What Percentage of Internet Traffic Is Bots? Q3 2026 Statistics

Updated October 1, 2026 with Q3 2026 data (July to September 2026; September is provisional). Earlier editions of this report are preserved in the update history, annotated where newer data supersedes them.

Bots made up 35.49% of all web requests in Q3 2026, against 64.51% human. That is up from 33.21% in Q2 2026 and from 30.13% in Q3 2025. September alone read 36.15% (provisional), 6.80 points above September 2025. Meta held the #2 operator slot at 17.06% of verified-bot requests for the quarter, Anthropic slid to 7.29% by September, and in September OpenAI dropped behind Microsoft to fifth. Source: Cloudflare Radar, radar/http/summary/bot_class and radar/bots/summary/bot_operator, calendar quarters and months. Pulled 2026-10-01.

One AI company now out-crawls every rival relative to what it gives back: Anthropic reads roughly 4,580 pages for every visitor it refers (28-day window ending June 22, 2026; it reads 1,782 on the trailing 28 days as of August 1). Overall, bots make up 35.2% of all web traffic as of June 2026, with humans still the majority at 64.8%, according to Cloudflare Radar. Other estimates exceed 50%, explained below.

⚠️ superseded by the Q3 2026 update above; preserved as originally published. Anthropic's ratio fell to 988 pages per referral across Q3 2026, and Perplexity's (1,083) passed it. Bot share was 35.49% in Q3 2026.

These figures come from data we pulled from Cloudflare Radar on June 22, 2026, and re-pull on publish. As a team that crawls 29.9M live business domains every month, we read other operators' crawl behavior directly in this data. The pattern that jumps out isn't the headline percentage. It's who is doing the crawling, and how little they return.

What percentage of internet traffic is bots?

Bots made up 35.49% of web requests in Q3 2026 and 36.15% in September 2026 (provisional), according to Cloudflare Radar. Roughly one request in three is automated, and humans are still the majority. The "51% bots" figure that circulates does NOT measure the same population: it comes from Imperva's 2025 Bad Bot Report (2024 data), which counts automated traffic on the application traffic that firm defends, where bots concentrate.

Source: Cloudflare Radar, radar/http/summary/bot_class, calendar quarters and September 2026, pulled 2026-10-01. PERCENTAGE normalized request shares.

Q3 2026 analysis: what changed from July to September

Three things moved in Q3. Bot share kept climbing, Google's share of the verified bots kept shrinking, and the web refused more crawler requests than in any quarter this report has measured.

Source: Cloudflare Radar, radar/http/summary/bot_class, radar/bots/crawlers/summary/response_status_category, radar/bots/summary/bot_operator and radar/http/summary/device_type with botClass filters. Calendar quarters 2025-07-01 to 2025-09-30, 2026-04-01 to 2026-06-30 and 2026-07-01 to 2026-09-30, pulled 2026-10-01. Q3 2026 is provisional.

I read Q3 as the quarter the crawler economy tilted further away from search rather than simply grew. Google's share of verified-bot requests fell another 3.18 points, continuing a slide from 46.8% in Q2 2025, while the 4xx rate climbed to 37.26%. There are more automated requests, a smaller share of them come from the operator whose crawling still arrives with real search referrals, and more of them are refused at the door.

Two calls from the August edition need grading. That edition said bot share "has risen every month this report has measured it". That was wrong, and our own July edition already showed it: July read 34.75% against June's 34.79%, and March 2026 fell almost a full point, to 30.66% from 31.65%. The direction held; "every month" did not. The second call was that automated traffic passes 40% of requests during 2027. That one is still open and looks closer than it did: September 2026 sits 6.80 points above September 2025, and the last seven days of September averaged 39.63%. A week after a step change isn't a monthly reading, though, which is the next point.

Late September: a step, not yet a trend

Most of September's rise arrived in its last week. Bot share averaged 35.16% from 1 to 23 September, then stepped up about two points on 24 September (37.60% to 39.58%) and averaged 39.63% through the 30th. It was still near 39.7% on 1 October. The step appeared on the same day in the United States (51.78% to 54.88% between the two periods), Germany (50.05% to 53.13%) and Singapore (80.83% to 82.65%), and it didn't change the device mix of bot traffic. Cloudflare hasn't annotated an event for that date.

I don't read a same-day step across unrelated countries as behaviour. It looks more like a change in what gets classified as automated, and until a re-pull settles it, September's 36.15% carries that week inside it. If you need one number from this edition, quote the quarter: 35.49%.

Source: Cloudflare Radar, radar/http/timeseries_groups/bot_class with daily aggregation, worldwide and with location=US, DE and SG, 1 to 30 September 2026; hourly to 1 October 2026; radar/annotations. Pulled 2026-10-01.

