In 2024, automated bots exceeded 50 percent of global internet traffic for the first time, according to the 2025 Imperva Bad Bot Report. The shift was driven by advances in AI and large language models that enable both benign and malicious bots to scale rapidly

Why Bots Have Taken Over the Web

AI tools like ChatGPT, ByteSpider, ClaudeBot, and others have significantly lowered the technical barriers for creating bots. This has led to an explosion in automation, where even non-technical users can deploy malicious bots at scale

Breaking Down the Traffic

  • 51% of all web traffic in 2024 came from automated bots—surpassing human traffic for the first time in over a decade
  • Bad bots (used for fraud, scraping, credential stuffing, and attacks) accounted for 37% of all traffic—up from 32% in 2023
  • Good bots—such as search engine crawlers and monitoring tools—made up the remainder and help index sites or monitor uptime

Industries Most Impacted

  • Travel experienced the highest share of bad bot activity at 27% of all bot attacks in 2024, increasing from 21% in 2023
  • Retail was similarly hit hard, with malicious bot traffic comprising about 59% of overall traffic in that sector
  • Other sectors like financial services, e‑commerce, and healthcare have been targeted with rising frequency, especially via API abuse and account takeover exploits

Emerging Challenges & Risks

  • Bots now use advanced evasion tactics, including mimicking human behavior, masking as mobile user agents, and leveraging residential IPs to bypass typical defenses like CAPTCHAs
  • A substantial 44% of advanced bot traffic is directed at APIs, aiming to exploit business logic and gain unauthorized access or steal data

What This Means & What Comes Next

  • The milestone of more bot than human traffic marks a turning point—web infrastructure and security must evolve rapidly to meet this challenge. Traditional defenses are no longer sufficient
  • Many experts worry about the “dead internet” scenario, where synthetic or bot-generated content overwhelms authenticity and degrades trust in online content and interactions
  • Innovations such as Cloudflare’s AI Labyrinth, which uses deceptive web pages to trap scraping bots, are emerging to help defend digital ecosystems

Conclusion

By mid-2025, automated bots now generate over 50% of global web traffic, with bad bots alone comprising 37%. AI-driven automation is fueling this transformation—and organizations must adopt advanced bot management and API protection solutions to defend infrastructure and uphold the integrity of the online ecosystem.