What percentage of internet traffic is bots? 2026.

Bots made 53% of all web traffic in 2025, up from 51% in 2024, according to the 2026 Thales Bad Bot Report. Bad bots alone made 40% and good bots 13%, so there were 3.1 bad bot requests for every good one. In 2016, the same report's chart puts the split at 20% bad and 19% good: roughly one to one. Humans have dropped from 61% of traffic to 47% over that decade.

On a small website that shift looks like a contact form full of junk, a login page hammered with leaked passwords, or spam to an address left in plain HTML. A CAPTCHA or a blocklist catches the crude bots and annoys people, while the bots that matter run real browsers.

This page answers what percentage of internet traffic is bots with numbers from the vendors who measure it, and explains why they disagree. Every number links to its publisher. Cite freely with a link.

Bot traffic statistics at a glance

What percentage of internet traffic is bots?

Bots made 53% of all web traffic in 2025, according to the 2026 Thales Bad Bot Report, now in its 13th annual edition. Other vendors measure smaller or larger shares because they see different customers and count different things.

The honest answer is "between a third and a half, depending on whose network you ask." Thales counts traffic to sites that bought bot protection, which skews toward targets, and F5's 10% is low because its bots are already blocked. For one number, use 53% and name Thales; for a neutral middle, use Cloudflare's near even split.

The next question is whether that share is still climbing, and the year-by-year data says it is.

How has bot traffic changed by year?

Bot traffic has grown in almost every year of the Thales series: bad bots rose from 20% of web traffic in 2016 to 40% in 2025, while the human share fell from 61% to 47%.

Source: Thales Bad Bot Report, April 2026, chart "Global internet traffic profile between 2015 and 2025". Values are rounded as charted; the 2015 column sums to 96%, and the 2025 Imperva release gave 32% for bad bots in 2023 where this chart shows 33%.

Barracuda is the one series that points down, and we don't read it as good news. Fewer requests from more distinct bad clients is what you'd expect when attackers spread their traffic thin to stay under rate limits. The volume numbers from Radware and Thales agree with each other: AI made simple automation cheap, and cheap automation scales.

Rising totals also hide a change in the mix between good and bad bots.

How much bot traffic is good vs bad?

Bad bots outnumber good bots by about three to one: Thales measured 40% bad and 13% good bot traffic in 2025, and Akamai found 65% of the bots on its network were malicious in 2024.

Most "good" bot traffic is one company: Google. Everything else that crawls you needs to prove it deserves the bandwidth. The Chrome number is the one we'd put on a wall. If 41% of bad bots claim to be the browser your customers use, a user-agent check filters out almost nothing that matters.

AI crawlers sit on the line between good and bad, and one kind of AI crawling grew more than 15x in 2025.

How much web traffic comes from AI crawlers and agents?

AI bots made 4.2% of the HTML requests Cloudflare saw in 2025, and Googlebot, which crawls for both search and AI, made another 4.5%. AI traffic is still a small slice of all requests, but parts of it are growing fast.

The crawl-to-refer ratio explains why so many sites now block AI crawlers. Anthropic's crawlers took tens of thousands of pages for every visitor they sent back, and OpenAI's peaked at 3,700. Blocking isn't always right, since being cited by an assistant has value, but you should know which AI bots read your pages and what you get back.

AI crawling is not spread evenly, and neither is bad bot traffic. The industry data shows where it lands.

Which industries get the most bot traffic?

Telecom and ISP websites carry the highest share of bad bot traffic, at 62% of all their traffic in 2025, according to Thales; financial services attracts the most bot attacks by volume, with 24% of all attacks.

Source: Thales Bad Bot Report, April 2026, chart "Bot traffic by industry". The chart covers 19 industries; we show 11, including the highest (Telecom and ISPs) and the lowest (Law and government).

Notice that non-profits rank second for bad bot share. That fits what we see from small sites: donation and contact forms are soft targets, nobody runs a fraud team, and a bot that tests stolen cards or posts spam pays no price. Big targets get the attacks; small targets get the background noise, and noise is most of their traffic.

Much of that noise is scraping, which is the most common thing bots do once they arrive.