The desktop shift, re-run on corrected data

Cloudflare revised its blended device series after our September edition. The August 2026 blended desktop share we published as 61.90% now reads 60.76%, while the human-only (45.83%) and bot-only (88.00%) figures reproduce exactly. The revised blended figure is exactly what you get by weighting the two populations by bot share (64.58% of 45.83% plus 35.42% of 88.00% is 60.76%), and the old one wasn't, so I'm treating the revision as a correction and running the decomposition on it.

Source: Cloudflare Radar, radar/http/summary/device_type, unfiltered and with botClass=LIKELY_HUMAN, calendar quarters, pulled 2026-10-01.

The identity closes: 2.17 points of human drift plus 3.98 points of widening gap equals the 6.15-point blended shift. So about 35% of the year's desktop shift is people and 65% is bot composition. Quarter on quarter the composition share is larger still, about three-quarters (0.53 points human, 1.62 points gap). The conclusion this report has carried since July survives the correction: re-run on the revised August figures, last month's 34/66 split reads 33/67.

Crawl purpose was reclassified, so the training numbers moved

Cloudflare has also reclassified its AI crawl-purpose history since our September edition. Volume moved from Search into Training in every month we checked, while Mixed Purpose and User Action stayed put. In August 2026, Training went from 40.15% to 48.25% and Search from 16.45% to 8.35%; the two still sum to 56.60%. That is a label change, not a change in crawling. On the new labels Q3 2026 reads Training 47.62%, Mixed Purpose 38.86%, Search 8.26% and User Action 3.66%. The year-over-year direction this report called still holds: training is up from 40.82% in Q3 2025 and search from 1.32%. The full, re-based crawl-purpose analysis lives in our AI crawler statistics report.

Source: Cloudflare Radar, radar/ai/bots/summary/crawl_purpose, calendar months and quarters, re-pulled 2026-10-01 against the values published 2026-08-01 and 2026-09-03.

The extraction gap: Perplexity now reads more per referral than Anthropic

Since June this report has led with Anthropic as the most one-sided crawler on the web. Q3 2026 ends that. Anthropic's crawl-to-refer ratio fell from 5,143 pages per referral in Q2 to 988 in Q3, and 555 in September. Perplexity's went the other way, from 153 to 1,083 for the quarter and 2,283 in September. OpenAI reads 309 pages per referral for Q3 and Google 4.88. Mistral's 310,122 sits on a referral base too small to rank, and Cloudflare reports September's as infinite.

Source: Cloudflare Radar, radar/bots/crawlers/summary/crawl_refer_ratio (RATIO normalization), calendar quarters and September 2026, pulled 2026-10-01.

2026 month by month

Source: Cloudflare Radar, radar/http/summary/bot_class (bot share of all requests) and radar/bots/summary/bot_operator (operator shares of verified-bot requests), calendar months, pulled 2026-10-01. "Below" means the operator is outside Cloudflare's top nine that month, and the figure is the ninth entry's share.

Anthropic's column starts in June because that is when it entered Cloudflare's operator table, at 12.69% from below 2.53% in May. In the same month its user-fetch agent Claude-User appeared in the busiest-bot table at 10.78%, from below 3.11%. A jump that size in one month looks to me more like the point Cloudflare began verifying that agent as Anthropic's than a fivefold change in crawling, so compare Anthropic from June onward, not from January. Cloudflare now lists the same agent as Claude, and in September it was the third-busiest verified bot at 5.72%, behind GoogleBot (13.47%) and Meta-ExternalAgent (7.16%).

Source: Cloudflare Radar, radar/bots/summary/bot, calendar months May, June and September 2026, pulled 2026-10-01.

By vertical: where crawler traffic lands, and who defends

Two panels follow. They come from different sources, use different industry labels and measure different things, so read them side by side and never as a ratio.

Cloudflare Radar: which verticals absorb verified crawler requests

Source: Cloudflare Radar, radar/bots/crawlers/summary/vertical, calendar quarters 2026-01-01 to 2026-03-31 and 2026-07-01 to 2026-09-30, pulled 2026-10-01. Shares of verified crawler requests by the vertical Cloudflare assigns to the destination site.

A quarter of all verified crawler requests now lands on shopping sites, and that share grew more than any other between Q1 and Q3. My reading is simple: crawlers return most often to pages that change every day, and product pages, prices and stock levels do.

TechnologyChecker: who runs bot defence, by industry

Detection data: TechnologyChecker crawl, September 2026. The total is a deduplicated union, not a sum.

No month-over-month change is published for this table. Two of the six products, Cloudflare Bot Management and Cloudflare Turnstile, moved more than our stability threshold between the August and September crawls, so the comparable statement is a dated level.

Detection data: TechnologyChecker website observations enriched with company information, September 2026 crawl. Base: the 2,888,394 bot-defended domains (50.8% of 5,687,047) and the 13,077,501 live domains we could match to a company. Index is the first share divided by the second.

