How much of your website traffic is real? For the second year in a row, bots generated more web traffic than humans, and four in ten requests now come from malicious automation. This page gathers the most recent, verified statistics on bot traffic, ad fraud, fake clicks and AI crawlers in one place, with a link to the original research for every number.
Key bot traffic statistics (2026)
- Bots made up more than 53% of all web traffic in 2025, up from 51% in 2024.[1]
- AI-driven bot attacks grew 12.5x in 2025 compared with 2024.[1]
- Ad fraud is projected to cost marketers $172 billion in 2028, up from $84 billion in 2023.[8]
- One in five programmatic ad impressions (20.64%) showed signs of invalid traffic in 2025.[11]
- The global paid-click fraud rate rose to 5.58% in H1 2026, costing advertisers an estimated $25.3 billion in six months.[9]
- Mobile apps are the riskiest ad channel, with a 41% global invalid traffic rate in Q2 2026.[10]
- AI bot activity grew 300% in 2025.[5]
- When Google shows an AI summary, users click a regular result in only 8% of visits, against 15% without one.[6]
How much internet traffic is bots?
In 2025, bots generated more than 53% of all web traffic and humans only 47%, according to the Thales/Imperva 2026 Bad Bot Report. It is the second year in a row that automated traffic has outpaced humans.[1]
Who is visiting the web? Traffic mix, 2023–2025
Share of all web traffic. Good-bot share = total bots minus bad bots.
Sources: Imperva Bad Bot Reports 2024 and 2025; Thales Bad Bot Report 2026.[1][2][3] Chart: Netotraffic.
Has bot traffic been growing every year?
Yes. Bad bot traffic has risen every year since at least 2019. It grew from 30.2% of all traffic in 2022 to 32% in 2023, then 37% in 2024 and 40% in 2025.[1][2][3]
| Data year | All bots | Bad bots | Good bots* | Humans | Source |
|---|---|---|---|---|---|
| 2022 | — | 30.2% | — | — | Imperva 2024 [3] |
| 2023 | 49.6% | 32% | 17.6% | 50.4% | Imperva 2024 [3] |
| 2024 | 51% | 37% | 14% | 49% | Imperva 2025 [2] |
| 2025 | 53% | 40% | 13% | 47% | Thales 2026 [1] |
*Good bots and the 2024 human share are calculated by Netotraffic (100% minus bots, and all bots minus bad bots).
How many bots are there for every human visitor?
For every 100 human requests on the web in 2025, there were about 113 bot requests. That is roughly 1.13 bots per human.
What does Cloudflare’s network show?
Cloudflare counts web page (HTML) requests rather than all traffic, and its numbers point the same way. On December 2, 2025, humans generated 47% of HTML requests and non-AI bots generated 44%.[4]
- Cloudflare’s systems mitigated 6% of all global traffic on its network in 2025, either as potentially malicious or for customer-defined reasons.[4]
- 40% of global bot traffic came from the United States.[4]
- Amazon Web Services and Google Cloud originated a quarter of global bot traffic.[4]
What share of bots are good vs bad?
About three out of every four bots are malicious. In 2025, bad bots made up 40% of all web traffic and good bots (search engines, monitoring tools, legitimate crawlers) only about 13%.[1]
2023: 32 ÷ 49.6 = 64.5% · 2024: 37 ÷ 51 = 72.5% · 2025: 40 ÷ 53 = 75.5%
Bad bots now outnumber good bots by about 3 to 1 (40 ÷ 13 = 3.1). Good-bot traffic fell from 17.6% to 13% of the web in two years.
Which good bots crawl the web the most?
Googlebot is by far the most active legitimate bot. It produced over 28% of verified bot traffic on Cloudflare in 2025. OpenAI’s GPTBot came next at about 7.5%, followed by Microsoft’s Bingbot at 6%.[4]
Verified bot traffic by bot, 2025
Share of all verified (known, good) bot traffic on Cloudflare’s network
Source: Cloudflare Radar 2025 Year in Review.[4] Categories overlap (Googlebot is part of search engine crawlers).
Are bad bots getting more sophisticated?
They are getting both more numerous and easier to build. Imperva found that simple bad bot traffic grew from just under 40% in 2023 to 45% in 2024, which it attributes to the growing adoption of AI.[2] In ad traffic, Spider AF found that advanced, human-mimicking bots jumped from 20.4% of bot-flagged invalid traffic in January 2025 to 64.4% in June 2026.[9]
Which industries and countries get the most bot traffic?
