Cloudflare: Bot Traffic Now Exceeds Human Internet Traffic

🔑 Enhanced Key Takeaways

•The reported shift to bot-dominated traffic specifically refers to HTTP requests for HTML content, while human traffic continues to account for a larger share of total internet bandwidth, including video streaming, social media, and in-app APIs.
•The surge is primarily driven by 'agentic AI' bots, which are autonomous systems capable of navigating, interacting with, and even performing transactions on the web, such as completing online shopping checkouts or managing accounts. This category of bot traffic experienced a 7,851% year-over-year growth in 2025, distinguishing them from traditional bots like search engine crawlers.
•Geographical distribution of bot traffic varies significantly; for instance, North America exhibits a higher bot usage at 68.6% compared to human usage at 31.4%, whereas some smaller regions like the American Midwest still show higher human traffic. Gibraltar stands out as an extreme outlier, with up to 97% bot traffic during peak times.
•The increased prevalence of AI agents introduces new and intensified security threats, including a rise in scraping attacks, a quadrupling of post-login account compromise attempts, and a significant surge in carding volume, with AI agents already being utilized in such attack patterns.
•Cloudflare has introduced 'AI Crawl Control,' a feature designed to give website owners granular control over how AI companies access their content, enabling them to permit, block, or even charge crawlers based on their source or intent, aiming to foster a more equitable relationship between publishers and AI entities.

📊 Competitor Analysis▸ Show

Feature/Category	Cloudflare Bot Management	Akamai Bot Manager	DataDome	Imperva Advanced Bot Protection	Radware Bot Manager
Detection Methods	ML, behavioral analysis, heuristics, JS detections, HTTP/2 & TLS fingerprinting, event tracking, IP reputation	AI, ML models, behavioral/telemetry analysis, browser fingerprinting, automated browser detection, HTTP anomaly detection, IP reputation	AI-powered, machine learning, real-time threat intelligence	Threat detection accuracy, low false positives	Intelligent bot mitigation
Mitigation Actions	Block, allow, challenge (Turnstile), rate limit, custom responses (AI Labyrinth, Workers)	Block, allow, challenge, rate limit, serve alternative content	Identify and block malicious bot traffic	Prevents legitimate traffic from being blocked	Intelligent bot mitigation
Network Scale/Intelligence	Global network, ML trained on huge portion of Internet traffic, sees novel attacks first	Global network, analyzes "clean traffic" data across wide distribution	Cloud-based, real-time threat intelligence	-	-
Key Differentiators	Integrated into Cloudflare stack, Turnstile (CAPTCHA alternative), AI Crawl Control	High user satisfaction, instant cache purging, VCL for edge logic customization	Focus on intelligent bot protection	WAF accuracy, bot management on lower tiers, strong compliance	Intelligent bot mitigation
Target Audience	All plans (Bot Fight Mode, Super Bot Fight Mode), Enterprise for granular control	Global scale, high-traffic/enterprise workloads, API-heavy flows	-	Regulated industries	-

🛠️ Technical Deep Dive

Multi-layered Detection Engines: Cloudflare employs various detection engines, including heuristics, JavaScript detections, and machine learning, to identify different types of bots.
Heuristics Engine: Processes all requests, performing checks to identify automated traffic and matching requests against a growing database of malicious fingerprints and software library fingerprints.
JavaScript Detections (JSD) Engine: Identifies headless browsers and other malicious fingerprints by performing a lightweight, invisible JavaScript injection on the client side. It can block, challenge, or pass requests to other engines.
Machine Learning (ML) Engine: This engine accounts for the majority of detections, distinguishing between human and bot traffic. It leverages Cloudflare's global network, processing billions of requests daily, and uses a supervised ML methodology.
Bot Score (1-99): The ML system assigns a bot score to each request, representing the predicted probability that a client is human. This score is derived from input variables such as request features (headers, session characteristics, browser signals).
__cf_bm Cookie: Utilized to refine the bot score and minimize false positives for legitimate user sessions by analyzing individual user request patterns.
Passive Fingerprinting: Backend checks include analyzing HTTP/2 and TLS fingerprints, along with verifying user-agent pairs against whitelisted databases.
Active Behavioral Analysis: Event listeners track user actions like mouse movements, clicks, and keystrokes. A persistent lack of such activity can indicate bot presence.
Automated Enforcement: Based on the assigned bot score, Cloudflare can execute defined security policies, including actions like blocking, allowing, rate-limiting, or issuing challenges such as Turnstile (a privacy-preserving CAPTCHA alternative).
AI Labyrinth Beta: An advanced custom response option available for automated enforcement.

🔮 Future ImplicationsAI analysis grounded in cited sources

Web content monetization models will undergo a fundamental transformation, moving away from traditional ad-driven approaches.

AI agents consume content without generating clicks or direct traffic, rendering current ad-based revenue models less effective for publishers and necessitating new frameworks for content compensation.

Cybersecurity strategies will increasingly prioritize sophisticated behavioral analysis and AI-driven anomaly detection over traditional methods.

The growing sophistication of 'stealth bots' and AI agents that mimic human behavior demands advanced detection methods beyond basic IP reputation or Web Application Firewall (WAF) rules, pushing security solutions towards more granular behavioral fingerprinting and machine learning.

The distinction between human-generated and bot-generated content on the internet will become increasingly blurred, posing significant challenges to content authenticity and trust.

As AI agents become more autonomous and capable of human-like interactions and content creation, it will become progressively difficult to differentiate between human-created and AI-generated content, impacting the integrity of online information.

⏳ Timeline

2023-03

Cloudflare's Application Security Report indicates 30% of HTTP traffic is automated.

2023-08

Cloudflare's Q2 2023 DDoS report highlights the emergence of VM-based DDoS botnets, up to 5,000 times more powerful than IoT botnets.

2023-12

Cloudflare Radar Year in Review 2023 identifies Googlebot as the highest volume request traffic source, with one-third of global bot traffic originating from the US.

2024-12

Cloudflare Radar Year in Review 2024 reports 17.2% global internet traffic growth, with Googlebot remaining dominant and the US accounting for 34.6% of bot traffic.

2025-03

Cloudflare enhances its Bot Management with new high-precision heuristics for improved bot identification and machine learning model training.

2025-07

Cloudflare reports an 18% growth in AI and search crawler traffic from May 2024 to May 2025, with GPTBot's share significantly increasing.

2025-12

Cloudflare Radar 2025 Year in Review notes 19% global internet traffic growth, Googlebot's continued dominance, 40% of global bot traffic from the US, and the introduction of 'AI Crawl Control'.

2026-06

Cloudflare CEO Matthew Prince announces that bot traffic has officially surpassed human traffic, reaching 57.5% of global HTTP requests for HTML content.