Bots accounted for 53% of all web traffic in 2025, and 40% of every request on the internet was outright malicious (Imperva, 2026 Bad Bot Report). It is the second straight year automated traffic has outnumbered humans, and the machines are getting smarter: AI-driven bot attacks surged 12.5x year over year (Imperva, 2026 Bad Bot Report). Cloudflare’s independent network telemetry agrees, showing humans behind just 47% of HTML page requests by December 2025 (Cloudflare, Radar 2025 Year in Review), while roughly one in five ad impressions now shows signs of invalid traffic (Fraudlogix, Ad Fraud Statistics 2026). This analysis consolidates data from Imperva, Cloudflare Radar, Fraudlogix, DataDome, Verizon, and six other primary sources into one reference set.
TL;DR
- Bots made up 53% of web traffic in 2025, with 40% of all traffic classified as malicious (Imperva, 2026 Bad Bot Report).
- AI-driven bot attacks surged 12.5x year over year in 2025 (Imperva, 2026 Bad Bot Report).
- Humans generated only 47% of HTML page requests as of December 2025, versus 44% from non-AI bots (Cloudflare, Radar 2025 Year in Review).
- AI crawlers reached 20% of verified bot traffic, with Googlebot over 28% and GPTBot near 7.5% (Cloudflare, Radar 2025 Year in Review).
- Global invalid traffic (IVT) hit 20.64% across 105.7 billion ad impressions in 2025 (Fraudlogix, Ad Fraud Statistics 2026).
- Only 2.8% of 16,900+ tested websites were fully protected against bots, down from 8.4% in 2024 (DataDome, 2025 Global Bot Security Report).
- Credential stuffing accounted for 19% of authentication attempts on a median day (Verizon, 2025 DBIR).
- Meta actioned 1.1 billion fake Facebook accounts in Q4 2025 alone (Meta, Transparency Center).
- Simple, high-volume bots rose to 45% of bad bot traffic, aided by free AI tools (Imperva, 2025 Bad Bot Report).
- Residential proxies masked 21% of bot attacks to blend in with real users (Imperva, 2025 Bad Bot Report).
- Commerce faced more than 200 billion application and API attacks across 2024-2025 (Akamai, 2025).
- AI can solve reCAPTCHA-style challenges at near 100% accuracy versus 50-84% for humans (arXiv, Breaking reCAPTCHAv2, 2024).
1. Bots vs. Humans: The Traffic Split
The headline crossed a threshold and kept going. For the second year running, automated traffic held the majority of the web, rising to 53% in 2025 from 51% a year earlier (Imperva, 2026 Bad Bot Report). Two independent measurement networks, Imperva and Cloudflare, land within a few points of each other, which is unusual for internet-scale estimates and suggests the human-minority era is real rather than a sampling artifact. The share that is actively hostile, not merely automated, is the number that matters for defenders: 40% of all traffic.
| Metric | Value | Source |
|---|---|---|
| Bot share of all web traffic, 2025 | 53% (up from 51%) | Imperva, 2026 Bad Bot Report |
| Traffic classified as malicious (bad bots), 2025 | 40% | Imperva, 2026 Bad Bot Report |
| Bad bot share, 2024 | 37% (up from 32% in 2023) | Imperva, 2025 Bad Bot Report |
| Human share of HTML page requests, Dec 2025 | 47% | Cloudflare, Radar 2025 Year in Review |
| Non-AI bot share of HTML requests, Dec 2025 | 44% | Cloudflare, Radar 2025 Year in Review |
| AI bot share of HTML requests (2025 average) | 4.2% (range 2.4%-6.4%) | Cloudflare, Radar 2025 Year in Review |
| Bot traffic on e-commerce sites (31% malicious) | 57% | Radware, 2025 E-Commerce Bot Threat Report |
Source: Imperva - AI-Driven Bot Attacks Surged 12.5x (2026 Bad Bot Report)
Radware’s e-commerce figure shows how much worse the split gets on high-value targets: malicious bots there doubled from 16% of traffic in 2022 to 31% in 2025. For the wider threat picture these bots feed into, see our cybersecurity statistics for 2026.
