SignalBridge
How much web traffic is automated in 2026?
Between about 26.5% and 64%, depending on what is counted and where it is measured. In its last-7-days view on October 7, 2026, Cloudflare Radar classified 64% of HTML page requests as automated but 39.5% of all HTTP requests, and Thales put bots at 53% of traffic across 2025. The numbers answer different questions, so none of them is the bot rate.
This page collects the figures from each primary publication, shows what each one counts, and explains what they do and do not tell an advertiser. Every figure links to its publication in Sources and methodology, and the date at the top shows when we last re-checked it.
Measured figures at a glance
| Measure | Automated share | Period | What it counts | Evidence type |
|---|---|---|---|---|
| Cloudflare Radar, HTML page requests | 64% (36% human) | Last 7 days, read Oct 7, 2026 | Requests for web pages across Cloudflare's network | Network measurement |
| Cloudflare Radar, all HTTP requests | 39.5% (60.5% human) | Last 7 days, read Oct 7, 2026 | Every request, including API calls and assets | Network measurement |
| Cloudflare Radar, HTML page requests, earlier reading | 57.4% (42.6% human) | Week to Jun 5, 2026 | Requests for web pages across Cloudflare's network | Network measurement, as reported by NBC News |
| Thales (Imperva) Bad Bot Report | 53% (40% bad bots, 13% benign; 47% human) | Full year 2025 | Traffic observed by Thales across its customers | Vendor measurement |
| DataDome State of Bot and Agent Security | About 26.5% (bots and AI agents) | Jul 2025 to Jun 2026 | Requests on 75,000+ customer sites, after CDN filtering | Vendor measurement |
What does "bot" mean in these figures?
Every source counts non-human requests, but each draws the line differently. Cloudflare Radar treats a request as automated when its bot score is between 1 and 29, which covers search crawlers, monitoring tools, scrapers and AI agents, good and bad. Thales and DataDome split the total into bad bots, benign automation and, for DataDome, AI agents.
A bot in these figures is therefore not the same thing as fake traffic or wasted ad spend. A search engine crawler is a bot, and so is a price scraper, a monitoring service or an AI assistant fetching a page for a user.
Why do the bot traffic figures disagree?
They measure different populations, different request types and different periods, so they are not supposed to match. Cloudflare's two October readings differ by 24.5 percentage points (64% minus 39.5%), and the setting that changes between them is which requests are counted.
| Source of difference | Example | What to check |
|---|---|---|
| Content type | Radar shows 64% for HTML pages and 39.5% for all HTTP requests in the same last-7-days view | Radar's default view counts HTML pages and excludes API calls, asset requests and other machine-to-machine traffic |
| Where it is measured | DataDome measures traffic that has already passed through a CDN on its customers' sites | About 60% of DataDome customers sit behind a CDN with basic bot filtering, and DataDome calls its figure a conservative lower bound |
| Whose traffic | Cloudflare's network, Thales' customers and DataDome's customers are three different sets of sites | Sites that pay for bot protection may attract, or already expect, more automated traffic than the wider web |
| Period | 7 days, a calendar year and a 12-month window | Compare readings only when the window and the content type match |
| Definition | Radar counts all automation, Thales separates bad from benign bots, DataDome adds a separate AI agent class | Check whether good bots and AI crawlers are included before comparing |
Radar's June reading of 57.4% and its October reading of 64% both describe HTML page requests, so they can be compared. The difference is 6.6 percentage points, but each is a single 7-day window, and Cloudflare's chief executive described the June data as a bit messy, so we do not treat it as a measured trend.
How much of the automated traffic comes from AI?
AI bots made up 5.9% of HTML page requests in Radar's last-7-days view on October 7, 2026, and mixed-purpose crawlers another 3.9%, while non-AI bots made up 54.3%. Of all automated HTML requests, AI bots were therefore about 9.2%, which means most of the automated share is not AI.
| Client type | Share of HTML requests | Share of automated requests (calculated) |
|---|---|---|
| Non-AI bot | 54.3% | 84.7% |
| AI bot | 5.9% | 9.2% |
| Mixed purpose | 3.9% | 6.1% |
| All automated | 64.1% | 100% |
| Human | 35.9% | Not applicable |
The 57.4% figure that circulated in June includes AI crawlers and agents, but they are a minority of it. Radar's chart does not split the non-AI group further, so we cannot say how much of it is search crawling, monitoring, scraping or security scanning.