I expected bot defence to cluster in finance and e-commerce, where credential stuffing and scraping cost money directly. It barely clusters at all. No industry runs above 1.25× its share of the web, and retail companies sit slightly below theirs at 0.90×. With reCAPTCHA on 3.59M of the 5.69M defended domains, bot defence mostly looks like a CAPTCHA on a contact form, installed like a utility rather than chosen for the threat an industry faces.

Put next to the Radar panel, that is the gap worth noticing: shopping sites take the largest share of crawler requests, and retail companies are no more likely than anyone else to run a defence.

Bot Traffic in 2026: Key Findings

Here are the headline numbers from our June 2026 Cloudflare Radar pull. Each one is attributed to a specific endpoint below, so you can lift any single stat and keep its source.

• Bots are 35.2% of all web traffic; humans are 64.8%. By Cloudflare's measure, humans are still the majority. Source: Cloudflare Radar — radar/http/summary/bot_class (radar.cloudflare.com), 7d (2026-06-15 to 2026-06-22).
• Anthropic is the #2 bot operator at 13.2% of verified bot traffic, ahead of Meta (12.2%) and nearly double OpenAI (7.2%). Only Google (28.4%) runs more. ⚠️ superseded by the August 2026 update (now in the update history below); preserved as originally published. Anthropic is #3 at 10.53% on the trailing 28 days, behind Meta at 15.01%.
• Claude-User is the web's #2 busiest individual bot at 11.3%, behind GoogleBot (14.2%) and nearly double GPTBot (5.8%). Rank still holds in August; the share reads 7.57% on the trailing 28 days.
• Anthropic crawls ~4,580 pages per referral it sends back, vs OpenAI's 848, Perplexity's 186, and Google's 5. This is a ratio, not a percentage. ⚠️ superseded by the August 2026 update (now in the update history below); preserved as originally published. The trailing-28-day ratio is 1,782.
• AI-related bots are 33.8% of all bot traffic. Crawlers, assistants, and AI search combined now rival traditional search-engine crawlers (26.8%). Holds: 34.30% on the trailing 28 days.
• More than 1 in 3 crawler requests (36.9%) gets a 4xx error. Only 46.8% get a successful 2xx response. Holds: 35.86% and 47.57% on the trailing 28 days.
• 52.3% of AI crawling is for model training, not live search indexing (10.1%). ⚠️ superseded by the August 2026 update (now in the update history below); preserved as originally published. Training reads 44.21% and search 11.66% on the trailing 28 days.
• Bot share swings from 76.6% in Singapore to 11.8% in Mexico. The most-automated countries are data-center hubs (Singapore, Ireland, the Netherlands); the most-human are mobile-first consumer markets. The US sits at 49.4%.
• Humans browse on phones; bots run on servers. Human web traffic is 55% mobile, but bot traffic is 84% desktop, and bots claim Chrome (78.6%) even more often than humans do (68.3%). The contrast widened in July: bots read 87.04% desktop and humans 54.64% mobile.
• NEW year-over-year (2025 vs 2026): the web slammed the door on crawlers. Across full calendar quarters, the share of crawler requests served (2xx) fell from 80.5% to 49.2% while 4xx blocks rose from 10.2% to 35.8%. Bot share of all traffic also rose from 30.4% to 33.2%. Source: Cloudflare Radar — radar/bots/crawlers/summary/response_status_category and radar/http/summary/bot_class, Q2 2025 vs Q2 2026. Pulled 2026-07-03.

How Much of the Web Is Bots in 2026?

Bots account for 35.2% of all web traffic as of June 2026 (roughly one in three requests), while humans account for 64.8%. That's the verified-and-likely-automated share Cloudflare sees across its global network. Source: Cloudflare Radar — radar/http/summary/bot_class (radar.cloudflare.com), 7d (2026-06-15 to 2026-06-22). August 2026 update: 34.94% bot and 65.06% human on the trailing 28 days to August 1, and 34.75% across calendar July. One in three still holds.

So why do you keep reading that bots have "overtaken humans"? Because different measurements ask different questions. Bot traffic share is the percentage of web requests that come from automated clients rather than people. But what counts as "automated," and which slice of the internet you measure, changes the answer a lot. Cloudflare measures requests across a large neutral network and separates verified bots and likely-automated traffic from human sessions. Security vendors like Imperva (owned by Thales) and HUMAN Security report higher figures because they weight toward the application-layer attack surface they defend (login endpoints, checkout flows, APIs) where automated abuse concentrates, and they fold more "likely-automated" requests into a broader bucket. Same internet, different lens.

Here's the reconciliation no single-source news post offers. Every major 2026 estimate sits side by side below, with how each one is measured.

Treat the precise figure (35.2%) as the network-wide measurement and the "around half" figures as attack-surface-weighted estimates. According to the Imperva (Thales) Bad Bot Report, automated traffic sits near half of all traffic by their definition. That's directionally consistent with Cloudflare's growth trend, just measured against a different denominator. Both can be true at once.

