Bots now generate 51% of web traffic, surpassing humans

With bots generating 53% of web traffic in 2025, reports from Thales confirm that automated agents have surpassed humans online. This tipping point is critical, as any metric assuming "one visit equals one person" is now built on an unreliable foundation.

How the bot traffic figure breaks down

This milestone signifies that automated software accounts for the majority of internet activity. According to industry reports, a significant portion consists of malicious 'bad bots' designed for fraud, while the remainder are 'good bots' for search indexing and other legitimate purposes. This shift fundamentally challenges the accuracy of web analytics.

The 2025 report documented 51% automated traffic with 37% bad bots; later reporting indicates bots were 53% of traffic in 2025 with approximately 40% of that being malicious. Industry reports show this trend accelerating, with AI-driven bot traffic growing significantly faster than human or conventional bot growth (HUMAN Security). Retail and travel sectors are disproportionately affected, with bad bots constituting a significant portion of traffic in these industries, with APIs being a primary target for attacks aimed at scraping prices and hoarding inventory.

The Impact on Analytics and Advertising

The prevalence of bots creates a dual crisis for advertisers. First, invalid traffic directly drains ad budgets, with studies suggesting every dollar lost to bot clicks costs three dollars in potential revenue. Second, contaminated data corrupts key business metrics. When bots infiltrate analytics, reported conversion rates, attribution models, and retargeting audiences become fundamentally flawed.

Key business impacts include:
- Ad budgets are exhausted prematurely by fraudulent impressions and clicks.
- Conversion rate data is distorted, leading to incorrect strategy adjustments.
- Audience segments for retargeting and look-alike campaigns are polluted with non-human profiles.
- Lead generation efforts are wasted on fraudulent form submissions from bots.
- Business forecasting models produce inaccurate predictions based on synthetic demand.

Rising interest in proof-of-personhood

The shift to a bot-majority web highlights a critical need for "proof-of-personhood" - verifying the human user, not just their device. Research papers outline frameworks for privacy-preserving credentials, giving each person a unique, unlinkable digital token. Projects like Worldcoin's World ID are pioneering this concept with biometrics and cryptography to distinguish humans from bots. However, these systems face significant hurdles related to accessibility, accuracy, and governance.

Defensive stack: from static filters to continuous authentication

In response, modern security strategies are moving beyond static filters toward continuous authentication. This involves combining behavioral biometrics (like typing cadence and mouse paths), device fingerprinting, and dynamic machine learning scores. Advanced platforms now monitor user interactions throughout an entire session - not just at login - and use liveness checks to identify deepfakes. This escalating arms race is shifting the paradigm from "bot detection" to "continuous human verification," a necessary evolution now that software generates most web traffic.

---

What exactly does the bot-traffic milestone mean for day-to-day web analytics?

According to industry reports, the majority of web requests are now automated, with a significant portion categorized as bad bots and the remainder being benign crawlers or monitoring services. Because most analytics stacks treat every request as a human visit, dashboards can drastically over-report sessions, bounce rates and even "add-to-cart" events. In practice, companies that do not filter bots may be optimising campaigns for traffic that delivers a 0:1 return on ad spend.

How is this majority-bot environment affecting advertising budgets right now?

Industry estimates suggest bot-driven waste costs billions globally. Analysis warns that even a conservative 3:1 ROAS assumption implies every dollar lost to an invalid click removes $3 in downstream revenue. Retailers are among the hardest hit, with bad bots constituting a significant portion of retail web traffic, and travel brands also seeing substantial bot activity. The hidden risk is budget depletion: bots can exhaust daily ad caps before real shoppers are awake, leaving campaigns dark during peak human hours.

Are there industries where the bot skew is even worse than the overall average?

Yes. Travel and retail are clear outliers. Industry data show that travel sites absorb a disproportionate share of bot attacks, with retail following closely, along with financial services and streaming media. Reports indicate that AI-driven bot traffic is heavily concentrated in retail, streaming and travel, reinforcing the pattern. If you operate in these verticals, the majority of your traffic can be heavily automated, making human-only KPIs almost meaningless without correction.

What new "proof-of-personhood" tools are emerging to counter this trend?

The most discussed approach is personhood credentials, with systems that would issue each human a single, unlinkable digital credential that proves "I am a unique person" without revealing identity. Early pilots from Worldcoin/World ID are testing iris scans plus zero-knowledge cryptography to issue such proofs on-chain. On the detection side, vendors are layering behavioural biometrics (keystrokes, mouse arcs, scrolling cadence) and continuous authentication to catch AI agents that can mimic human navigation.

How should product and marketing teams re-set their metrics given the bot majority?

1. Start with traffic audits: Use server logs or specialised bot-filtering services to segment good bots, bad bots and humans.
2. Re-baseline KPIs: Review at least 90 days of filtered data before adjusting ROAS targets, CPM bids or lifetime-value models.
3. Move to conversion-based goals: Shift budget toward campaigns that optimise for downstream revenue rather than top-of-funnel clicks.
4. Invest in liveness checks: Login, checkout or gated-content flows can quietly add frictionless proof-of-human steps like camera liveness or device fingerprinting.

Ignoring the bot majority today means tomorrow's dashboards may celebrate "record growth" while cash registers stay silent.