 24 sessions, and we described it as the only figure on the property worth reading. Every other channel was visibly automated: 179 sessions arriving as Direct with a three-second average engagement time, and whole countries — Poland, Germany, the Netherlands — registering literally zero seconds and a zero per cent engagement rate. Against that, an organic line with 50 to 67 per cent engagement and fourteen to twenty-one seconds per session looked like the real thing.

It is not the real thing. We are not softening the earlier reading, we are withdrawing it. Those sessions are almost certainly not people arriving from a search result, and the test that shows it took one report and one subtraction.

We are publishing it because the mistake is more instructive than the finding. We had already decided the property was contaminated. We simply exempted the one line that flattered us, and we never tested the exemption.

Two reports, same site, same twenty-eight day window, read on 29 September 2026.

GA4 session source, rather than the default channel grouping — the distinction matters, because the channel grouping tells you what Google Analytics decided a visit was, and the source tells you what the visit itself claimed to be:

Google Search Console, Performance report, the same property and the same window:

Analytics reports 22 sessions referred by Google. Google reports that our results were shown 12 times in total.

You cannot be visited from a search result more often than the result was displayed. An impression is the shown listing; a click is a subset of impressions; a session from search is a subset of clicks. Twenty-two against twelve is not a gap to be explained by sampling or attribution windows. It is the wrong way up.

There are legitimate reasons these two numbers never match exactly, and an honest version of this check states them before drawing the conclusion.

Search Console's Performance report covers Web search only by default, so impressions in Images, News and Discover sit outside it. The two reports also do not end on the same day — Search Console data lagged ours by about two days at the time of reading. And a single click can legitimately produce more than one session, if a visitor returns later within the session-timeout window and Analytics re-attributes the visit to the original source.

Allow for all three generously and the numbers still do not meet. Discover and Images traffic is not a plausible source of a dozen extra visits for a site with, at the time of reading, one page indexed out of eighty-three. A two-day window offset on a property averaging under half a click a day cannot produce ten sessions. And multi-session attribution multiplies clicks, of which there were four.

The explanation that fits is referrer spoofing: automated traffic that declares google as its source without having come from Google. It is the standard companion to what is already documented on this domain — 183 backlinks from an active link-selling network, 179 Direct sessions at three seconds, and the zero-second country block. It is not a separate phenomenon. It is the same traffic wearing a different label, and the label is the cheapest part of it to forge.

The honest figures are Google's own, and they are small and real:

Clicks doubled and impressions quadrupled in three days. That is genuine movement and it is the first of its kind on this domain. It is also four clicks.

The page-level split is the first signal this site has produced that is worth acting on at all. The homepage took 4 clicks from 11 impressions. One other page, our Ahmedabad location page, took 6 impressions and no clicks — it is being shown and not chosen. On six impressions that is not yet evidence of a title and description problem, but it is the first page-level reading we have had, and it is the one we will watch.

Neither of the two queries Google names — our own brand, and a misspelling of a different Ahmedabad company — produced a click, so all four clicks came from queries below Google's anonymisation threshold. Reporting this as 'four clicks' rather than as a growth rate is deliberate. Four is a number you can act on the truth of. A percentage increase on a base of two is a sentence that sounds like progress and contains none.

The failure was not analytical. We had already found the contamination and written it down. The failure was that the contaminated channels were the ones telling us bad news, and the exempted channel was the one telling us good news, and we tested the first group and not the second.

That asymmetry is worth naming because it does not feel like bias while it is happening. It feels like reasonable triage. Direct traffic at three seconds from countries we do not serve is obviously fake, so it gets scrutiny. Organic traffic at fourteen seconds with a fifty per cent engagement rate looks fine, so it gets none. The scrutiny went where the suspicion already was, which means it could only ever confirm what we already thought.

The rule we have written for ourselves out of this: a number that flatters the project gets the first check, not the benefit of the doubt. This is the third time this month that accepting a pleasing figure without the test that would break it has produced a false finding here, and the third time the correction turned out to be more useful than the original claim.

The obvious lesson would be that Analytics lies and Search Console tells the truth. That is not the lesson, and we found the counter-example on the same day.

Search Console's Page indexing report told us the same thing at six consecutive checks across eight days: one page indexed, eighty-one discovered and not indexed. Every check also showed the report's own stamp reading Last update: 21/09/2026. Meanwhile the Performance report on the same property was stamped as refreshed four and a half hours earlier, and the Sitemaps report had refreshed twice in the same window.

