Bot traffic accounted for 51% of all web traffic in Imperva’s 2024 measurement, exceeding human traffic for the first time in a decade. Bad bots alone represented 37% of internet traffic, while good bots contributed 14%. These figures show why traffic analysis, crawling policy, and automated-threat detection matter to anyone managing a website.
Table of contents
- Global bot traffic share and long-term trend
- Human, good-bot, and bad-bot traffic
- Why bot traffic is harder to identify
- AI crawlers and emerging automated traffic
- Geography and industry exposure
- Account takeover and API abuse
- What the numbers mean for SEO teams
Global bot traffic share and long-term trend
Imperva’s 2025 Imperva Bad Bot Report measured automated traffic at 51% of all web traffic in 2024. Human traffic represented the remaining 49%. The 2024 result is notable because automated traffic exceeded human traffic for the first time in a decade in Imperva’s measurement.
The composition of that automated activity was also significant. Bad bots represented 37% of all internet traffic in 2024, while good bots represented 14%. In other words, automated requests were not a single category: search crawlers and other legitimate services formed a smaller share than malicious or unwanted automation.
The previous year’s figures were already close to an even split. According to Imperva’s Bots Now Make Up Nearly Half of All Internet Traffic Globally, bots generated 49.6% of all internet traffic in 2023, compared with 50.4% from human users. Bad bots represented 32% of all internet traffic in 2023 and 30.2% in 2022.
| Measurement | Human traffic | Good bots | Bad bots | Total automated traffic |
|---|---|---|---|---|
| Imperva, 2024 | 49% | 14% | 37% | 51% |
| Imperva, 2023 | 50.4% | Not stated in supplied breakdown | 32% | 49.6% |
| Imperva, 2022 | Not stated in supplied breakdown | Not stated in supplied breakdown | 30.2% | Not stated in supplied breakdown |
The longer comparison supplied by Imperva reaches back to 2015: bad bots accounted for 19% of all bot traffic that year. Because the 2015 figure is expressed as a share of bot traffic while the 2022–2024 bad-bot figures are expressed as a share of all internet traffic, these measures should not be treated as a single directly comparable series.
Human, good-bot, and bad-bot traffic
DataDome’s Bad Bot Traffic & Threat Trends 2026 provides a different view based on its customer-site dataset covering July 2025 through June 2026. Bots and AI agents together generated about 26.5% of analyzed requests. Human requests represented 73.4%, bad bots 15.4%, good bots 9.9%, and AI agents 1.3%.
These percentages describe DataDome’s analyzed customer traffic, not all internet requests. The dataset is therefore useful for understanding the mix seen by those sites, while Imperva’s global measurements provide a broader industry benchmark.
DataDome also reported a marked change during the period. The human share fell from 77.9% in July 2025 to 70.7% in February 2026. Over the same interval, bad-bot traffic rose from 9.9% to 20.3%. Across the 12-month comparison period, bad-bot traffic grew 124.0% and AI traffic grew 82.3%.
The measurement periods matter when comparing these results. Imperva’s 51% automated-traffic figure covers 2024, whereas DataDome’s 26.5% combined bot-and-agent share covers July 2025 to June 2026 and comes from a customer-site dataset. A lower percentage in one dataset does not invalidate the other; it reflects different samples, definitions, and observation windows.
Why bot traffic is harder to identify
Automation is increasingly able to resemble ordinary browser traffic. Imperva reported in its 2024 measurement that advanced and moderate bot attacks together accounted for 55% of all bot attacks, leaving simple bot attacks with 45%. In 2023, simple bots accounted for 40% of bot attacks, so the supplied figures show a larger advanced-or-moderate share in 2024.
Declared browser identity is not a reliable stand-alone signal. Chrome was the declared browser identity in 46% of bad-bot attacks in 2024, up from 40% before the 2024 increase, according to the 2025 Imperva Bad Bot Report. A request presenting a familiar browser label can still be automated.
Network origin can be similarly deceptive. Residential proxies were used in 21% of bot attacks coming through internet service providers in 2024. That makes simple rules based only on data-center addresses less complete, especially when automation is distributed across residential-looking connections.
Imperva’s 2024 Bad Bot Report classified 60.5% of bad bots as evasive in 2023. Advanced bad bots represented 48.1% of bad bots, and moderate bad bots represented 12.4%. Those categories describe bad-bot sophistication in that report’s 2023 measurement and should not be read as a universal classification for every site.
