It's commonplace to use the referrer and user agent to cloak traffic as well as IP addresses. However i was thinking of this... Have a php page which sets a cookie... then some php to check if the cookie was set, if it wasnt set then its likely a bot. What are peoples opinions on this? Googlebot doesn't read cookies, or store them. Just another detection method to add to the others.