So we asked Google directly instead, with a live site query against our own domain. It returned four URLs, not one. Two of them were pages we had retired two days earlier and redirected — which is its own problem, and a different article — but the count was four.

Indexing had grown and the report had not said so. The number we had spent eight days describing as unmoved was not a frozen site, it was a frozen dial. Two reports inside the same Google product, on the same property, with different refresh cycles: one understating our position, the other overstating it.

The durable version of the lesson is therefore not about which tool to trust. It is that every report has a refresh cycle and a failure mode, and that a figure is only as current as the timestamp printed next to it. Read the timestamp before you read the number. If a report does not print one, treat that as the finding.

This takes about ten minutes and needs no tooling beyond the two free products. It is worth doing on any property where paid media, agency reporting or a board slide depends on an organic figure. The two reports you need are GA4's Traffic acquisition, switched from the default channel grouping to session source, and Search Console's Performance report set to the same date range.

• Match the windows first. Set both to the same twenty-eight days, and note that Search Console's data ends one to three days behind. If you cannot match them, make the Search Console window the longer one, so the comparison runs against you rather than for you.
• Compare sessions attributed to google against total impressions, not against clicks. Impressions is the ceiling that cannot be exceeded.
• Sessions materially above impressions means the traffic did not come from web search. Sessions between clicks and impressions is normal and needs no explanation. Sessions far below clicks usually means a tagging or consent problem instead, which is a different repair.
• Check engagement by country. Zero seconds and a zero per cent engagement rate is not a visitor who bounced. A person who bounces still registers a moment.
• Check your referring domains and their growth rate. Link networks crawl what they link to, so a sudden rise in referring domains and a sudden rise in sessions are frequently the same event.
• Verify your indexed count against a live site query rather than trusting the Page indexing report alone, and read that report's Last update stamp every time.

If the check fails on your property, the first consequence is not technical. It is that any reporting built on that organic line needs correcting with whoever received it, including the version of it you told yourself.

We changed the metric of record. Search performance on this site is now reported as Search Console clicks and impressions, and Analytics sessions are no longer used to describe how much search traffic arrived or where it came from. Analytics remains genuinely useful for behaviour within a visit — which pages a real visitor reads, how far down, what they click — and useless for counting visits until a filter exists.

We did not create that filter. Excluding this traffic in GA4 means changing a data setting on the property, and a data filter is retrospectively invisible: reporting after it exists will not resemble reporting before it, and anyone comparing the two periods needs to know why. That is an owner's decision rather than a technician's, and our recommendation is to build it after the link cleanup rather than before, so the filter is written against the pattern as it actually settles.

We also did not change anything about the site itself, because nothing about the site was wrong. The pages, the measurements and the published findings are unaffected. What changed is which dial we read to judge them — which is, on reflection, the more expensive kind of error to have been making, because it is the kind you can keep making indefinitely while everything looks fine.

This article was written on 29 September, the day the check was run, and held for two weeks while the site was restructured and rebuilt. Rather than publish a fortnight-old reading without saying so, here are both reports again, read on 14 October 2026, with their own timestamps attached — which is the discipline the article argues for, applied to the article.

The Performance report for the 28 days ending 11 October — its data lags three days — shows 7 clicks from 72 impressions. The Page indexing report, stamped Last update: 09/10/2026, shows 6 pages indexed and 40 in Discovered – currently not indexed, against 1 indexed and 81 discovered at the frozen September reading. Average position falling from 7.6 to 13.1 and CTR falling from 33.3 to 9.7 per cent are both arithmetic consequences of impressions rising six-fold onto lower-ranked terms, not declines, and saying so is the same discipline as the rest of this piece.

None of that revises the finding. It is seventy-two impressions. The organic session count in GA4 is still unfiltered and still unusable for counting visits, so the comparison that produced this article cannot yet be run in reverse to confirm the traffic is now real — the honest statement is that Search Console's numbers have grown and Analytics' numbers remain uncountable. What has changed is the direction of the one number that matters here: pages discovered and not crawled fell for the first time, from 42 to 40.

The reusable part of this article was never the figures. It is the subtraction: sessions attributed to a search engine cannot exceed the impressions that search engine recorded. That test costs ten minutes and it does not get less true as the numbers get bigger.