Bot traffic statistics - how much of the web is bots?

What percentage of internet traffic comes from bots?

• Bots made up 53% of web traffic in 2025 in the Thales/Imperva Bad Bot Report.
• Human traffic fell to 47% of the total in that dataset.
• This is the second straight year bots have been the majority, after automated traffic first crossed 50% in 2024.
• Thales says it blocked 17.2 trillion bad bot requests in 2025.
• In Thales/Imperva’s reporting, humans are now the minority of web traffic.

This is a genuine tipping point for the web. When most observed traffic is automated, the assumptions behind analytics, security and infrastructure all shift, since many visits may come from software agents, scripts or malicious bots rather than people.

What share of bot traffic is bad bots versus other automation?

• Bad bots account for 40% of internet traffic in the Thales/Imperva report.
• Total automated traffic is 53%, leaving about 13% as non-bad automated traffic.
• That means roughly 76% of automated traffic is bad bot traffic.
• Bad bots handle scraping, account takeover, fraud, scalping and business logic abuse.
• Legitimate automation includes search crawlers, monitoring tools and some AI agents, but Thales says AI agents are now a distinct category that blurs the old good-versus-bad split.

The worrying part is the balance within automated traffic. In the headline split, roughly three-quarters of automated traffic is bad bot traffic, so the rise in bots is not simply helpful crawlers. It also reflects a growing tide of hostile or unmanaged automation aimed at businesses.

Has automated traffic overtaken human web traffic?

• Yes, automated traffic reached 53% versus 47% human.
• The crossover, first hit in 2024, held and widened in 2025.
• The shift was accelerated by AI, large language models and a new wave of AI agents, according to Thales.
• These tools have lowered the barrier to creating and scaling automated activity, including for less sophisticated actors.
• Human traffic continues to decline, per Thales.

The trajectory is the real story. Crossing 50% was symbolic, but a second straight year in the majority, with human traffic still falling, shows how fast automation is reshaping who, and what, actually uses the web.

Which industries receive the most bot attacks?

Note: industry figures come from Thales/Imperva bot-attack data and vary by sector and measurement window.

• Financial services was the most-attacked sector, drawing 24% of all bot attacks in the Thales/Imperva data.
• Business ranked second, accounting for 19% of bot attacks.
• Financial services was also the top account-takeover target, at 46% of ATO incidents.
• 27% of bot attacks targeted APIs, making APIs a major automated attack surface.
• Retail was the top sector for AI-driven bot attacks, at 20% of AI bot attacks.

The pattern follows value and APIs. In the Thales/Imperva data, financial services attracted the largest share of bot attacks and account-takeover incidents, while API-targeted attacks show how automation can bypass user interfaces and hit backend business logic directly. See our website hacking research.

How is bot traffic trending year over year?

• Bad bot traffic rose to 40%, up from 37% the year before.
• Thales says that is a 3 percentage point year-over-year increase.
• Overall bot traffic reached 53%, up from 51%, a second year in the majority.
• Human traffic keeps falling as automation takes a larger share.
• The 2026 edition is the 13th annual Bad Bot Report.

The long-term direction is upward. Across more than a decade of tracking, bad bot traffic has climbed in recent years, and the latest jump shows how AI-driven automation is adding pressure to an already-growing problem.

How is AI driving the growth of bot traffic?

• AI and LLMs have lowered the barrier to creating and scaling automated attacks.
• AI agents have emerged as a new category of internet traffic alongside good and bad bots.
• Thales tracked a jump in daily AI-driven bot attacks from 2 million to 25 million in a year, about 12.5 times.
• API-directed attacks made up 27% of bot attacks.
• Retail accounted for 20% of AI bot attacks in the Thales/Imperva data.

AI has changed the math of attacks. By making automated tooling easier to create, scale and disguise, it has increased machine-driven activity while making some attacks harder to detect, a double squeeze on defenders. See our DDoS attack research.

Sources & additional resources

• Thales. “Bad Bots in the Agentic Age: What the 2026 Thales Bad Bot Report Reveals.” Thales.
• Thales. “2026 Thales Bad Bot Report.” Thales.
• Imperva. “Bad Bot Report 2026: Bots in the Agentic Age.” Imperva.
• Imperva. “2026 Bad Bot Report.” Imperva, a Thales Company.
• Imperva Community. “The 2026 Bad Bot Report Is Here.” Imperva Community.

Web Hosting Services helps you keep bots from dragging down your site, with independent security and hosting research, current hosting deals and managed WordPress hosting with managed updates, backups, a built-in CDN, firewalls, brute-force protection and malware scanning.