Short answer: about half of all web traffic is now bots, not people. Two independent network operators agree on it: Imperva measured 53% bots and 47% human for 2025, and Cloudflare’s own data independently puts humans at the same 47%. For your website that isn’t an abstraction — bots burn the same CPU, bandwidth and database your real customers need, they hammer your forms and admin login, and most of them never show up in Google Analytics. On a cheap, oversold server, a single bot wave is enough to slow the site for actual visitors. Here’s what’s really going on and what to do about it.
We run managed hosting and watch this at the server level, so here’s the practical version.
The number, from the people who actually measure it
There’s no neutral, government count of bot traffic — the only parties who can measure it are the networks the traffic flows through. Two of the biggest land in the same place, independently:
- Imperva (Bad Bot Report 2026): “more than 53% of all web traffic in 2025… Human activity has declined to just 47%.”
- Cloudflare (Radar 2025 Year in Review): “human traffic generated 47% of HTML requests, and non-AI bots generated 44%” — with AI crawlers on top of that.
Both sell security and run CDNs (the networks that deliver sites worldwide), so treat these as self-reported telemetry from their own networks, not an audit. But two rival networks, using different methods, arriving at the same 47%-human figure is about as solid as a number like this gets. Cloudflare also notes the split moves around through the year — at times humans pulled back ahead — so “roughly half” is the honest shape, not a fixed 53.00%.
Not all bots are the bad kind
“Bot” doesn’t automatically mean “attack.” Roughly:
- Good bots: search engines (Googlebot alone was 4.5% of Cloudflare’s HTML requests), AI crawlers (bots that comb sites for AI training data; around 4.2%), uptime monitors. You want most of these.
- Bad bots: scrapers copying your content and prices, bots trying stolen passwords against your login, spam bots filling your forms, scanners probing for an unpatched plugin.
The good ones you let through; the bad ones you filter. The problem is that on a basic host, nobody is sorting them — they all just land on your server.
Why this is a hosting problem, not only a security one
Every one of those bots costs you the same resources a paying customer would:
- CPU and database: a scraper crawling every page, or a scanner hitting hundreds of URLs, burns processor time and database queries.
- Bandwidth: crawlers fetch whole sites systematically, re-fetch them for updates, and pull files a real visitor never opens.
- The tipping point: on a cheap, oversold server with no spare capacity, one bot wave is enough to slow the site for actual humans — the bots win the CPU, your customer waits.
Why you don’t see it in Google Analytics
Here’s the catch: most analytics (Google Analytics, and any JavaScript-based tracker) only count visitors whose browser runs their script. Most bots don’t run JavaScript — so they’re invisible in that dashboard. Your traffic looks clean while half the real load on the server is bots. The only place they show up honestly is the server’s own logs. (Our own analytics, Pulse, is built to surface AI-bot hits straight from server logs for exactly this reason.)
What actually helps
- Decide who’s allowed. Let the search and AI crawlers you want through; block or rate-limit the rest. (We covered which AI bots to allow or block separately.)
- Filter at the server, not in the page. Fail2ban, rate limits and firewall rules stop bad bots before they ever reach PHP or the database — a plugin can’t.
- Keep headroom. The bots are coming regardless; the question is whether the server has spare capacity to absorb a wave without dropping your real visitors.
The honest version
You can’t make bots go away — they’re half the internet now, by two independent measurements. What you can do is not host on a box where they compete head-to-head with your customers for the last slice of CPU. On our managed hosting we run servers with real headroom (no overselling), filter bad bots at the server level with Fail2ban and rate limits, and let the search and AI crawlers you actually want through. Half your traffic being non-human is fine — as long as it isn’t slowing down the half that pays.