For the human side of this split, see the country, device, and browser breakdowns later in this report, plus our web traffic statistics post on the 64.8% that isn't a bot.

The Extraction Gap: Which AI Companies Take the Most and Give Back the Least

The extraction gap is the ratio of pages an AI crawler reads to visitors it refers back to the open web, and Anthropic's is the widest of any major operator. Anthropic crawls roughly 4,580 pages for every 1 referral it sends back, versus OpenAI's 848, Perplexity's 186, and Google's 5. Source: Cloudflare Radar — radar/bots/crawlers/summary/crawl_refer_ratio (radar.cloudflare.com), 28d (2026-05-25 to 2026-06-22).

⚠️ The June ratios below are superseded by the August 2026 update (now in the update history below) and preserved as originally published. On the trailing 28 days to August 1, 2026: Anthropic 1,782, Perplexity 303, OpenAI 233, Microsoft 37, Google 4.79. Mistral reads 29,586 but on a referral base small enough that its ratio swings by orders of magnitude month to month, which is why we don't headline it. Source: radar/bots/crawlers/summary/crawl_refer_ratio, 28d (2026-07-04 to 2026-08-01). Pulled 2026-08-01.

⚠️ Also superseded by the Q3 2026 update above: Anthropic's gap is no longer the widest. Across Q3 2026 Perplexity read 1,083 pages per referral against Anthropic's 988, and in September 2,283 against 555. Source: radar/bots/crawlers/summary/crawl_refer_ratio, calendar Q3 2026 and September 2026. Pulled 2026-10-01.

Read this table as "pages crawled per 1 referral," not as a percentage. It's a ratio, so a bigger number means a more one-sided exchange, not a larger share of traffic.

Google sits at 5:1 because its crawl still feeds a search engine that sends clicks back to publishers. The ratio is roughly the old bargain of the open web: you let the crawler in, it sends you traffic. AI assistants break that bargain. They read your page to answer a question inside a chat window, and the user rarely clicks through. Anthropic's 4,580:1 is that broken bargain at its most extreme, nearly a thousand times more lopsided than Google's.

This isn't a moral verdict. It's the mechanics of how answer engines work, and it's the same shift driving our Claude usage statistics and ChatGPT statistics. If your content fuels AI answers without earning a click, the referral ratio is where you see it first.

Who Operates the Internet's Bots?

⚠️ The June ranking below is superseded by the August 2026 update (now in the update history below) and preserved as originally published. On the trailing 28 days to August 1, 2026 the order is Google 27.11%, Meta 15.01%, Anthropic 10.53%, OpenAI 6.50%, Microsoft 5.50%, Amazon 4.73%, Ahrefs 3.47%, Apple 3.47%, Baidu 3.07%. Source: Cloudflare Radar — radar/bots/summary/bot_operator, 28d (2026-07-04 to 2026-08-01). Pulled 2026-08-01.

Google operates the largest share of verified bot traffic at 28.4%, and Anthropic is now second at 13.2%, ahead of Meta and nearly double OpenAI. The operator league below counts each company's share of verified-bot requests. Source: Cloudflare Radar — radar/bots/summary/bot_operator (radar.cloudflare.com), 7d (2026-06-15 to 2026-06-22).

A year ago, the runner-up to Google in any bot-operator chart would have been Microsoft (Bing) or Amazon. Now it's Anthropic, a company with no search engine and no ad network, whose bots exist almost entirely to read pages for an AI assistant. That single fact reshapes how site owners should think about their server logs. The second-heaviest crawler hitting your site probably isn't indexing you for search; it's reading you for a chatbot.

August 2026 note: Meta reclaimed second place through July, so the second-heaviest crawler is now a social-platform bot again. Anthropic at #3 and OpenAI at #4 still put two AI labs in the top four, which is the part of this read that held.

We track which companies sit behind the technology and crawlers on millions of sites. See how we detect technologies and crawlers for the methods behind reads like this.

The Busiest Bots on the Web Right Now

GoogleBot is still the single busiest bot at 14.2% of verified-bot requests, but Claude-User is now #2 at 11.3%, nearly double GPTBot (5.8%). An AI assistant agent now out-crawls every search engine except Google. Source: Cloudflare Radar — radar/bots/summary/bot (radar.cloudflare.com), 7d (2026-06-15 to 2026-06-22).

August 2026 update: the top two hold. On the trailing 28 days GoogleBot reads 12.87% and Claude-User 7.57%, with Meta-ExternalAgent third at 6.88% and GPTBot fourth at 5.28%. Watch the labelling here: in the final week of July, Cloudflare began reporting a separate Claude agent (4.23%) alongside Claude-User (3.33%), so a single-label read of that week understates Anthropic's user-fetch volume. Source: radar/bots/summary/bot, 28d (2026-07-04 to 2026-08-01). Pulled 2026-08-01.