How common is web scraping by bots?

Scrapers made over half of all web content page requests in F5 Labs' 2025 analysis, and content scraping rose 47.7% on the previous year.

The Wikimedia split is worth remembering: 35% of pageviews, 65% of the expensive traffic. Scrapers don't browse like people. They pull the old, uncached pages and large files, which is why they cost more than their share of visits suggests. If your hosting bill rises while analytics stays flat, check the bots before you check the marketing.

Scrapers read pages. The next group tries to log in.

How many login attempts are credential stuffing bots?

Bots make 94% of all login attempts on Cloudflare's network, and 63% of logins use credentials already compromised elsewhere, according to Cloudflare's 2026 Threat Report.

Read the two Cloudflare numbers together: bots are 30% of requests overall but 94% of login attempts. A login page is a bot magnet in a way a blog post is not. A better CAPTCHA won't fix that. Refusing to accept a reused password on its own will, which is why Microsoft says phishing-resistant multi-factor authentication blocks over 99% of identity-based attacks.

Login forms are only one kind of form. Contact forms and published email addresses attract their own class of bot.

Which bots harvest email addresses and fill in forms?

Email harvesters made 2.67% of visitors to Project Honey Pot's trap pages as of November 2026, and the project has identified 916,108 of them since it began. An address they collect gets an average of about 912 spam messages.

Harvesters are the oldest bots on the web and still the cheapest to beat. Most of them read raw HTML and match an email pattern; they don't run JavaScript. That's why an old trick, hiding the address until a script runs, still stops nearly all of them, and why we built Email Protector to turn an address into a snippet that only appears after the page runs. Forms are harder, since a form bot can run a full browser, and that is the problem we're working on next.

If you publish an address on a site, our free encoder does the conversion in your browser. For the form side, our contact form spam statistics collect what's measured about junk submissions, and the WordPress security statistics cover the platform most of those forms run on.

How we calculated the original numbers

Four figures here are our own arithmetic on published numbers.

1. 3.1 bad bots per good bot in 2025, up from about 1 to 1 in 2016. The 2026 Thales Bad Bot Report puts bad bots at 40% and good bots at 13% of 2025 web traffic: 40 / 13 = 3.08. The same report's ten-year chart shows 20% bad and 19% good in 2016: 20 / 19 = 1.05. Same publisher, same method, so the ratio compares like with like.
2. About 47 billion bot requests blocked per day. Thales says it blocked 17.2 trillion bot requests in 2025. 17.2 trillion / 365 = 47.1 billion a day, or about 545,000 a second. This is one vendor's customer base, not the whole internet.
3. 1,042 spammers down to about 42. In Spencer Mortensen's honeypot test (article updated November 2026), a plain-text address with no protection blocked 0% of 1,042 spammers, so all of them reached it. HTML entities blocked 96%: 1,042 x 0.04 = 41.7, about 42 spammers still got through. Every JavaScript method in the test blocked 100%, so none did.
4. Financial services takes 1.9x its share of attacks in account takeover. Thales reports financial services drew 24% of all bot attacks and 46% of account takeover incidents in 2025: 46 / 24 = 1.92.

What the 2026 numbers say

Bots passed humans, and the bad ones are pulling away. The longest series has humans at 47%. The bigger change is inside the bot half: good bots shrank while bad bots doubled their share in nine years.

AI crawling is small in share and large in cost. At 4.2% of HTML requests, AI bots don't dominate traffic, but some of them take thousands of pages per referral and hit the expensive, uncached parts of a site. Expect more sites to block or charge for them in 2027.

The cheapest targets are forms and addresses. Login attempts are 94% bots, harvesters still sweep pages for plain-text addresses, and form spam splits across sign-up and contact forms. That's where small sites are weakest, and where simple measures like encoding an address or adding multi-factor authentication still stop most of the volume.

FAQ

What percentage of internet traffic is bots in 2026?

53% of web traffic was made by bots in 2025, according to the 2026 Thales Bad Bot Report published in April 2026. Bad bots made 40% and good bots 13%, leaving humans at 47%. Cloudflare's 2025 data shows a near even split, with humans at 47% of HTML requests in December 2025.

