How Much Of The Internet Is AI Or Bots: What Data Shows

For people in the United States, the best available public data suggests that about half of web traffic comes from automated programs, not human users. Imperva reported that bots made up 49.6% of all internet traffic in 2023, while humans accounted for 50.4%.

That figure includes many kinds of bots. It does not mean that half of the internet is run by artificial intelligence. Search crawlers, monitoring tools, ad verification systems, account scanners, fraud tools, scrapers, and AI crawlers are all counted as automated traffic.

The share caused specifically by AI is much harder to measure. No trusted public source currently shows that a fixed percentage of the entire internet is “AI-generated” or “AI traffic.” The answer depends on what you mean by AI and what you count as the internet.

Quick answer: How much of the internet is made up of bots?

Bots generated 49.6% of web traffic in 2023, according to Imperva’s Bad Bot Report 2024. Humans generated the other 50.4%.

Within that automated traffic:

• Good bots performed useful or expected tasks, such as search indexing and uptime checks.
• Bad bots performed harmful or unwanted tasks, such as scraping, fraud, credential attacks, and spam.
• AI bots are only one part of the wider bot category.
• AI-generated content is a separate issue from bot traffic.

Imperva estimated that bad bots made up 32.1% of all internet traffic in 2023. Good bots made up about 17.5%.

These numbers describe traffic observed across sites using Imperva’s network and security tools. They are not a complete census of every connection, app, private network, or device in the United States.

What counts as a bot?

A bot is software that performs tasks on the internet without a person manually making every request.

Some bots are simple scripts. Others use machine learning or artificial intelligence. A bot may visit a web page, submit a form, test a password, collect prices, or check whether a service is online.

Common bot types include:

Bot type	Typical purpose	Usually helpful or harmful?
Search crawler	Finds and indexes web pages	Usually helpful
Monitoring bot	Checks uptime and performance	Helpful
Ad verification bot	Confirms that ads appear correctly	Helpful
Scraper	Copies prices, text, images, or data	Depends on use
Spam bot	Posts unwanted links or messages	Harmful
Credential attack bot	Tests stolen usernames and passwords	Harmful
AI crawler	Collects content for an AI system	Depends on permission and use
Fraud bot	Abuses accounts, payments, or promotions	Harmful

The word bot does not automatically mean “bad.” A search engine crawler is a bot, but it helps people find websites. A bot that tries thousands of stolen passwords is also a bot, but it creates a security threat.

That distinction matters when someone says, “Bots make up half of the internet.” The statement describes automation, not criminal activity.

How much traffic comes from bad bots?

Bad bots made up 32.1% of global internet traffic in 2023, according to Imperva. This was the highest share in the report’s history at that time.

Bad bots can:

• Test stolen login details.
• Create fake accounts.
• Copy articles, product listings, or prices.
• Buy limited products before human shoppers can.
• Send spam through forms and comments.
• Scrape business data.
• Hide attacks inside normal-looking web requests.
• Inflate clicks, views, or engagement numbers.

The risk is not the same for every website. An online bank, ticket seller, news site, and small blog may see very different traffic patterns.

Imperva’s report also found that automated traffic varied by industry and region. That means the global average should not be treated as a precise number for every American website, app, or household.

The source is useful because it measures a large volume of real web requests. Its limit is that it analyzes traffic seen by Imperva customers and systems, rather than every packet moving across the public internet.

How much of the internet is AI?

There is no reliable single percentage for AI traffic across the entire internet.

AI traffic can mean several different things:

1. AI crawlers that collect web pages for training or search.
2. AI assistants that fetch pages while answering a user.
3. AI agents that browse websites and take actions.
4. AI-generated text, images, audio, or video published online.
5. Automated software that uses machine learning for fraud, spam, or personalization.
6. Human users accessing AI services, such as a chatbot or image generator.

These categories overlap, but they are not interchangeable.

For example, a person in Texas asking an AI assistant a question may create one request to an AI service. An AI crawler may make millions of requests to websites. A fraud system may use machine learning without being an AI chatbot. Counting all three as “AI traffic” would produce a misleading result.

Cloudflare, Imperva, Akamai, and other internet infrastructure companies publish useful reports about crawlers, automated requests, and security activity. However, their measurements cover different networks, customers, definitions, and time periods. Their figures should not be added together.

The safest conclusion is:

Bots account for roughly half of measured web traffic, but the portion caused specifically by AI is unknown and cannot be stated as a trustworthy global percentage.

Is half of the internet made by AI?

No. The 49.6% bot figure does not mean that half of the internet is made or controlled by AI.

Most bots are not generative AI systems. Many use fixed rules or simple scripts. A bot that checks a web page every five minutes may be fully automated but use no artificial intelligence at all.

