53% of web traffic in 2025 was not a person

Imperva, a Thales company, publishes an annual count of what actually crosses its network. The 2026 edition, covering 2025, reports that "automated traffic continues to outpace human activity online, accounting for more than 53% of all web traffic in 2025, up from 51% the year before", while "human activity has declined to just 47% and continues to fall". (Imperva, 2026 Bad Bot Report: Bad Bots in the Agentic Age, April 2026)

That is the second consecutive year in which machines outnumbered people on the open web. It is worth being precise about what the number does and does not say, because the useful part for a site owner is not the headline.

What counts as a bot

"Bot" in this count means any automated request, not just a malicious one. It covers at least four different populations, and they visit for different reasons.

Search crawlers index your pages so people can find them. AI crawlers fetch pages to answer questions or to train models, which is why a shop that has never seen an AI referral may still be crawled hundreds of times a month. Scrapers copy prices, stock levels and content for competitors, aggregators and resellers. And a newer group, agents, browse on behalf of a person who asked a question, clicking and reading in real time.

Imperva's own framing for this edition is the arrival of that last group: the report is subtitled "Bad Bots in the Agentic Age". The company does not publish a clean split between good bots and bad bots in the public summary, so the honest statement is the one on the card: 53% of traffic was automated, of every kind, and 47% was human.

Why your analytics does not show this

Open Google Analytics on a normal shop and you will see nothing like a 53% machine share. That is not a contradiction, it is a measurement difference, and understanding it matters.

Analytics tools that run in the browser only count visitors who execute JavaScript. Most crawlers do not. They request the HTML, read it, and leave, so they never fire the tracking script and never appear in your reports. Analytics platforms also filter known bots by user agent on purpose, because the reports exist to describe customers.

Imperva counts at a different layer. It sits in front of the site as a network service and sees every request, script or no script. So the two numbers measure different things: your analytics measures people who rendered a page, Imperva measures requests that arrived. Both are correct.

The practical consequence is that the only place you can see this traffic is your server logs or your CDN's dashboard. If you have never looked there, you have never seen the majority of what reads your site.

What it means when most readers are machines

For a shop or a service business, three things follow.

Your product page has two audiences with different needs. A person scans a photo, a price and a review score. A crawler reads the text and the structured data and ignores the photo entirely. A page that looks complete to a human can be nearly empty to a machine if the specifications live in an image, the price is drawn by a script after load, or the delivery terms sit in a PDF. Both audiences are now large, and only one of them can ask you a question.

Machine reading is what feeds AI answers. When someone asks an AI assistant where to buy a product, the assistant answers from pages that were fetched and read, either by its own crawler or live during the search. Being absent from that fetch is the most common reason a company is missing from the answer, and it is invisible in analytics because the visit never showed up there.

Some of the traffic is working against you. The same report exists because much of this automation is hostile: scrapers taking prices to undercut them, credential stuffing, inventory hoarding. Blocking indiscriminately is the wrong response, because the crawlers that feed search and AI answers look, at the network level, much like the ones taking your prices. The judgement is which agents to let in, not whether to have a gate.

What to check

Three checks, each half an hour or less.

Look at your server or CDN logs for a week and count requests by user agent. You are looking for the named AI crawlers, whether they got a 200 or a 403, and which pages they asked for. A surprising number of sites block them by accident through a security setting nobody remembers enabling.

Open your best-selling product page with JavaScript disabled, or fetch it with a plain HTTP request. Whatever survives is roughly what a crawler sees. If the price and the key specifications are missing, that is your gap.

Then check whether your robots.txt says what you think it says. It is the one file that decides which of these populations is allowed to read you at all, and it is usually written once and never read again.

The question on the card was: when did your analytics last show more people than bots, and would you know? For nearly every site, the honest answer is that analytics could not tell you either way.