The name to sit with is Claude-User. The "-User" suffix means these are user-initiated fetches: a person asks Claude a question, and Claude goes and reads live pages to answer. That's different from a training crawler quietly building a dataset. It means Claude's reach into the live web is being pulled by real demand, in real time, at a volume that now trails only GoogleBot. GPTBot, OpenAI's heavier crawler, sits at less than half Claude-User's share. The agentic web isn't a forecast anymore; it's the #2 entry in this table.

What AI Crawlers Actually Want: Training vs Search

⚠️ The June split below is superseded by the August 2026 update (now in the update history below) and preserved as originally published. On the trailing 28 days to August 1, 2026: Training 44.21%, Mixed Purpose 40.18%, Search 11.66%, User Action 2.65%, Undeclared 1.29%. Training is still the largest slice, but the five-to-one dominance over live search has narrowed to about four to one. Source: radar/ai/bots/summary/crawl_purpose, 28d (2026-07-04 to 2026-08-01). Pulled 2026-08-01.

⚠️ Cloudflare has since reclassified its crawl-purpose history, moving volume from Search into Training (see the Q3 2026 update above). Re-pulled on 1 October 2026, the June window above reads Training 51.13%, Mixed Purpose 40.62%, Search 4.88%, and the window to August 1 reads Training 50.70%, Mixed Purpose 39.89%, Search 5.56%. On the new labels Q3 2026 reads Training 47.62% and Search 8.26%.

More than half of AI crawler activity (52.3%) is for model training, while only 10.1% is for live search indexing. The rest is mixed-purpose (34.2%) or unspecified. Source: Cloudflare Radar — radar/ai/bots/summary/crawl_purpose (radar.cloudflare.com), 28d (2026-05-25 to 2026-06-22).

Most AI crawling feeds model training (52.3%), not live search (10.1%).

This breakdown matters for one practical reason: the page an AI reads today to train on shapes the answer it gives a user tomorrow. When training is 52.3% of AI crawling and live search is only 10.1%, most of what assistants "know" about your brand is being baked in during training runs, not fetched fresh at query time. If your content isn't in the training pass, you may simply be absent from the answer, with no live-search step to recover the omission. The same dynamic shows up in our open-source AI adoption data, where models trained on public code and docs inherit whatever was crawlable.

AI Bots Are Now a Third of All Bot Traffic

AI-related bots make up 33.8% of all bot traffic, combining AI crawlers (17.7%), AI assistants (9.0%), and AI search (7.0%), rivaling traditional search-engine crawlers at 26.8%. Source: Cloudflare Radar — radar/bots/summary/bot_category (radar.cloudflare.com), 28d (2026-05-25 to 2026-06-22).

Q3 2026 note: Cloudflare retired its AI assistant category in July 2026 and moved that traffic into AI crawler and page preview, so the combined AI share is not like-for-like across that change. Q3 2026 reads 32.49% (AI crawler 22.12%, AI search 7.03%, AI assistant 3.35% before its retirement) against 26.14% for search-engine crawlers. A third still holds. Source: radar/bots/summary/bot_category, calendar Q3 2026. Pulled 2026-10-01.

Add the three AI rows and you get 33.8%. A third of every automated request hitting the web is now AI-driven. Stack that against the single largest traditional category, search-engine crawlers at 26.8%, and the direction is clear: AI has already passed classic search crawling as a category of bot traffic. For most of the web's history, "a bot is crawling my site" meant a search engine wanted to rank you. In 2026, it's more likely an AI system wants to read you. That reframes AI adoption trends from a product story into an infrastructure one: the adoption is visible in raw crawl volume.

Bot Traffic by Country: Where the Web Is Most Automated

Bot share is wildly uneven by country, from more than 76% of requests in Singapore to under 12% in Mexico. The countries with the highest bot share are the ones that host the internet's data centers, not the places where the most "attacks" originate. Source: Cloudflare Radar — radar/http/summary/bot_class with a per-country location filter (radar.cloudflare.com), 7d (2026-06-15 to 2026-06-22).

The top of this list is a map of cloud infrastructure. Singapore, Ireland, and the Netherlands are majority-bot because they host hyperscale data-center regions for AWS, Google Cloud, and Azure, and bots run inside those data centers, so their traffic originates there. That's why "which country has the most bot traffic" is really asking "which country hosts the most servers," not "which country is under attack." It also explains the headline gap from earlier: the United States reads at 49.4% bot and Germany at 50.2%, right around the "half the internet is bots" figure security vendors report, because both are huge economies that also host enormous data-center capacity. Measure a server-dense country and you get roughly half; measure the whole neutral network and you get 35.2%. At the other end, mobile-first consumer markets like Mexico (11.8%), India (16.2%), and Turkey (16.5%) are the most human, because they generate huge volumes of real phone browsing and host comparatively few data centers. One caveat: a few mid-table countries (Russia here, and Nigeria at 53%) rank high less because of hosting and more because of proxy and VPN exit nodes plus lower human request volume, so read single countries with care.