2. AI Crawlers and the Scraping Surge
The fastest-growing slice of bot traffic is not attacking anything; it is reading everything. AI crawlers reached 20% of all verified bot traffic in 2025, and OpenAI’s ChatGPT-User agent peaked at roughly 16x its start-of-year request volume (Cloudflare, Radar 2025 Year in Review). The composition of “good” crawler traffic is shifting from search indexing toward model training and live chatbot retrieval, which is why publishers are seeing crawl volume rise while referral clicks stay flat. Google’s dual-purpose crawler still dwarfs the rest.
| Metric | Value | Source |
|---|---|---|
| AI crawlers as share of verified bot traffic | 20% | Cloudflare, Radar 2025 Year in Review |
| Googlebot share of verified bot traffic | Over 28% | Cloudflare, Radar 2025 Year in Review |
| Search-engine crawlers share of verified bots | 40% | Cloudflare, Radar 2025 Year in Review |
| OpenAI GPTBot share of verified bot traffic | ~7.5% | Cloudflare, Radar 2025 Year in Review |
| Microsoft Bingbot share of verified bot traffic | 6% | Cloudflare, Radar 2025 Year in Review |
| SEO bots share of verified bot traffic | Over 13% | Cloudflare, Radar 2025 Year in Review |
| Google-Extended allow directives in robots.txt | Tripled during 2025 | Cloudflare, Radar 2025 Year in Review |
AI crawlers were also the most frequently disallowed user agents in robots.txt, led by GPTBot, ClaudeBot, and CCBot (Cloudflare, Radar 2025 Year in Review). The overlap with generative search is covered in our AI search statistics for 2026, which tracks the crawl-to-referral gap separately.
3. Bad Bot Sophistication and Evasion
Cheap AI has flattened the skill curve for attackers. Simple, high-volume bots jumped to 45% of bad bot traffic in 2024, up from about 40% a year earlier, as free automation tools let low-skill actors launch attacks at scale (Imperva, 2025 Bad Bot Report). At the other end, advanced bots increasingly hide inside legitimate infrastructure: roughly one in five attacks now routes through residential proxies to look like a real home user, and Chrome impersonation plus headless browsers defeat naive user-agent filtering.
| Metric | Value | Source |
|---|---|---|
| Simple bots as share of bad bot traffic, 2024 | 45% (up from ~40%) | Imperva, 2025 Bad Bot Report |
| Bot attacks using residential proxies | 21% | Imperva, 2025 Bad Bot Report |
| Advanced bot traffic targeting APIs, 2024 | 44% | Imperva, 2025 Bad Bot Report |
| Advanced bot traffic targeting applications, 2024 | 10% | Imperva, 2025 Bad Bot Report |
| Bot attacks now targeting APIs, 2025 | 27% | Imperva, 2026 Bad Bot Report |
| AI-driven bot attack growth, 2025 | 12.5x year over year | Imperva, 2026 Bad Bot Report |
Source: Imperva - 2025 Bad Bot Report: How AI is Supercharging the Bot Threat
The evasion toolkit, residential proxies, faked browser identities, AI-assisted scripting, and anti-detection browsers, is why signature-based blocking keeps losing ground (Imperva, 2025 Bad Bot Report). Many of these same botnets double as DDoS infrastructure, detailed in our DDoS attack statistics for 2026.
4. Bot Traffic by Industry
Bots follow the money, and the distribution is lopsided. Travel sites saw 48% of all their traffic come from bad bots, the highest share of any sector, driven by price-scraping and seat-hoarding automation (Imperva, 2025 Bad Bot Report). Financial services is the prime target for account takeover, while commerce absorbs attacks at a scale measured in the hundreds of billions. AI shopping agents are now a distinct third traffic category that retailers must classify alongside good and bad bots.
| Metric | Value | Source |
|---|---|---|
| Bad bot share of travel-site traffic, 2024 | 48% | Imperva, 2025 Bad Bot Report |
| Travel share of all bad bot attacks, 2024 | 27% | Imperva, 2025 Bad Bot Report |
| AI-powered bad bots on retail-site traffic | 33% | Imperva, 2025 Bad Bot Report |
| Financial services share of all bot attacks, 2025 | 24% | Imperva, 2026 Bad Bot Report |
| Financial services share of ATO incidents, 2025 | 46% | Imperva, 2026 Bad Bot Report |
| Application and API attacks on commerce, 2024-2025 | Over 200 billion | Akamai, 2025 |
| AI bot traffic growth in commerce, 2025 | +19% year over year | Akamai, 2025 |
Source: Akamai - Smash and Grab at Scale: Agentic AI Is Reshaping the Threat to Commerce
Akamai also tallied nearly three trillion Layer 7 DDoS attacks against commerce in 2025, with 84% aimed at the retail vertical (Akamai, 2025). Retail bot pressure sits alongside broader spending shifts in our social media statistics for 2026.