It also helps to separate three different measurements:

1. Web requests

A web request occurs when a browser, app, crawler, or other system asks a server for data. This is the type of activity measured in many bot-traffic reports.

A single bot can make a very large number of requests. Therefore, a bot may account for many requests without representing many people or devices.

2. Online content

Content may be written, edited, or generated by humans, software, or both. There is no universal label on every web page that accurately reveals how it was made.

Some pages use AI for a first draft and human editing. Others publish raw machine-generated material. Many sites do not disclose their process.

Because of this, researchers cannot reliably say that a specific percentage of all web pages was created by AI.

3. Internet users

A traffic percentage is not the same as a user percentage. One person may load a few pages, while one automated system may send millions of requests.

For example, if 100 requests reach a server and 50 come from bots, that does not mean 50 out of 100 people are bots. It means that half of those measured requests were automated.

Why AI-generated content is hard to measure

Detecting whether content came from AI is not a simple web-wide calculation.

AI detection tools can produce false positives and false negatives. Human writing may look machine-generated, especially when it is formal, repetitive, or heavily edited. AI writing may also be revised by a person until common detection signals disappear.

The same content may pass through several stages:

1. A person creates an outline.
2. An AI system drafts the text.
3. A person checks facts.
4. An editor rewrites parts of it.
5. A publishing system formats and posts it.

Which part is “AI-generated”? Different researchers may answer differently.

A web page can also contain AI-generated images or summaries while the main article was written by a person. That makes a single percentage even less meaningful.

For practical decisions, look for evidence of quality and authorship instead of trusting a detector score alone:

• Named authors and editors.
• Clear sources for important claims.
• Dates and updates.
• First-hand testing when a page claims to test something.
• A correction policy.
• Specific examples rather than vague summaries.
• Human review of medical, legal, financial, and safety information.

No AI detector should be treated as proof by itself.

How do researchers estimate bot traffic?

Researchers usually analyze server requests, browser signals, network patterns, and known bot behavior.

A simplified process looks like this:

1. Collect traffic data.
   A security or analytics system records requests to participating websites.

2. Identify known bots.
   The system compares user-agent details, IP ranges, verified crawler records, and other signals.

3. Detect automated behavior.
   It looks for patterns such as very fast page visits, repeated requests, unusual timing, or identical activity across many accounts.

4. Classify the traffic.
   Requests may be labeled as human, good bot, bad bot, or unknown automation.

5. Calculate the share.
   The system divides automated requests by total measured requests.

A basic calculation is:

Bot traffic percentage =
automated requests ÷ total requests × 100

Hypothetical example

Suppose a website receives 10 million requests in one month:

• 5 million are from human browsers.
• 3 million are from unwanted automated tools.
• 2 million are from search crawlers and monitoring systems.

The result would be:

• Human traffic: 50%
• Bad-bot traffic: 30%
• Good-bot traffic: 20%
• Total bot traffic: 50%

This example resembles the scale of recent industry findings, but it is only a calculation. It is not a measurement of every website in the United States.

Why bot percentages differ from site to site

A website’s bot share can be much higher or lower than the global average.

The largest factors include:

• Industry: Financial services, retail, gaming, travel, and media sites often attract substantial automation.
• Page type: Login, search, product, pricing, and account pages are common targets.
• Popularity: High-traffic sites attract crawlers, scrapers, and attackers.
• Security controls: Strong defenses may block bots before analytics tools record them.
• Geography: Traffic patterns differ by country, region, and hosting location.
• Measurement method: One provider may count requests that another provider filters out.
• Time period: Product launches, breaking news, attacks, and holidays can change the mix.
• Use of APIs: Automated software may use an API instead of loading normal web pages.

A site owner should not compare a personal blog’s traffic directly with a bank’s traffic. The underlying risks and measurement conditions are different.

Do search engine crawlers count as bots?

Yes. Search engine crawlers are bots.

Googlebot, Bingbot, and other verified crawlers visit pages to discover and index content. Their activity is automated, but it is not normally considered malicious.

Site owners can check whether a crawler is genuine by using documented verification methods. A user-agent string alone is not proof. Attackers can pretend to be Googlebot or another trusted crawler.

Search crawlers can still create problems if they request pages too often or ignore site rules. Website owners can use:

• robots.txt instructions.
• Server rate limits.
• Web application firewalls.
• Search engine tools.
• Access logs.
• Caching and content delivery settings.

The robots.txt file is a request, not a complete security barrier. It can guide well-behaved crawlers, but hostile bots may ignore it.

Do AI crawlers count as bots?

Yes. An AI crawler is a bot when it automatically requests pages or other online resources.

AI companies may use crawlers to collect information for:

• Model training.
• Search features.
• Retrieval systems.
• Product answers.
• Indexing.
• Safety and quality checks.

