Automated traffic crossed a significant threshold in 2024, accounting for 51% of all web activity according to Imperva’s 2025 Bad Bot Report, the 12th edition of their annual series tracking automated traffic trends. The figure represents the first time bots have outpaced human-initiated traffic in the report’s history, though the crossing was hardly sudden. The previous year’s report put bots at 49.6%, making this the confirmation of a multi-year trend rather than an overnight surprise.
Imperva is not alone in documenting the shift. Cloudflare, Akamai, TollBit, and Human Security have all published data pointing in the same direction. Kinsta’s own analysis of more than 10 billion requests across its managed infrastructure found that AI bot traffic surged 300% in a single year.
Why the Old Bot Definitions No Longer Hold
Bots have traditionally been straightforward to identify. They could not execute JavaScript, simulate realistic pointer movement, maintain browser sessions, or rotate IP addresses convincingly. Those detection signals are increasingly unreliable. AI-powered automation now allows bots to mimic human browsing behavior with enough sophistication to evade conventional fingerprinting.
David Belson, formerly Head of Data Insights at Cloudflare, is quoted in Kinsta’s AI and bot traffic report noting that most of what analysts are observing is not malicious in intent. The larger problem is bots behaving inefficiently at scale. He also points out that low-code and “vibe coded” automation tools have made it trivial for non-technical users to deploy crawlers without any consideration for robots.txt or rate limiting.
As a result, detection systems are shifting away from identity-based signals and toward behavioral analysis.
A Note on How Traffic Is Measured
It is worth clarifying what “traffic” means in this context. The bot-versus-human comparison is measured by requests and network activity, not by headcount. A single human page load can generate dozens or even hundreds of requests for HTML, CSS, JavaScript, fonts, images, APIs, and advertising assets. A small number of aggressive bots generating requests at machine scale can therefore produce traffic volumes that dwarf what many human visitors produce combined.
Three Factors Accelerating the Shift
- Financial incentives: Fraud, data theft, ransomware distribution, large-scale content scraping, and market manipulation are now carried out at enormous scale by automated systems. AI-powered bots make these activities harder to detect and trace, raising the potential profit for organized operations.
- Regulatory fragmentation: The internet spans jurisdictions with widely varying laws and enforcement capacity. That fragmentation has long benefited malicious actors, and the pace of AI development has widened the gap between what automation can do and what regulations can address.
- Degraded identity signals: User agents once provided a reliable way to distinguish browsers, crawlers, and bots. Modern bots can spoof or rotate these identifiers effectively enough that the signal itself is losing value as a primary detection mechanism.
What This Means for WordPress and Hosting Professionals
For site owners and hosting professionals, the practical implication is straightforward: a growing share of the server load, bandwidth consumption, and security surface you are managing is not coming from customers or readers. Capacity planning, bot filtering at the edge, and behavioral rate limiting are becoming baseline requirements rather than optional hardening. Relying on user-agent blocklists or simple crawl-budget rules is unlikely to be sufficient as bot sophistication continues to increase.