5. Account Takeover, Credential Stuffing, and Fake Accounts
Bots are the delivery mechanism for stolen passwords. Credential stuffing made up 19% of all authentication attempts on a median day across enterprise single sign-on logs (Verizon, 2025 DBIR), and account takeover attacks climbed 40% in 2024 (Imperva, 2025 Bad Bot Report). The supply side explains the volume: infostealer malware alone harvested 1.8 billion credentials in the first half of 2025, feeding automated login attempts faster than any platform can revoke reused passwords.
| Metric | Value | Source |
|---|---|---|
| Credential stuffing share of auth attempts (median day) | 19% | Verizon, 2025 DBIR |
| Breaches beginning with credential abuse | 22% | Verizon, 2025 DBIR |
| Web app attacks involving stolen credentials | 88% | Verizon, 2025 DBIR |
| Account takeover attack growth, 2024 | +40% year over year | Imperva, 2025 Bad Bot Report |
| Credentials harvested by infostealers, H1 2025 | 1.8 billion | SpyCloud, 2025 |
| Fake Facebook accounts actioned, Q4 2025 | 1.1 billion (up from 698M) | Meta, Transparency Center |
| Malicious bot request surge, Dec 2025 vs Dec 2024 | +135% | DataDome, 2025 |
Despite removing over a billion fake accounts per quarter, Meta still estimates roughly 3-4% of its 3 billion-plus monthly active users are fake (Meta, Transparency Center). Password reuse keeps stuffing viable: in the median case, only 49% of a user’s passwords were distinct across services (Verizon, 2025 DBIR).
6. Ad Fraud and Invalid Traffic
Every fake impression is a bot getting paid. Invalid traffic reached 20.64% across 105.7 billion measured ad impressions in 2025, roughly one in five impressions showing non-human or fraudulent characteristics (Fraudlogix, Ad Fraud Statistics 2026). The rate is wildly uneven by environment: legacy browsers and desktop Windows carry the most fraud, while the trend line for 2026 is sharply up as AI-generated traffic mimics human scrolling, pauses, and clicks convincingly enough to fool basic filters.
| Metric | Value | Source |
|---|---|---|
| Global invalid traffic (IVT) rate, 2025 | 20.64% | Fraudlogix, Ad Fraud Statistics 2026 |
| U.S. programmatic ad spend tied to IVT | ~$37 billion | Fraudlogix, Ad Fraud Statistics 2026 |
| Desktop IVT rate | 27.03% | Fraudlogix, Ad Fraud Statistics 2026 |
| IVT rate on Internet Explorer traffic | 79.50% | Fraudlogix, Ad Fraud Statistics 2026 |
| IVT rate on Windows OS traffic | 30.55% | Fraudlogix, Ad Fraud Statistics 2026 |
| Highest-IVT country (100M+ impressions) | Nigeria, 61.37% | Fraudlogix, Ad Fraud Statistics 2026 |
| Global IVT climb, Jan to Jun 2026 | 26% -> 40% | eMarketer, 2026 |
Regional spread is just as stark: Asia-Pacific ran a 27.85% IVT rate against Europe’s 7.80% (Fraudlogix, Ad Fraud Statistics 2026). By June 2026 eMarketer reported global IVT at 40%, a jump attributed to sophisticated invalid traffic (SIVT) built on AI (eMarketer, 2026).
7. Detection, CAPTCHA, and the Defense Gap
The tools most sites rely on are failing quietly. Bot detection rates across major commercial vendors ranged from just 6% to 42% in live testing, and only 2.8% of 16,900+ websites were fully protected, down from 8.4% a year earlier (DataDome, 2025 Global Bot Security Report). The classic backstop, CAPTCHA, is effectively solved: a 13-month field study found automated solvers hit near 100% accuracy while humans managed only 50-84%, so challenge-based defenses now add friction for real users without stopping machines.