Other sources point the same way on growth rather than share. DataDome measured AI agents at 1.25% of requests on its customers' sites between July 2025 and June 2026, and AI agent and LLM crawler traffic grew 82.3% over that period. AI requests to login pages rose from 11.9 million in January 2026 to 99.7 million in June. Thales counted a 12.5 times increase in AI-enabled bot attacks, and 20% of them targeted retail sites, the most targeted industry.
Does bot traffic reach your analytics and ad platforms?
Only part of it does, and the share is lower than the request share. A bot becomes a pixel event only when it runs your page's JavaScript, so crawlers that fetch pages without a browser and bots that call APIs directly never fire a tag. We found no source that measures the share of pixel events, conversions or paid clicks that come from bots.
Two figures show why filtering by user agent is not enough. Thales reports that 27% of bot attacks targeted API endpoints, which never load a page, and that 41% of bad bot traffic declared itself as Chrome. Advanced and moderate bots made up 58% of its 2025 bot attacks, and the other 42% were simple. DataDome adds that browser-side signals can be suppressed or imitated, and that requests aimed at APIs, mobile endpoints or server-side services may never execute client-side code.
The platforms apply their own filters, and none of them removes everything:
| Layer | What it filters | What stays |
|---|---|---|
| Google Analytics | Known bots and spiders, identified from Google research and the IAB list, are excluded automatically | Unknown bots, and the amount excluded cannot be seen |
| Google Ads | Invalid clicks, impressions, interactions and conversions found before the end of the billing cycle are removed from billing and reports | Bots that reach your site after the click, and invalid traffic found later, which is credited instead |
Google states that its filters run after an ad is served, so they cannot stop bots from visiting your site, and that bots or people can still submit forms even when Google marks the ad interaction as invalid. Its reports can therefore show fewer clicks than your website analytics records as visits. Neither document describes a filter for events that you send to other platforms yourself, so whether bot events are removed before forwarding depends on your own setup.
How do bots distort conversion rate and CPA?
In opposite directions. Bots that never convert inflate your sessions and lower your measured conversion rate, while fake conversions inflate your conversion count and make your reported CPA too low. Both follow one formula: if a share x of a count is not real, the real figure differs from the reported one by 1 divided by (1 - x), minus 1.
Bot sessions first. A store records 10,000 sessions and 200 orders, a 2.00% conversion rate. If bots that never buy are part of those sessions:
| Bot share of recorded sessions | Human sessions | True conversion rate | Reported rate understates by |
|---|---|---|---|
| 10% | 9,000 | 2.22% | 11.1% |
| 20% | 8,000 | 2.50% | 25.0% |
| 30% | 7,000 | 2.86% | 42.9% |
| 40% | 6,000 | 3.33% | 66.7% |
Now fake conversions. An account reports a $40 CPA. If a share of the reported conversions came from bots, such as fake leads:
| Fake share of reported conversions | Real CPA | Real CPA is higher by |
|---|---|---|
| 5% | $42.11 | 5.3% |
| 10% | $44.44 | 11.1% |
| 20% | $50.00 | 25.0% |
| 30% | $57.14 | 42.9% |
The inputs in both tables are examples, not measurements, and the hard part is knowing your own shares. Ad blockers push the other way: if blockers hide a share h of your conversions from the pixel, your reported CPA is the real CPA divided by (1 - h), as shown in our state of conversion tracking report. Because the two effects offset each other, the net effect on your numbers depends on your traffic.
How much ad spend do bots waste?
No source we could verify publishes a bot or invalid click rate for Google Ads or Meta, so the honest answer is that it is unknown. Google says there is no industry standard for a normal invalid traffic rate, and that it removes invalid traffic found before billing, so those clicks are not charged.
The published rates cover other inventory. Pixalate measured invalid traffic of 23% for web, 36% for mobile apps and 21% for connected TV in global open programmatic advertising in Q4 2025, which does not describe search or social clicks. Juniper Research forecast in 2023 that 22% of online ad spend, about $84 billion, would be lost to ad fraud that year, and $172 billion by 2028. That is an analyst forecast, and the press release was distributed by a fraud detection vendor, so we do not treat it as a measured loss. The benchmark report has the method for both.
The waste that matters to an advertiser is the clicks that were non-human, billed and not credited. If a share w of the clicks you paid for were of that kind, the waste is your ad spend multiplied by w, at an equal cost per click. At $10,000 of spend, each 1% of billed clicks is $100. Google's "Invalid clicks" column shows what it filtered, which you did not pay for, so it is not a measure of your waste.