Bots vs Humans by Device and Browser

Humans and bots look completely different at the device level: human web traffic is 55% mobile, but bot traffic is 84% desktop. People browse on phones; bots run on servers. Source: Cloudflare Radar — radar/http/summary/device_type, split by likely-human and likely-automated (radar.cloudflare.com), 7d (2026-06-15 to 2026-06-22).

August 2026 update: the gap widened. In calendar July 2026 bots read 87.04% desktop and 12.87% mobile, while humans read 54.64% mobile and 45.34% desktop. A year earlier bots were 85.51% desktop and humans 57.01% mobile. Source: radar/http/summary/device_type filtered by botClass, calendar July 2025 and July 2026. Pulled 2026-08-01.

That single contrast is one of the more dependable ways to tell automated traffic from people. A user-agent string is trivial to fake, but the overall shape of traffic is not: humans skew mobile because that's where real browsing happens, while bots skew desktop because they run on servers and headless browsers that present as desktop clients. The operating-system mix underneath confirms it: among human traffic, Android leads at 36.0%, ahead of Windows (32.9%), iOS (20.1%), and macOS (8.8%), so mobile operating systems (Android plus iOS) now carry roughly 56% of human browsing.

Browser share tells a subtler story. Among humans, Chrome leads at 68.3%, followed by Safari (18.2%), Edge (6.5%), and Firefox (3.7%). Bots claim a similar lineup, but they over-index on Chrome and barely touch Safari.

August 2026 update: re-pulled on the 28 days to 5 August 2026, the lineup holds and the Chrome gap widens slightly. Humans: Chrome 68.66%, Safari 17.57%, Edge 6.93%, Firefox 3.63%, Samsung Internet 1.74%, Opera 1.25%. Bots: Chrome 79.59%, Safari 8.52%, Firefox 4.93%, Edge 3.65%, Samsung Internet 1.97%, Opera 1.08%. The one real mover is Samsung Internet on the bot side, down from 4.2% to 1.97%. Every conclusion in this section is unchanged. Source: radar/http/summary/browser_family filtered by botClass, 28 days to 2026-08-05. Pulled 2026-08-05. For the human side over time see our Chrome, Safari and Firefox market share reports.

Bots report Chrome even more often than humans (78.6% vs 68.3%) because headless Chrome, driven by automation frameworks like Puppeteer and Playwright, is the default tool for scraping and AI fetching. Safari, by contrast, is far rarer among bots (7.6% vs 18.2%): almost nobody automates WebKit at scale. The practical read for site owners is that a desktop client claiming the latest Chrome, with no matching mobile traffic, is a classic headless-scraper fingerprint. Just remember these browser labels come from user-agent strings, which bots can set to anything, so treat the bot-side browser numbers as claimed identity rather than verified fact. For the human side, our Chrome market share and Safari market share reports track those browsers over time.

The weekly rhythm is a bot detector, and it's harder to fake than a user agent

Device level is the signal this section has described so far: humans skew mobile, bots skew desktop. There is a second signal sitting underneath it that is considerably harder for an operator to imitate, because it is not a property of any single request. It is a property of the traffic over time.

Human traffic breathes on a seven-day cycle. Bot traffic does not. Aggregating by day of week across 1 June to 5 August 2026:

Source: Cloudflare Radar — http/timeseries_groups/device_type filtered by botClass, daily aggregation, 1 June–5 August 2026 (9 full weeks). Pulled 2026-08-05.

Read the consistency column rather than the swing column, because that is where the two populations genuinely separate. Human device mix moves by more than six times as much, but more tellingly it moves the same way every single week, nine weeks out of nine, never straying outside a 0.6-point band. Bot device mix wanders around roughly zero and changed direction in one of the nine weeks, which is what a series with no underlying weekly driver looks like.

The reason is straightforward once stated. Humans have weekends: the work laptop goes down on Friday and the phone comes up, and that shift is visible in aggregate traffic with metronomic reliability. Servers do not observe Saturday. A crawler fleet runs the schedule its operator set, and that schedule has no particular reason to know what day it is.

This matters because it is cheap to check and expensive to defeat. A user agent is one header and can claim anything, which is why the bot-side browser figures above are claimed identity rather than verified fact. Device type is harder to fake convincingly at scale but still forgeable per request. A weekly rhythm, though, would require an operator to deliberately model human weekend behaviour across their whole fleet and sustain it for months — possible, but nobody scraping at volume bothers, because until now nobody was looking for it.

One honest limitation before you use it. This is an aggregate-population signal, not a per-visitor one: it tells you something about a segment of thousands of sessions over weeks, and nothing at all about whether one particular request is a bot. It is a good tool for auditing whether a traffic source, referrer, or campaign is delivering real people, and a bad tool for gating an individual request.