AI crawlers and emerging automated traffic
AI-related automation is now a distinct part of the bot landscape. Imperva blocked an average of 2 million AI-powered cyberattacks per day in 2024. In its analyzed set of AI-enabled attacks, ByteSpider Bot accounted for 54%, AppleBot for 26%, ClaudeBot for 13%, and ChatGPT-User for 6%.
Imperva also reported that bad bots made up more than 16% of all AI-enabled attacks in 2024. Bad bots combined with business-logic attacks made up 41% of AI-enabled attacks. These percentages refer to Imperva’s analyzed set and attack categories, not to the total volume of all AI crawler requests on the web.
DataDome reported in its 2025 Global Bot Security Report that AI bot and crawler traffic grew fourfold across its customer base in 2025 and exceeded 10% of verified bot requests in that customer dataset. Its 2025 assessment covered more than 16,900 analyzed domains, of which only 2.8% were fully protected against automated threats.
The DataDome findings point to two separate questions for site owners: how much automated traffic reaches a site, and how much of it can be identified and controlled. A crawler may be legitimate, unwanted, or part of an attack, so volume alone does not determine whether a request should be allowed.
Geography and industry exposure
Bad-bot ratios varied substantially among the countries listed in Imperva’s 2023 figures. Ireland had the highest listed ratio at 71%, followed by Germany at 67.5%. Mexico recorded 42.8%, while the United States recorded 35.4%.
Those ratios should not be confused with the share of global attacks originating from or targeting a country. Imperva’s 2024 Bad Bot Report said the United States accounted for 47% of the countries listed as most targeted by bad bots in its 2023 infographic. The Netherlands accounted for 9%, Australia 8.4%, the United Kingdom 5.1%, and France 3.1%.
Cloudflare’s 2024 Year in Review reported that the top 10 countries generated 68% of the global bot traffic it observed in 2024. This is a concentration measure for Cloudflare’s observed traffic, not a ranking of every country’s total bot activity.
Account takeover and API abuse
Automated traffic becomes especially costly when it targets authentication and application logic. Imperva’s 2023 figures show that account-takeover attacks increased 10% compared with the prior year. Account-takeover attempts represented 11% of all login attempts, and API endpoints received 44% of all account-takeover attacks.
Imperva’s industry breakdown assigned 36.8% of account-takeover attacks to Financial Services, 11.5% to Travel, and 8% to Business Services. These are shares within that 2023 industry breakdown, not estimates of the probability that an individual login attempt in one sector will become an account takeover.
Automated threats caused 30% of API attacks in 2023. Bad bots exploiting business-logic vulnerabilities represented 17% of automated API threats. The distinction matters for SEO and content teams because a site can have normal page traffic while APIs, login endpoints, search functions, or checkout flows experience a very different automated-threat profile.
DataDome’s July 2025–June 2026 dataset shows how bad-bot activity was categorized by action. Scraping represented 70.9% of bad-bot traffic, DDoS represented 12.7%, and spamming represented 7.9%. These figures describe the distribution of bad-bot traffic in that 12-month dataset; they are not a complete taxonomy of every automated threat.
What the numbers mean for SEO teams
Bot traffic statistics are most useful when the measurement scope stays visible. Global traffic shares, customer-site request mixes, attack ratios, country concentrations, and action categories answer different questions. A report covering 2024 cannot be merged casually with a customer dataset covering July 2025 through June 2026, and a bad-bot ratio cannot be substituted for a total bot-traffic share.
For search-focused sites, the clearest signal is the scale and changing character of automation: Imperva measured automated traffic at 51% of web traffic in 2024; DataDome saw bots and AI agents at about 26.5% of requests in its July 2025–June 2026 customer dataset; and AI bot and crawler traffic grew fourfold across DataDome’s customer base in 2025. Together, these findings frame bot management as both a traffic-quality and an application-security issue.
The practical exposure is also distributed across several surfaces. Scraping can affect content and competitive intelligence, account takeover can target logins, and API abuse can reach business logic without resembling ordinary page browsing. Geography and browser identity add context, but the supplied measurements show why neither is sufficient on its own: bad-bot ratios differ by country, and Chrome was the declared browser identity in 46% of bad-bot attacks in Imperva’s 2024 measurement.