A few days ago, Cloudflare CEO Matthew Prince posted something that stopped a lot of people in the digital industry mid-scroll. Bot traffic, he confirmed, has now overtaken human traffic on the internet for the first time in history. As of June 2026, automated systems account for 57.5% of all HTTP requests to web content. Humans are responsible for just 42.5%.
Prince had predicted this crossover would happen by the end of 2027. It happened 18 months early.
So, should you be worried? In short, we think that the answer is no, you don’t need to be worried. But you do need to be prepared, and here is what that might look like, and also what you will need to know.
What is driving the bot traffic?
Not all bots are the same, and understanding the difference matters. The shift is being driven primarily by agentic AI, which means autonomous programs that browse the web on behalf of people using AI assistants like ChatGPT, Claude or Gemini. When you ask an AI tool to research something for you, it does not just pull from one source. It can visit thousands of pages to complete a single task that a human would finish in a handful of clicks.
On top of that, you have the more traditional bots: search engine crawlers (Googlebot, Bingbot), monitoring tools, uptime checkers, SEO audit tools, price scrapers, and of course malicious bots probing for website vulnerabilities.
AI-driven traffic grew eight times faster than human traffic across 2025 alone, according to cybersecurity firm HUMAN Security. Agentic AI made up just 1.7% of automated traffic at the end of 2025, but that category grew nearly 8,000% over the course of the year. The growth is astonishing.
The instinct when you hear “more than half your traffic is bots” is to want to block all of it and remove the risk entirely. That would be a mistake.
Good bots vs bad bots: it is not black and white
Good bots are valuable to your business. Without Googlebot crawling your site, you would not rank in search results. Uptime monitors keep you informed when something breaks. Legitimate AI crawlers indexing your content for AI-powered search tools could bring you new business.
Bad bots are a different matter. These include scrapers harvesting your content without permission, credential stuffing bots attempting to brute-force login pages, vulnerability scanners looking for exploitable weaknesses, and bots designed to inflate metrics or skew data.
The goal is not to block everything automated. The goal is to be intentional about what you allow in.
At Laser Red, our back-end development team maintains a whitelist of bots that we permit across our own and our clients’ websites. These are bots whose traffic is likely to benefit the site, and unlikely to cause harm. We review and update that list regularly as the landscape changes, because it does change so frequently in fact that staying still is not really an option.
What this means for your hosting and infrastructure
More traffic means more server load, regardless of where it’s coming from. If your hosting is on the cheaper end or sitting on a shared environment, a spike in bot activity can slow your site down for real human visitors, or in more extreme cases, take it offline entirely.
The Wikimedia Foundation reported that its bandwidth for multimedia content surged 50% from January 2024, driven not by curious readers but by scrapers harvesting training data. Around 65% of its most resource-intensive requests were automated. Most businesses aren’t operating at Wikimedia’s scale, but the principle is the same: bot traffic consumes real resources.
Good hosting infrastructure for today’s web should include:
This isn’t just about speed. A slow or unavailable website affects your search rankings, your conversion rate, and ultimately your revenue. Think of hosting as a genuine business investment, not just a line to cut.
The capacity to handle traffic spikes without slowing down for real users
A content delivery network (CDN) that can absorb and distribute load
Rate limiting to stop individual IPs hammering your server
DDoS protection (these attacks are more common than most people realise)
Regular server-side maintenance to keep everything running as it should
Security: more bots means more attempts to find a way in
The security implications of this shift are significant. Cloudflare mitigated 6% of all global traffic across its network in 2025, with 3.3% flagged as DDoS attacks. General mitigations were applied to over 10% of traffic coming from more than 30 countries. These aren’t abstract statistics. They represent actual attempts to disrupt, compromise, or exploit websites.
For businesses, the practical risks look like this:
- Bots scanning for outdated plugins, themes or software with known vulnerabilities
- Credential stuffing attacks targeting login pages
- Content scraping that republishes your material without credit or permission
- Form spam and fake enquiries polluting your CRM data
- Resource exhaustion attacks designed to overwhelm your server
Keeping your website up to date is one of the most effective defences you’ve got. The vast majority of successful attacks exploit known vulnerabilities in outdated software – ones that already have a patch available. Comprehensive maintenance covering CMS updates, plugin updates and security checks closes those gaps before anyone finds them.
Every website we manage goes through full monthly maintenance for exactly this reason. It’s not glamorous, but in a world where bot traffic is growing at this rate, it’s one of the most important things you can do.
So what does this mean for your analytics?
This is the part most businesses haven’t thought about yet, but should.
If more than half of web traffic is automated and your analytics platform isn’t filtering it out properly, a meaningful chunk of the data you’re making decisions from isn’t human behaviour. It’s bots.
In practice, this can look like:
- Inflated pageview numbers that make your traffic look better than it is
- High bounce rates and zero session durations skewing your engagement metrics
- Conversions that never came from real people, distorting your conversion rate
- Traffic sources that look significant but represent bot behaviour rather than a genuine audience
Google Analytics 4 has built-in bot filtering, but it’s not perfect and it needs proper configuration to work well. Server-side analytics platforms can give you a cleaner picture. Regular audits of your data, looking at session quality, time on page, and user flow rather than just headline numbers, will help you spot where bot activity might be muddying things.
The question to ask isn’t just “how much traffic are we getting” it’s “how much of this is real, and what’s it actually doing?”
Should you block AI bots from crawling your content?
This is a question a growing number of businesses and publishers are wrestling with, and there’s no single right answer.
The case for blocking is straightforward: AI companies are using your content to train their models or power their search results, often without payment or credit. The Wikimedia Foundation’s experience is a good illustration of what uncontrolled AI scraping looks like in practice.
The case against blanket blocking is that as more people turn to AI-powered search tools to find answers, being indexed by those systems could become an increasingly important part of how you get found online. Block everything, and you might be cutting yourself off from a growing source of discovery.
Cloudflare has responded to this with Pay Per Crawl, a system that lets site owners charge AI scrapers for access to their content. It’s early days, but it signals where things are heading: a more structured, commercial relationship between content owners and the AI systems consuming their material.
For most businesses right now, the smart move is to be deliberate rather than reactive. Know which bots you’re letting in, understand what they’re doing when they visit, and make informed decisions rather than assuming everything’s fine or blocking things indiscriminately.
So, what should you actually do?
If you’re a business owner reading this and wondering where to start, here’s the short version:
- Make sure you’re on good, reliable hosting that can handle traffic properly
- Keep your site maintained and updated every month, without exception
- Check your analytics are filtering bot traffic and actually reflect real user behaviour
- Know which bots are accessing your site and whether that’s working for you or against you
- Put the basics in place: strong authentication, up-to-date software, rate limiting on login pages
The internet has changed. It changed faster than most people in this industry expected. But none of this needs to be overwhelming. A well-built, well-maintained website on solid infrastructure is still the right foundation. You just need to make sure yours is actually that.
Not sure how your website stacks up?
If you’d like a fresh pair of eyes on your hosting, security, or analytics, we’re happy to have that conversation. Get in touch with the team at Laser Red and let’s take a look.
