Bots overtake humans in web traffic, Cloudflare says
Cloudflare says bots now account for 57.5% of HTTP requests to HTML content, compared with 42.5% human traffic. The shift puts pressure on advertising, analytics, security and how companies distinguish real users from AI agents.
Summary
Cloudflare says bots now generate more web traffic than humans. According to the Forbes article, the Cloudflare Radar dashboard put bots at 57.5% of HTTP requests to HTML content, compared with 42.5% human traffic.
That is earlier than Cloudflare CEO Matthew Prince had expected. He had previously predicted the crossover would happen in 2027. The difference is the kind of automation now driving traffic: not only search crawlers or scraping bots, but AI agents that browse, compare, read and carry out tasks on behalf of users.
In practice
The commercial internet was designed around humans: pageviews, session time, ad impressions, SaaS funnels, ecommerce conversions and anti-fraud systems. When a larger share of traffic comes from software, those metrics become harder to read.
Forbes cites an example Prince gave at SXSW: a person shopping for a camera may visit five websites; an agent doing the same task may visit 5,000. For publishers and brands, that can mean more requests and higher costs without equivalent human attention, direct purchase activity or advertising revenue.
Context
The growth is not isolated. HUMAN Security reported that AI-driven traffic grew eight times faster than human traffic in 2025, while traffic from agents and agentic browsers grew 7,851% year over year. Thales/Imperva also recorded a 12.5x surge in AI-driven bot attacks and classified 40% of total internet traffic as malicious bots.
The harder problem is no longer simply deciding whether something is a bot or a human. It is understanding intent: an agent may be helping a legitimate user, collecting data for a model, abusing an API or testing credentials. Blocking everything fails; trusting everything fails too.
Why it matters
- Advertising, SEO and analytics become less reliable when machine requests dominate volume.
- Companies built around CPM, CPC or human conversion assumptions need to revisit their unit economics.
- Web security will depend more on identity, intent and behavior than on basic bot detection.
- The next critical internet layer may be authentication and permissioning for AI agents.