More Than 1 in 3 Crawler Requests Gets Blocked

About 37% of crawler requests now receive a 4xx error (more than one in three), while only 46.8% get a successful 2xx response. Source: Cloudflare Radar — radar/bots/crawlers/summary/response_status_category (radar.cloudflare.com), 7d (2026-06-15 to 2026-06-22). August 2026 update: this one held. The trailing 28 days to August 1 read 4xx 35.86%, 2xx 47.57%, 3xx 14.49%, 5xx 2.08%, and the most recent weekly bucket puts 4xx back up at 37.10%.

More than 1 in 3 crawler requests (about 37%) now gets a 4xx block.

A 4xx response on more than a third of crawler requests is the web pushing back. Sites are returning 403s and 429s to crawlers they don't want, and a lot of that pushback now targets AI crawlers specifically, through robots.txt rules, firewall rules, and CDN toggles. We dug into exactly who's blocking which AI bots in our robots.txt AI crawler blocking report, and the short version is that blocking has gone mainstream among large publishers. The tension is real: block too aggressively and you vanish from AI answers; allow everything and you hand over your content for a referral ratio of 4,580:1.

Who Is Actually Defending Against All This

Radar measures bot requests arriving at the edge. It cannot tell you how many sites have deployed something to stop them. Our own crawl can, because bot-mitigation products leave a detectable signature on the pages they protect.

Source: TechnologyChecker detection data, August 2026 crawl. The total is a deduplicated union, not a sum: a domain running two products is counted once.

⚠️ superseded by the Q3 2026 update above; preserved as originally published. As of the September 2026 crawl the union reads 5,687,047 live domains, about 19% of the web we crawl. Product counts and the industry split are in the By vertical section above.

Google's reCAPTCHA is on two-thirds of the defended web and more than twice the next product. The concentration is worth noticing on its own: the most widely deployed defence against automated traffic is operated by the company that also runs the single largest bot operation on the web, at 26.58% of verified-bot requests.

The gap is the finding. Automated traffic is over a third of all requests and rising every month, while fewer than one in five live business domains runs anything specifically built to identify it. Most of the web is not defending itself; it is being crawled and simply absorbing the load.

Bot Traffic in 2026 vs 2025: The Year-Over-Year Shift

The single biggest change since last year isn't the bot share; it's how hard the web now pushes crawlers away. A year ago (Q2 2025), more than four in five crawler requests succeeded and barely one in ten hit a 4xx block. Over the full Q2 2026 quarter, fewer than half succeed and more than a third are blocked. Source: Cloudflare Radar — radar/bots/crawlers/summary/response_status_category, full-quarter windows (2025-04-01 to 2025-06-30 vs 2026-04-01 to 2026-06-30). Pulled 2026-07-03.

The figures earlier in this report use Cloudflare's rolling 7-day and 28-day windows, which react fast to the latest week. The table below instead compares three full calendar quarters, so the year-over-year change is measured on the same-length window at both ends.

August 2026 note: the quarter table above stands as published. A calendar-month cut of the same comparison, July 2025 against July 2026, is in the What July 2026 Changed section (now in the update history) and points the same way: bot share 30.76% to 34.75%, 4xx blocks 14.04% to 35.79%, 2xx responses 73.50% to 47.66%. July 2025 on its own already had a higher block rate than the Q2 2025 quarter average, so the crackdown was underway before the quarter closed. Month windows and quarter windows are not interchangeable, so read each row against its own label.

⚠️ The training row is superseded by Cloudflare's crawl-purpose reclassification (see the Q3 2026 update above); preserved as originally published. The same quarters now read 32.56% (Q2 2025), 46.30% (Q1 2026) and 49.93% (Q2 2026), a gain of 17.37 points. The bot-share and Q2 response-code rows reproduce exactly. The Q3 2026 comparison is in the Q3 2026 analysis at the top of this report.

Read down that 4xx row and you can watch the open web's posture toward crawlers change in a single year. In Q2 2025, letting a crawler in was still the default: 80.5% of crawler requests got a clean 2xx. By Q2 2026 that default is gone, with success down to 49.2% and blocks up to 35.8%. The rolling 7-day figure earlier in this report (36.9%) shows the same wall, just measured on the most recent week. This is the infrastructure side of the story we tracked in our robots.txt AI crawler blocking report: the blocking went from niche to mainstream, and the aggregate request logs now show it plainly.

The operator league looks just as different a year on. Anthropic, the runner-up in the recent-week ranking at the top of this report, did not appear in the operator top nine at all in Q2 2025, and still didn't through Q1 2026. It broke into the full-quarter league only in Q2 2026, at #5. Source: Cloudflare Radar — radar/bots/summary/bot_operator, full-quarter windows. Pulled 2026-07-03.