Financial services was the most attacked industry in 2025, with 24% of all bot attacks and 46% of account takeover incidents. In 2024, travel was the most targeted sector, with 27% of all bad bot attacks.[1][2]
| Industry | Statistic | Year | Source |
|---|---|---|---|
| Financial services | 24% of all bot attacks; 46% of account takeover incidents | 2025 | [1] |
| Travel | 27% of all bad bot attacks (most targeted industry) | 2024 | [2] |
| Travel | 48% of travel-site traffic was bad bots, 47% human, 5% good bots | 2024 | [2] |
| Gaming | 57.2% of traffic was bad bots, the highest share of any industry | 2023 | [3] |
| Retail | 24.4% of all bot attacks | 2023 | [3] |
| Media and publishing | 13% of all AI bot traffic (2nd globally) | 2025 | [5] |
| Automotive (ads) | 15.49% paid-click fraud rate, the highest of any industry | H1 2026 | [9] |
Which countries have the most bad bot traffic?
In 2023, Ireland (71%), Germany (67.5%) and Mexico (42.8%) had the highest share of bad bot traffic. In the United States, 35.4% of traffic came from bad bots, up from 32.1% in 2022.[3]
Bad bot share of traffic by country, 2023
Source: Imperva 2024 Bad Bot Report.[3]
How many bot attacks target APIs and logins?
- 27% of bot attacks targeted API endpoints in 2025.[1]
- In 2024, 44% of advanced bot traffic targeted APIs, against only 10% targeting applications.[2]
- Account takeover (ATO) attacks increased by 40% in 2024.[2]
- In 2023, 11% of all login attempts across the internet were associated with account takeover.[3]
How much web traffic comes from AI bots?
AI bots (excluding Googlebot) accounted for an average of 4.2% of web page requests on Cloudflare in 2025. Googlebot alone accounted for 4.5%, which is more than all AI bots combined. AI is growing fast: Akamai saw AI bot activity surge 300% in 2025.[4][5]
- AI-driven bot attacks grew 12.5x in 2025 compared with the previous year.[1]
- AI “user action” crawling, where an AI tool visits a page because a person asked it something, grew more than 15x in 2025.[4]
- AI training crawlers made up 63% of all AI bots targeting the media industry. AI fetchers, which grab pages in real time to answer a question, made up 24%.[5]
- AI crawlers were the most frequently fully blocked user agents in robots.txt files in 2025.[4]
Do AI bots send traffic back to websites?
Very little. AI chatbots drove about 96% less referral traffic than traditional Google search in Q4 2024.[5] Cloudflare found that Anthropic had the highest crawl-to-referral ratio (pages crawled per visitor sent back) among the leading AI and search platforms in 2025.[4]
How much does ad fraud cost advertisers?
Ad fraud was projected to cost marketers $84 billion in 2023, about 22% of online ad spend, rising to $172 billion by 2028, according to Juniper Research. In the first half of 2026 alone, advertisers lost an estimated $25.3 billion to fraudulent clicks.[8][9]
| Estimate | Amount | Period | Source |
|---|---|---|---|
| Global ad fraud cost (22% of $382B spend) | $84B | 2023 | Juniper Research [8] |
| Projected ad fraud cost (23% of $747B spend) | $172B | 2028 | Juniper Research [8] |
| Share of 2028 losses in North America | 42% | 2028 | Juniper Research [8] |
| Paid-click fraud losses, first six months | $25.3B | H1 2026 | Spider AF [9] |
| Annualized losses if the H1 pace continues | $50.6B | 2026 | Spider AF [9] |
| Cost of fraud per billion unprotected CTV impressions | $1.8M | 2025 | DoubleVerify [12] |
What percentage of ad clicks are fake?
Spider AF measured a global paid-click fraud rate of 5.58% in the first half of 2026, across 4.006 billion clicks. That is up from 4.32% for full-year 2025.[9] The riskiest industries were automotive (15.49%), telecommunications (13.19%) and gaming (10.82%).[9]
How much of a $1,000 ad budget goes to fake traffic?
| Scenario (measured rate) | Invalid rate | Wasted | Real cost of a $1.00 click* |
|---|---|---|---|
| Average paid click, H1 2026 [9] | 5.58% | $55.80 | $1.06 |
| Average programmatic impression, 2025 [11] | 20.64% | $206.40 | $1.26 |
| US programmatic web, Q2 2026 [10] | 25% | $250.00 | $1.33 |
| US mobile app ads, Q2 2026 [10] | 39% | $390.00 | $1.64 |
*Real cost per genuine click = $1.00 ÷ (1 − invalid rate). Vendors measure invalid traffic differently, so treat these as ranges, not exact figures.
Is connected TV (CTV) advertising safe from bots?
Not entirely. DoubleVerify detected 140% more CTV fraud schemes in Q1 2026 than in Q1 2025, and found 10x more fraudulent CTV apps in 2025 than in 2024. In unprotected CTV campaigns fraud reached nearly 9%, against under 1% in protected ones. Only 21% of advertisers use invalid traffic as a CTV performance KPI.[12]
Which ad channels and devices have the most invalid traffic?
Mobile apps have the highest invalid traffic (IVT) rates. Globally in Q2 2026, IVT was 41% for mobile app traffic, 26% for CTV and 20% for web traffic, according to Pixalate.[10]
Invalid traffic rate by channel, Q2 2026
Global programmatic advertising
Source: Pixalate Q2 2026 IVT & Ad Fraud Benchmarks.[10]
Is desktop or mobile traffic more likely to be fake?