How can you measure your own bot exposure?
Compare three counts for the same period and segment: clicks in the ad platform, sessions in your analytics, and requests in your server or CDN logs. Your own gap is the only figure that applies to your audience, and the segment with the largest gap is a better lead than the total.
| Step | What to do | What it tells you |
|---|---|---|
| 1 | In Google Ads, add the "Invalid clicks" and "Invalid click rate" columns to your campaigns table | What Google filtered, which you were not charged for |
| 2 | Check the "Invalid activity" adjustments in billing, and the Invalid Activity Credit Report | Invalid traffic Google found after billing and credited |
| 3 | Compare ad platform clicks with landing page sessions by campaign | Where clicks never become sessions |
| 4 | In your backend, look for leads with repeated emails or addresses, or timing that is not plausible | Fake conversions that platforms may have counted |
| 5 | Compare backend orders with the conversions each platform reports | Gaps in both directions |
Gaps have several causes. Ad blockers, slow pages, consent choices and bot filtering can each widen or narrow the difference between clicks and sessions, so treat a gap as a place to investigate, not as a bot rate. Our Google Ads bot traffic audit walks through the account-level checks, and bot filtering removes known bot events before they are forwarded to ad platforms.
Why do other bot traffic articles show different numbers?
They often mix denominators or repeat figures that were never sourced. Four patterns explain most differences we found while correcting our own pages.
| Pattern | Example | How to check |
|---|---|---|
| Edge share read as ad click share | Cloudflare's share of HTML requests quoted as the share of paid clicks that are bots | Radar counts requests to all kinds of sites, not ad clicks |
| Bad bots read as all non-human traffic | Thales' 40% bad bot share quoted as the whole non-human share | Thales' total automated share is 53%, and 40% is its bad bot part |
| Vendor customers read as the web | DataDome's 26.5% quoted as the bot share of the internet | It covers sites that buy bot protection, behind CDN filtering |
| Forecast read as measurement | Juniper's 2023 forecast of $84 billion quoted as a 2026 loss | It is a forecast for 2023 |
We also found rates with no origin, such as bot shares by ad platform or industry and percentage CPA increases attributed to bots. We searched for a primary source for each and found none, so this page does not repeat them.
Frequently Asked Questions
What percentage of web traffic is bots?
It depends on the source. Cloudflare Radar showed 64% of HTML page requests and 39.5% of all HTTP requests as automated in its last-7-days view on October 7, 2026, Thales measured 53% for 2025, and DataDome measured about 26.5% on its customers' sites. Compare figures only when the content type, period and population match.
Does the 57.4% bot figure include AI scrapers?
Yes, but they are a minority of it. In Radar's last-7-days view on October 7, 2026, AI bots were 5.9% of HTML requests and mixed-purpose crawlers 3.9%, while non-AI bots were 54.3%. The June 2026 reading of 57.4% covered the same HTML page requests, and Cloudflare's chief executive called that data a bit messy.
Why does Cloudflare show both 39.5% and 64%?
Radar's bot and human percentage can be viewed for all HTTP requests or only for HTML page requests, and the two differed by 24.5 percentage points on October 7, 2026. The default view counts HTML pages, which Cloudflare says represents traditional web traffic by excluding API calls and asset requests.
Do bots fire the Meta Pixel or Google tag?
Only bots that run your page's JavaScript can. Crawlers that fetch pages without a browser, and bots that call APIs directly, never execute a tag, and we found no source that measures how many pixel events or conversions come from bots. Check your own data by comparing clicks, sessions and backend orders.
How much of my ad spend goes to bots?
No source we could verify gives a rate for Google Ads or Meta clicks. Google removes invalid traffic it finds before billing and credits what it finds later, and it says there is no industry standard for a normal invalid traffic rate. The "Invalid clicks" column shows what it filtered, which you were not charged for.
Does server-side tracking remove bot traffic?
No. Sending events from a server changes where they are sent from, not who triggered them, so bot events are removed only if your setup filters them before forwarding. Google Analytics excludes known bots in its own reports, and Google documents no equivalent for events you send to other platforms.
Sources and methodology
Primary sources
- Cloudflare Radar, Bots (Last 7 days, read October 7, 2026): 39.5% bot and 60.5% human share of all HTTP requests.
