On Monday morning the visits chart shows a 40 percent collapse compared with the previous week. The instinctive reaction is to look for a culprit: a search engine update, a paused campaign, a competitor. Before any of that, though, there is a simpler and often decisive question: is the drop real, or has the measurement changed?
First question: measurement or reality
A good share of the anomalies I have investigated in my work were not about how people behaved but about how it was recorded. The initial checks take a few minutes:
- is the tracking code still present on every page? A new page template may have lost it;
- has the consent banner changed, or its configuration?
- was there a site release around the days of the drop?
- do other sources agree? Server logs, orders in the management system, requests received by email, data from other tools.
If the management system records the usual number of orders and only analytics shows the drop, the problem is in measurement. If both fall, the change is real.
Second question: when did it start
Narrowing down the moment helps enormously. Switch from the daily view to the hourly one: a drop that begins at a precise time usually points to a technical event, such as a release or configuration change; a gradual decline over several days suggests an external phenomenon, such as losing positions in search results.
Check the calendar too: public holidays, long weekends, clock changes, local events. Comparing with the same period last year may reveal that the «collapse» happens every year.
Third question: where is it concentrated
An overall drop is almost always the sum of very different drops. Break it down one dimension at a time and look for the one where the difference is concentrated:
| Dimension | What it may reveal |
|---|---|
| Channel | organic search down, direct stable: a ranking problem |
| Landing page | only one section of the site affected |
| Device | only mobile down: a display or speed problem |
| Browser | a single browser affected: technical incompatibility or blocking |
| Country or language | a language version no longer reachable |
If the drop concerns only organic search and only a group of pages, the direction of the investigation is clear. If it affects everything uniformly, a measurement problem or a very general factor is more likely.
Fourth question: what changed
At this point you look for changes made at that moment and in that segment. A change log, with dates and descriptions of releases, campaigns, content edits and configuration changes, shortens this phase dramatically. Without a log you end up reconstructing from memory, with the risk of blaming the drop on the first plausible explanation.
Spikes
A sudden increase deserves the same procedure. The most common causes are automated traffic, content picked up by a very busy site, a duplicated tracking event or a tag installed twice. A spike in page views with no increase in users, for example, suggests double counting.
Detecting anomalies in time
Waiting to spot them by eye means finding them late. A few well-chosen alerts are enough:
- daily traffic below a threshold compared with the average of the same weekday in previous weeks;
- zero conversions for a whole day;
- the ratio between key events and visits outside its usual range.
Thresholds must be tuned to avoid too many false alarms: an alert that goes off every week stops being read.
Documenting the conclusion
Every investigation should end with a short note: what happened, when, which segment, which cause, which fix. An annotation on the chart lets whoever looks at the data a year from now avoid repeating the same investigation, and exclude the anomalous period from comparisons if the data was wrong.
In short
- Before looking for external causes, check that the drop is not caused by measurement.
- Compare with independent sources such as server logs and the order system.
- Pin down when the change started and check the calendar and seasonality.
- Break the data down one dimension at a time to find where the change is concentrated.
- Keep a change log, set alerts and document every conclusion.