An AI crawler may identify itself through a user-agent name or documentation. That does not always make every request harmless or authorized.

Website owners should review the terms and controls available from their hosting provider, content delivery network, and the AI service involved. They should also check logs instead of assuming that a user-agent label is accurate.

AI crawlers raise a separate policy question: whether a publisher wants its content collected and how that content may be used. Bot traffic statistics can show activity, but they do not settle copyright, licensing, or permission questions.

How can you tell whether a website has bot traffic?

No public visitor can determine a site’s exact bot percentage without access to reliable traffic logs.

Site owners can look for warning signs such as:

• Sudden traffic spikes with no clear cause.
• Many visits from one network or data center.
• Thousands of requests at regular intervals.
• Very short sessions across many pages.
• Repeated requests for login or checkout pages.
• Large numbers of failed login attempts.
• High traffic with little JavaScript execution or normal browsing behavior.
• Identical actions across many accounts.
• Unusual increases in scraping or API use.

These signs do not prove that traffic is malicious. Search crawlers, uptime checks, mobile apps, and accessibility tools can also behave differently from normal browsers.

A reliable review combines server logs, analytics, authentication records, firewall events, and known crawler information. One metric, such as bounce rate or user-agent data, is not enough.

What does the bot share mean for ordinary internet users?

For most people, the bot share matters because automated systems shape what they see and how safely they use online services.

Bots can affect:

• Search results and content discovery.
• Product availability and ticket access.
• Online advertising measurements.
• Social media engagement.
• Account security.
• Website speed and reliability.
• The amount of low-quality or copied content online.

A high bot share does not mean that a human conversation or online community is fake. It does mean that views, likes, followers, reviews, and traffic counts deserve some caution.

For personal safety:

• Use unique passwords.
• Turn on multifactor authentication.
• Avoid clicking unexpected login links.
• Check account alerts.
• Keep browsers and devices updated.
• Treat sudden messages or offers with care.
• Do not assume that a polished profile belongs to a real person.

Bots can imitate normal users, but they cannot make every online claim true or trustworthy.

Common mistakes when discussing AI and bots

Mistake 1: Treating all bots as harmful

Search crawlers and monitoring tools are often useful. The word bot describes automation, not intent.

Mistake 2: Calling all automation AI

Many bots use rules, schedules, or simple scripts. Automation is broader than artificial intelligence.

Mistake 3: Turning one vendor’s sample into a global fact

A report based on protected websites does not measure every website, app, private network, or internet user.

Mistake 4: Confusing traffic with people

A bot can make millions of requests. A human can make only a few. Request share is not user share.

Mistake 5: Treating AI detection scores as proof

Detection tools estimate probability. They do not provide certain evidence of how a document was created.

Mistake 6: Adding good-bot and bad-bot figures without checking the base

Percentages must use the same year, sample, region, and definition. Figures from different reports may not be compatible.

Frequently asked questions

Is most internet content written by AI?

No reliable study proves that most internet content is written by AI. AI use is growing, but websites differ widely in their workflows, and many pages are written, edited, or reviewed by people.

Are social media accounts mostly bots?

The answer varies by platform, region, topic, and measurement method. Some accounts are automated, but no single public percentage accurately describes every social network or all users.

Can Google tell whether content was made by AI?

Google can evaluate content using many quality and spam signals, but it does not publish a simple public rule that labels every page as human- or AI-written. Its guidance focuses on useful, accurate content and warns against scaled content made mainly to manipulate search rankings. See Google Search Central’s guidance about AI-generated content.

Are bots responsible for most website attacks?

Bots play a major role in automated attacks, including credential stuffing, scraping, spam, and account abuse. However, the exact share differs by attack type and by the security provider measuring it.

How can I block all bots from my website?

You cannot reliably block every bot without also blocking some legitimate users and services. Use layered controls, such as rate limits, authentication protection, bot management, server rules, monitoring, and verified crawler policies.

Sources and limitations

The central bot-traffic estimate in this article comes from the Imperva Bad Bot Report 2024, which reported that automated traffic represented 49.6% of internet traffic in 2023.

For search guidance, see Google Search Central’s documentation on AI-generated content and Google’s documentation on verifying Googlebot.

These sources support measured traffic and published search guidance. They do not establish a universal percentage of AI-generated pages, AI users, or AI activity across every online service.

Key takeaway

The most defensible answer is simple:

Bots generated about half of measured web traffic in 2023, but no trustworthy global figure shows how much of the internet is specifically AI.

If you are evaluating a website, focus on the data that applies to that site. Check its traffic logs, bot definitions, time period, industry, and measurement method. For content, judge the source, evidence, and human review rather than assuming that a bot percentage tells you whether an article is reliable.