In programmatic advertising in 2025, desktop had the highest IVT rate (27.03%), followed by mobile (19.30%) and tablet (16.34%), according to Fraudlogix’s analysis of ad impressions.[11]
| Segment | IVT rate |
|---|---|
| All impressions (global) | 20.64% |
| Desktop | 27.03% |
| Mobile | 19.30% |
| Tablet | 16.34% |
| Asia-Pacific | 27.85% |
| United States | 23.69% |
| Europe | 7.80% |
Source: Fraudlogix Ad Fraud Statistics 2026.[11]
How much invalid traffic is there in the United States?
In Q2 2026, US programmatic IVT was 25% on desktop and mobile web, 39% in mobile apps and 25% on CTV.[10]
Does Google Analytics 4 filter out bot traffic?
Partly. GA4 automatically excludes traffic from known bots and spiders, using Google’s own research and the IAB International Spiders and Bots List. You cannot turn this off or see how much traffic was excluded.[7]
The key word is known. Declared bots like Googlebot are filtered. Bots that pretend to be real browsers are not on any list, so some can still reach your reports. If you buy traffic or run paid campaigns, check GA4 for engagement signals such as engaged sessions, scroll and time on page, not just session counts.
Related guide: How to see Netotraffic visits in Google Analytics 4.
Is AI search reducing real human clicks to websites?
Yes. Pew Research found that Google users who saw an AI summary clicked a traditional result in 8% of visits, almost half the 15% rate without a summary. Ahrefs found that AI Overviews cut the click-through rate for the #1 result by about 58%.[6][13]
- Users clicked a link inside the AI summary in just 1% of visits.[6]
- 18% of Google searches in Pew’s March 2025 study produced an AI summary.[6]
- Ahrefs’ earlier study (April 2025) measured a 34.5% drop. The newer update shows the impact has grown.[13]
What do these bot statistics mean for website owners?
With more than half of web traffic automated, raw visit counts no longer tell you much. Judge traffic by engagement and conversions, and know where every visitor source comes from.
- Check engagement, not sessions. In GA4, compare engaged sessions, average engagement time and conversions by source.
- Tag every campaign with UTM parameters so you can isolate each traffic source and spot anomalies quickly.
- Watch for bot patterns: sudden spikes from one country or data-center network, 0-second sessions, or near-100% bounce rates.
- Be careful with mobile app inventory. It has the highest measured invalid traffic rates (39–41%).
- Review your robots.txt to decide which AI crawlers you allow. AI bots crawl heavily and send back little traffic.
Want traffic you can verify?
Netotraffic delivers visitors through native ad placements, trackable in GA4 with your own UTM tags. See traffic plans or read the traffic guide.
Methodology and sources
We compiled statistics from the most recent primary research published by security, ad-verification and research organizations, and checked every figure against its original source page on October 6, 2026. Different vendors measure different networks: Imperva/Thales measure all web traffic across their customers, Cloudflare measures HTML requests on its network, and Pixalate, Fraudlogix and Spider AF measure advertising traffic. Treat figures from different sources as ranges, not direct comparisons. Calculations marked “Netotraffic analysis” are our own and show the formula used.
We update this page every year. Last update: October 6, 2026.
Use these statistics
You’re welcome to use any statistic or chart on this page in your own articles. Please credit Netotraffic with a link to this page:
Source: <a href=”https://netotraffic.com/research/bot-traffic-statistics/”>Netotraffic – Bot Traffic Statistics 2026</a>
Sources
- Thales (2026). 2026 Bad Bot Report: Bots in the Agentic Age (2025 data). Thales news release · Imperva blog
- Imperva (2025). 2025 Bad Bot Report (2024 data). imperva.com
- Imperva (2024). 2024 Bad Bot Report (2023 data). imperva.com
- Cloudflare (2025). Cloudflare Radar 2025 Year in Review. blog.cloudflare.com
- Akamai (2026). State of the Internet: Protecting Publishing – Navigating the AI Bot Era. akamai.com
- Pew Research Center (2025). Google users are less likely to click on links when an AI summary appears in the results. pewresearch.org
- Google. Known bot-traffic exclusion, Analytics Help. support.google.com
- Juniper Research (2023), reported by Marketing Brew. Advertisers will spend $84 billion on ad fraud this year. marketingbrew.com
- Spider AF (2026). First Half 2026 Ad Fraud Investigation Report. newswire.com
- Pixalate (2026). Q2 2026 Invalid Traffic & Ad Fraud Benchmarks, North America. pixalate.com
- Fraudlogix (2026). Ad Fraud Statistics 2026 (2025 data). fraudlogix.com
- DoubleVerify (2026). Global Insights: CTV fraud schemes surge 140% globally. doubleverify.com
- Ahrefs (2026). Update: AI Overviews Reduce Clicks by 58%. ahrefs.com