| Metric | Value | Source |
|---|---|---|
| Websites fully protected against bots, 2025 | 2.8% (down from 8.4% in 2024) | DataDome, 2025 Global Bot Security Report |
| Websites left unprotected, 2025 | 61.2% | DataDome, 2025 Global Bot Security Report |
| Vendor bot-detection rate range (live tests) | 6% to 42% | DataDome, 2025 Global Bot Security Report |
| AI bot traffic that touched web forms | 64% | DataDome, 2025 Global Bot Security Report |
| AI/bot success rate solving reCAPTCHA-style tests | Near 100% (vs 50-84% humans) | arXiv, Breaking reCAPTCHAv2, 2024 |
| AI bot traffic that reached login pages | 23% | DataDome, 2025 Global Bot Security Report |
Source: DataDome - Key Findings, 2025 Global Bot Security Report
The uncomfortable takeaway: 64% of AI bot traffic reached web forms and 23% hit login pages, the exact surfaces where fraud and account takeover happen (DataDome, 2025 Global Bot Security Report). Layered risk scoring and behavioral analysis now outperform any single challenge, since the CAPTCHA itself is no longer a barrier machines cannot cross (arXiv, Breaking reCAPTCHAv2, 2024).
Summary: Bot Traffic by the Numbers
| Metric | Value | Source |
|---|---|---|
| Bot share of all web traffic, 2025 | 53% | Imperva, 2026 Bad Bot Report |
| Traffic classified as malicious | 40% | Imperva, 2026 Bad Bot Report |
| AI-driven bot attack growth | 12.5x YoY | Imperva, 2026 Bad Bot Report |
| Human share of HTML page requests, Dec 2025 | 47% | Cloudflare, Radar 2025 Year in Review |
| AI crawlers as share of verified bot traffic | 20% | Cloudflare, Radar 2025 Year in Review |
| Googlebot share of verified bot traffic | Over 28% | Cloudflare, Radar 2025 Year in Review |
| Global invalid traffic (IVT) rate, 2025 | 20.64% | Fraudlogix, Ad Fraud Statistics 2026 |
| U.S. ad spend tied to IVT | ~$37 billion | Fraudlogix, Ad Fraud Statistics 2026 |
| Global IVT by June 2026 | 40% | eMarketer, 2026 |
| Websites fully protected against bots | 2.8% | DataDome, 2025 Global Bot Security Report |
| Vendor bot-detection rate range | 6% to 42% | DataDome, 2025 Global Bot Security Report |
| Credential stuffing share of auth attempts | 19% | Verizon, 2025 DBIR |
| Breaches beginning with credential abuse | 22% | Verizon, 2025 DBIR |
| Credentials harvested by infostealers, H1 2025 | 1.8 billion | SpyCloud, 2025 |
| Fake Facebook accounts actioned, Q4 2025 | 1.1 billion | Meta, Transparency Center |
| Bad bot share of travel-site traffic | 48% | Imperva, 2025 Bad Bot Report |
| Financial services share of ATO incidents | 46% | Imperva, 2026 Bad Bot Report |
| Simple bots as share of bad bot traffic | 45% | Imperva, 2025 Bad Bot Report |
| Application/API attacks on commerce, 2024-2025 | Over 200 billion | Akamai, 2025 |
| CAPTCHA solve rate for AI vs humans | ~100% vs 50-84% | arXiv, Breaking reCAPTCHAv2, 2024 |
Methodology and Sources
Data was gathered by reviewing the most recent primary reports, vendor threat telemetry, transparency disclosures, and peer-reviewed research on automated traffic published between 2024 and 2026, prioritizing 2025 and 2026 editions and cross-referencing traffic-share figures across at least two independent networks.
Sources cited:
- Imperva (Thales) - 2026 Bad Bot Report (2025 data)
- Imperva (Thales) - 2025 Bad Bot Report (2024 data)
- Cloudflare - Radar 2025 Year in Review
- Fraudlogix - Ad Fraud Statistics 2026
- DataDome - 2025 Global Bot Security Report
- Verizon - 2025 Data Breach Investigations Report (DBIR)
- Akamai - Agentic AI and the Threat to Commerce (2025)
- Meta - Transparency Center, Integrity Reports (Q4 2025)
- Radware - 2025 E-Commerce Bot Threat Report
- SpyCloud - 2025 identity threat research
- arXiv - Breaking reCAPTCHAv2 (2024)
- eMarketer - AI-Powered Ad Fraud analysis (2026)
Data watch: Imperva’s Bad Bot Report and Cloudflare’s Radar Year in Review are both annual, with next editions expected in H1 2026 and late 2026 respectively; Verizon publishes its DBIR each spring; DataDome’s Global Bot Security Report and Fraudlogix’s annual ad-fraud tally refresh yearly; Meta’s Transparency Center updates quarterly. Figures dated 2024 (Imperva 2025 report, Verizon SSO log analysis) are flagged as the most recent available for those specific metrics.
Last updated: July 17, 2026. We review and update this page quarterly as new data is published.