Is bot traffic increasing every year?

Mostly yes. The Thales series shows bad bot traffic rising from 20% in 2016 to 40% in 2025, and Radware measured 91.8% growth in bad bot transactions in 2025. Barracuda is the exception: its measured bad bot share fell to 24% in 2024, though the number of distinct bad bots rose.

How much traffic comes from AI bots?

4.2% of HTML requests came from AI bots in 2025, according to Cloudflare Radar, with Googlebot adding another 4.5%. Fastly found crawlers make almost 80% of AI bot traffic, and Meta alone sends 52% of AI crawler traffic.

What share of login attempts are bots?

94% of login attempts originate from bots, according to Cloudflare's 2026 Threat Report, and 63% of logins involve credentials compromised elsewhere. Verizon's 2025 DBIR found credential stuffing made a median 19% of daily authentication attempts at 2,301 organisations.

How do spam bots find email addresses?

Harvester bots crawl web pages and copy anything that looks like an email address. Project Honey Pot has identified 916,108 of them, and an address they collect receives about 912 spam messages on average. In a honeypot test updated in November 2026, encoding an address with HTML entities blocked 96% of spammers and JavaScript methods blocked all of them.

Which industry has the most bot traffic?

62% of telecom and ISP website traffic came from bad bots in 2025, the highest of any industry, according to Thales. Financial services draws the most attacks by volume, with 24% of all bot attacks and 46% of account takeover incidents.

Sources

1. Thales, 2026 Bad Bot Report: Bad Bots in the Agentic Age (PDF) (April 2026)
2. Thales, AI-driven Bot Attacks Surged 12.5x According to Thales Bad Bot Report (April 2026)
3. Thales / Imperva, 2025 Imperva Bad Bot Report press release (April 2025)
4. Cloudflare, The 2025 Cloudflare Radar Year in Review (December 2025)
5. Cloudflare, Application Security report: 2024 update (July 2024)
6. Cloudflare, Password reuse is rampant: nearly half of observed user logins are compromised (March 2025)
7. Cloudflare, Extending Cloudflare Radar's security insights with new DDoS, leaked credentials, and bots datasets (March 2025)
8. Cloudflare, Introducing the 2026 Cloudflare Threat Report (March 2026)
9. Akamai, Bots Compose 42% of Overall Web Traffic; Nearly Two-Thirds Are Malicious (June 2024)
10. Akamai, AI Bots Threaten the Foundation of Web-Based Business Models (November 2025)
11. Barracuda, Threat Spotlight: Bad bots are evolving to become more "human" (November 2024)
12. Barracuda, Threat Spotlight: The good, the bad, and the "gray bots" (April 2025)
13. F5 Labs, 2025 Advanced Persistent Bots Report (March 2025)
14. Fastly, New Fastly Threat Research Reveals AI Crawlers Make Up Almost 80% of AI Bot Traffic (August 2025)
15. Radware, 2026 Global Threat Analysis Report (PDF) (February 2026)
16. Verizon, Additional 2025 DBIR research on credential stuffing (2025)
17. Microsoft, Microsoft Digital Defense Report 2025 (October 2025)
18. Wordfence, 2024 Annual WordPress Security Report (PDF) (April 2025)
19. Wikimedia Foundation, How crawlers impact the operations of the Wikimedia projects (April 2025)
20. Read the Docs, AI crawlers need to be more respectful (July 2024)
21. Project Honey Pot, Statistics (live data, read November 2026)
22. Spencer Mortensen, Email address obfuscation: What works in 2026? (updated November 2026)
23. OOPSpam, 2025 Annual Spam Report (2026)

Methodology. Numbers were collected in November 2026 and checked against the original publisher's report, press release or live dataset, not against other statistics roundups. Each vendor measures its own customers' traffic, so shares differ by network and by what counts as a request; we show the measurement next to each number rather than averaging them. Stats older than 24 months are marked DATED. HUMAN Security and DataDome blocked automated access to their 2026 reports, so their figures are left out rather than cited from coverage. Last updated 14 November 2026.