Automated traffic accounted for 53% of all internet traffic in 2025, according to the Thales (formerly Imperva) 2026 Bad Bot Report, which analyzed activity across thousands of domains and industries worldwide. Bad bots alone made up 40% of that total, up from 37% the year before, while human visitors accounted for the remaining 47%. This is the second consecutive year the report has found automated traffic outweighing human traffic on the open web.
That is not a one-year spike. Bad bot share has risen every year the report has tracked it, and the arrival of cheap, capable AI tooling has made the climb steeper, not flatter. Below is the five-year trend, which industries take the worst of it, and what actually counts as a "bad" bot in the first place.
What percentage of web traffic is bots?
53% of all web traffic in 2025 came from bots and other automated tools rather than human visitors, according to the Thales 2026 Bad Bot Report. Of that automated share, 40 percentage points were bad bots (scrapers, credential-stuffing tools, inventory hoarders, vulnerability scanners) and 13 percentage points were benign automation such as search engine crawlers and uptime monitors. It is the first time in the report's history that automated traffic has stayed above the halfway mark for two years running.
Figure 1: Bad bots have taken a larger share of internet traffic every year since 2021. Source: Imperva/Thales Bad Bot Report series, 2022 to 2026 editions.
The pace of that climb matters as much as the current number. Bad bot share grew about 3 percentage points a year in 2021 to 2023, then accelerated to 5 points in 2024 and another 3 in 2025, tracking closely with the availability of low-cost AI tooling that makes writing and running a scraper or credential-stuffing script far cheaper than it used to be.
How is web traffic split between humans, good bots, and bad bots?
In 2025, human visitors accounted for 47% of all measured web traffic, bad bots accounted for 40%, and benign, self-identifying bots accounted for the remaining 13%, per the Thales 2026 Bad Bot Report. That 13% good-bot slice covers traffic that discloses what it is, such as Googlebot, Bingbot, uptime and monitoring services, and RSS or feed readers.
Figure 2: Human visitors are now a minority of measured web traffic. Source: Thales 2026 Bad Bot Report.
A site owner reading server logs cannot assume the bulk of non-human hits are harmless crawlers. On the average site in 2025, bad bots outnumbered good bots roughly three to one, which is a very different traffic mix than the "mostly Google and Bing" assumption most small sites still operate under. Knowing that split matters directly for a privacy policy: if automated tools are submitting forms, creating accounts, or scraping pages that collect personal data, that data flow needs to be accounted for the same way a human visitor's would be.
How does a bot get classified as "bad" in the first place?
Not every non-human visitor is treated the same way. The Thales/Imperva report sorts bad bots into three sophistication tiers based on how hard they work to evade detection: simple bots that connect from a single ISP-assigned address without pretending to be a browser, moderate bots that use headless-browser software to execute JavaScript and look more legitimate, and advanced bots that emulate real human behavior like mouse movement and click timing while cycling through residential proxy IPs. The report groups moderate and advanced together as "evasive" bad bots, since both actively disguise themselves rather than just declining to identify.
Figure 3: How the Thales/Imperva Bad Bot Report classifies non-human traffic. Source: Imperva "Bad Bot Sophistication Levels" methodology.
A quarter of bad bot traffic now originates from residential ISPs rather than data centers, a tactic that makes an automated request look like it is coming from an ordinary home internet connection instead of a server farm, and complicates detection that relies on flagging known hosting-provider IP ranges.
Which industries get hit hardest by bad bots?
Retail and travel carry the heaviest bad bot load of any tracked industry. In 2024, bad bots made up 59% of all traffic to retail sites and 48% of all traffic to travel sites, both well above the 37% web average that year, according to the 2025 Imperva Bad Bot Report. Retail's exposure tracks with automated inventory hoarding and price-scraping activity around high-demand product launches and sales events; travel's tracks with fare-scraping bots that repeatedly query booking systems for price data.
Figure 4: Retail and travel traffic ran well above the web-wide bad bot average in 2024. Source: Imperva 2025 Bad Bot Report.
| Metric | Value | Year measured | Source |
|---|---|---|---|
| Bad bot share, web average | 37% | 2024 | Imperva 2025 Bad Bot Report |
| Bad bot share, web average | 40% | 2025 | Thales 2026 Bad Bot Report |
| Bad bot share, retail sites | 59% | 2024 | Imperva 2025 Bad Bot Report |
| Bad bot share, travel sites | 48% | 2024 | Imperva 2025 Bad Bot Report |
By attack volume rather than traffic share, financial services was the single most targeted industry in 2025, accounting for 24% of all bot attacks tracked in the Thales 2026 report, ahead of every other sector measured.
Is bot traffic getting worse because of AI?
