Bots Surpass Humans in Global Web Traffic for the First Time
Automated bots now account for 57.5% of global web traffic, a milestone driven by AI scrapers and LLM training, with significant implications for cybersecurity.
For the first time in internet history, automated bots have officially surpassed human users in generating global web traffic. Data from Cloudflare Radar indicates that bots now constitute 57.5% of all HTTP requests to HTML pages worldwide, reducing human-generated traffic to 42.5%. This trend is even more pronounced in the United States, where bot traffic commands a substantial 71.5% share of domestic web requests, highlighting the deep penetration of AI-driven automation in major online markets.
The crossover point was independently corroborated by the 2025 Imperva Bad Bot Report, which also found automated traffic breaching the 50% threshold for the first time in a decade, reaching 51% of global web traffic in 2024. Cloudflare's own network, serving approximately one in five websites globally, observed the bot-to-human split at around 53% versus 47% for HTML requests by the close of 2025. Cloudflare CEO Matthew Prince noted that this shift arrived ahead of his own projections, which had anticipated bot traffic surpassing human traffic by 2027.
This surge is largely attributed to the proliferation of AI scrapers, large language model (LLM) training crawlers, and autonomous search agents powered by advanced models like OpenAI's GPT, Anthropic's Claude, and Google's Gemini. The behavior of these AI agents differs dramatically from human browsing; while a human might visit five websites for product research, an AI agent could query thousands. Consequently, AI-driven traffic saw an astonishing 187% surge in 2025, growing nearly eight times faster than human web activity during the same period.
The security implications of this bot dominance are profound. A significant portion of this automated traffic, 37%, is classified as malicious "bad bots." This influx distorts web analytics, making it challenging for publishers and advertisers to gauge genuine audience engagement. The shift necessitates a re-evaluation of how web content is accessed and monetized, as machine behavior increasingly overshadows human interaction.
In response to this evolving landscape, new frameworks are emerging. Protocols like "pay-to-crawl" are gaining traction, incentivizing content creators for the use of their data by automated systems. Cloudflare has already begun blocking AI crawlers by default unless they provide compensation to content owners. This move reflects a broader industry recognition of the need to adapt to the economic and security challenges posed by automated web access.
As AI-powered search tools, autonomous agents, and LLM pipelines continue to advance and proliferate, the balance is expected to tip even further towards automation. The concept of an "agent economy," once a future projection, is now the present reality of the internet. This fundamental change requires significant adaptations in the web's infrastructure, its monetization models, and its overall security architectures to effectively manage and secure this new era of automated online activity.