- Cloudflare Radar, AI Insights (Last 7 days, read October 7, 2026): HTML page requests by client type, with 54.3% non-AI bot, 35.9% human, 5.9% AI bot and 3.9% mixed purpose.
- Cloudflare Radar docs, Glossary: bot versus human traffic definition and the default HTML content view.
- Cloudflare Radar docs, Bot classes: bot scores of 1 through 29 are likely automated and 30 or above likely human.
- NBC News, Bot web traffic has overtaken human web traffic, data shows (June 4, 2026): the 57.4% and 42.6% reading and the chief executive's comment that the data is messy.
- Thales, 2026 Bad Bot Report: 53% automated, 40% bad bots, 13% benign, 47% human, API targeting, Chrome impersonation, attack sophistication and AI-enabled attack growth, all for 2025.
- Help Net Security, DataDome report on growing bad bot traffic (September 23, 2026): about 26.5% of traffic from bots and AI agents, growth rates and the limits of browser-side signals.
- PPC Land, Full bot protection drops to 2.4% of popular websites, DataDome finds (September 26, 2026): the 1.25% AI agent share, AI requests to login pages, CDN filtering caveat and the week-ending June 5 Radar comparison.
- Google Ads Help, About invalid traffic: filtering before billing, credits, the "Invalid clicks" column and the absence of an industry standard rate.
- Google Analytics Help, Known bot-traffic exclusion: automatic exclusion of known bots and spiders.
- Pixalate, Q4 2025 North America Invalid Traffic (IVT) and Ad Fraud Benchmarks (March 9, 2026): invalid traffic rates in open programmatic advertising.
- Juniper Research, ad fraud study press release (September 26, 2023): the 2023 and 2028 forecasts.
How we verified the figures
- Every figure was read from the publication named in the table or, for DataDome, from independent coverage of its report. DataDome's own report page did not open for us, so its figures are second-hand.
- Cloudflare Radar updates continuously. The October readings are 7-day windows that we read on October 7, 2026, and they will have moved by the time you read this. Use the links to see the current values.
- Calculated values use only the inputs shown: automated shares are each client type divided by 64.1%, the 24.5 and 6.6 point differences are subtractions, and the tables of true conversion rate and real CPA divide by (1 - x).
- Evidence types are our labels: network measurement means requests counted on the publisher's own network, and vendor measurement means a company that sells related tools published it.
Limitations
- Most sources sell bot protection or have an interest in the topic. Thales and DataDome sell detection, Pixalate sells ad fraud measurement, and Cloudflare sells bot management.
- Radar measures requests on Cloudflare's network, and the Thales and DataDome figures describe customers of those vendors, so none of them is a census of the web.
- DataDome's report was noted by PPC Land to contain internal inconsistencies about its scale, and DataDome states that attack figures count attempts, not successful attacks or financial loss.
- The conversion rate and CPA tables use assumed inputs and show arithmetic, not measured effects.
Corrections and updates
- October 7, 2026: Rewritten from the version published July 9, 2026. The earlier version presented its figures as an analysis of aggregate store data, and we could not trace them to a primary source or reproduce them from published data, so we removed them. They were: bots at 18-32% of paid ad clicks, and 14-27% in 2024; $42 billion lost to bot-driven ad fraud; $1,200-$4,800 per month wasted by the average Shopify store; bot click rates by platform (Meta 22-35%, Google Display 18-28%, Google Search 8-12%) and by industry; the 47.2% automated share of web traffic and its +3.1% change; the rates for e-commerce visits, conversion events and form submissions; the shares of bot traffic by source and region; the detection rates attributed to Meta, Google and TikTok; the claim that server-side filtering removes 85-95% of bot traffic; the 15-30% higher CPA for stores that do not filter; the before and after improvement table; and the forecasts for 2027.
- October 7, 2026: Other pages quoted 38-42% of web traffic as non-human and credited it to Imperva. Imperva's 2026 report measures 53% automated traffic and 40% bad bots, so we corrected those pages to the sourced figures.
Related Articles
How to Audit Your Google Ads for Bot Traffic (Step-by-Step Guide)
Audit your Google Ads account for bot traffic: check invalid clicks, conversion timing, placements, locations and Smart Bidding trends, then filter bot events server-side.
Ad Blocker Usage Statistics 2026: Users, Rates by Country and Tracking Impact
Sourced 2026 ad blocker statistics: 1.1 billion users, a 30% global rate, 54 countries compared across two datasets, and what blockers do to ad tracking.