Yes, sharply. AI-driven bot attacks increased 12.5 times over in 2025 compared with the year before, pushing the daily average of blocked AI-related incidents from 2 million to 25 million, according to the Thales 2026 Bad Bot Report. That growth outpaces every other category the report tracks, and it shows up even in traffic that looks legitimate on paper: more than 10% of sessions from AI "fetcher" tools (used by chat assistants pulling a page on a user's behalf) and about 9% of sessions from AI crawlers (used for training-data collection) triggered the report's bad-bot detection rules outright.
Figure 5: The last five editions of the Bad Bot Report, by the year of data each one measured. Source: Imperva/Thales Bad Bot Report series, 2022 to 2026 editions.
Most AI crawler traffic is not malicious by intent, but a growing share of it behaves indistinguishably from a scraper once it starts ignoring rate limits or robots.txt directives, which is exactly why the detection rules flag it at all. For a site owner, this means the "good bot" bucket is no longer a static, well-understood list; a privacy policy generator that gets updated as new automated-collection categories emerge is doing more real work than it was five years ago, when Googlebot and a handful of monitoring services covered nearly all the non-human traffic worth naming.
The same crawlers driving that growth are frequently the ones reshaping how people search and browse in the first place; see our look at online tracking for how third-party scripts and RTB auctions compound the exposure once a page does load for a real visitor.
The Bottom Line
Bots are no longer a minority presence on the open web. Automated traffic passed the halfway mark in 2024 and grew again in 2025, with bad bots alone now claiming 40% of all traffic, nearly triple the share held by every disclosed, good-purpose bot combined. Retail and travel sites carry a disproportionate share of that load, and AI-driven automation is now the fastest-growing slice of it, not a side effect. For most site owners the practical response is not trying to block every automated hit, which is not realistic, but knowing which categories of automated traffic are actually collecting or submitting personal data, and making sure that activity is accounted for the same way a human visitor's would be. That question sits next to two related ones worth tracking in the same research cluster: how many users actually follow through on ad-tracking opt-outs once they say they want one, and how rarely real visitors use incognito mode to try to manage that exposure themselves.
Frequently Asked Questions
What percentage of web traffic is bots? 53% of all internet traffic in 2025 was automated, with bad bots making up 40% and benign automation another 13%, according to the Thales (formerly Imperva) 2026 Bad Bot Report, based on traffic across thousands of domains and industries. Human traffic made up the remaining 47%.
What counts as a bad bot versus a good bot? A good bot self-identifies and serves a disclosed purpose, such as a search engine crawler or an uptime monitor. A bad bot hides or fakes its identity to scrape content, test stolen credentials, buy up inventory, or scan for vulnerabilities. Thales' 2026 report sorts bad bots into three sophistication tiers: simple, moderate, and advanced, the latter two grouped together as evasive bots.
Which industries see the most bot traffic? Retail saw bad bots make up 59% of its traffic and travel sites saw 48%, both well above the 37% web average, according to the 2025 Imperva Bad Bot Report covering 2024 data. Financial services was the single most targeted industry by attack volume in the 2026 report, accounting for 24% of all bot attacks.
Are AI crawlers making bot traffic worse? Yes. AI-driven bot attacks increased 12.5 times over in 2025, pushing the daily average of blocked AI-related incidents from 2 million to 25 million, per the Thales 2026 Bad Bot Report. More than 10% of AI fetcher sessions and about 9% of AI crawler sessions triggered bad-bot detection rules outright.
Where the Numbers Come From
- Thales. (2026). "2026 Bad Bot Report: Bad Bots in the Agentic Age." Automated traffic 53% of all internet traffic in 2025 (bad bots 40%, benign automation 13%); AI-driven bot attacks up 12.5x; financial services 24% of bot attacks; United States 59% of bot attacks.
- Imperva. (2025). "2025 Bad Bot Report." Automated traffic 51% of all internet traffic in 2024, bad bots 37%; retail traffic 59% bad bots, travel traffic 48% bad bots; 13 trillion bad bot requests blocked across tracked domains.
- Imperva. (2024). "2024 Bad Bot Report" press release. Automated traffic 49.6% of all internet traffic in 2023, bad bots 32% (up from 30.2% in 2022); a quarter of bad bot traffic originates from residential ISPs.
- Imperva. (2023). "2023 Bad Bot Report." Bad bots 30.2% of all internet traffic in 2022, up from 27.2% in 2021; total automated traffic 47.4% in 2022.
- Imperva. "Bad Bot Sophistication Levels." Methodology for the simple, moderate, and advanced (evasive) bad bot classification tiers used across the report series.
Note: All figures verified as of July 2026. The Bad Bot Report is Thales' (formerly Imperva's) annual measurement, now in its 13th year, and each edition covers the prior full calendar year; the 2026 edition covering 2025 data is the freshest available. This post will be refreshed when the next edition publishes.