Two things are worth separating here. Over the full quarter, Anthropic averages #5 at 4.9%, because it was a small operator for most of the quarter and surged late. In the most recent 7-day window it jumps to #2 at 13.5%, which is the figure the top of this report quotes. ⚠️ That 13.5% is superseded by the August 2026 update (now in the update history below) and preserved as originally published; the 7-day window to August 1, 2026 reads 9.45% and #3. Both are correct: the full-quarter average captures where Anthropic sat across all of Q2, and the rolling week captures where it is right now. The direction is the story either way, because a year ago Anthropic was not on the board at all. The same pattern holds for individual bots: Claude-User is absent from the Q2 2025 busiest-bot top nine, sits at #8 across the full Q2 2026 quarter, and reaches #2 in the current week. Meanwhile GoogleBot's own share of verified-bot requests roughly halved over the year (from 31.0% to 15.6%) as the field fragmented across many more crawlers.

One thing has not changed: the extraction gap. Anthropic read the most pages per referral of any major operator in Q2 2025, and it still does. If anything the gap was even wider a year ago, before Claude began sending meaningful referral traffic back; the exact ratio swings sharply week to week, but Anthropic sits at the top of it in both years. That widening-then-narrowing arc is the same shift we cover in our Claude usage statistics.

Good Bots vs Bad Bots: Not All Automated Traffic Is Equal

Not all automated traffic is equal: "good bots" identify themselves and obey rules, while "bad bots" spoof user agents, ignore robots.txt, and drive scraping, credential stuffing, and fraud. The bot share (35.2% in June, 34.94% on the trailing 28 days to August 1, 2026) isn't one undifferentiated swarm. It's search crawlers and AI assistants on one end, and impersonators on the other.

The cleanest signal here is verification. A verified bot proves its identity (Cloudflare and others confirm it via published IP ranges or signed requests), so GoogleBot, Claude-User, and BingBot in the tables above are bots you can trust to be what they claim. An unverified or spoofed bot sets a user-agent string it has no right to, pretending to be GoogleBot to slip past filters, and these are where most scraping and attack traffic hides. That's exactly why security vendors report higher bot percentages: they're counting the malicious, often-spoofed layer that a verified-bot view filters out.

So should you block bots? It depends on which ones. Blocking verified search and AI-search crawlers costs you visibility in both Google and AI answers. Blocking spoofed and abusive automation protects your infrastructure and data. The honest position is that "block bots" is the wrong instruction. "Block the right bots, by verified identity" is the right one. Getting that distinction wrong is how sites accidentally delist themselves while leaving the actual scrapers untouched.

Frequently Asked Questions

What is bot traffic?

Bot traffic is any web traffic generated by automated software (bots) rather than a person using a browser. It spans search-engine crawlers, AI crawlers, monitoring tools, link previewers, and scrapers. In Q3 2026 bots accounted for 35.49% of all web requests and humans for 64.51%, according to Cloudflare Radar (calendar quarter, July to September 2026). Bot traffic can be legitimate (verified crawlers that identify themselves) or malicious (spoofed scrapers, credential-stuffing, and attack bots).

What percentage of internet traffic is bots in 2026?

Bots were 35.49% of all web requests in Q3 2026 and 36.15% in September 2026 (provisional), with humans at 64.51% for the quarter (Cloudflare Radar, radar/http/summary/bot_class). September 2025 read 29.35%. Other reports put automated traffic above 50% using broader definitions weighted toward application-layer attack surface.

How much has bot traffic grown since last year?

Bots rose from 29.35% of all web traffic in September 2025 to 36.15% in September 2026 (provisional), a gain of 6.80 percentage points on matching calendar months. On full quarters the gain is 5.36 points, from 30.13% in Q3 2025 to 35.49% in Q3 2026 (Cloudflare Radar, radar/http/summary/bot_class, pulled October 1, 2026). The rise wasn't smooth: bot share fell in March and July 2026.

Do bots outnumber humans on the internet?

By Cloudflare Radar's network-wide measurement, no: humans were 64.51% of web traffic in Q3 2026 against 35.49% for bots. The last week of September came closest, with bots averaging 39.63% of daily requests after a step Cloudflare hasn't explained yet. Security vendors such as Imperva (Thales) and HUMAN Security report automated traffic at or above 50%, because they measure the attack surface they defend with a broader "automated traffic" definition. Whether bots "outnumber humans" depends entirely on what you measure.

Is it true that 51% of internet traffic is bots?

Not on Cloudflare's network-wide measure: bots were 35.49% of requests in Q3 2026. The 51% figure comes from Imperva's 2025 Bad Bot Report, which covers 2024 and counts automated traffic across the application traffic that firm protects (login pages, checkout flows, APIs), where bots concentrate. Both numbers can be right, because they measure different populations.

How much of internet traffic is AI?

Cloudflare does NOT publish a single figure for AI's share of all web traffic, and multiplying its numbers together would mix two different populations. What it does publish: bots were 35.49% of all requests in Q3 2026, AI categories were 32.49% of verified-bot requests, and within AI crawling training was 47.62% and live search 8.26% (Cloudflare Radar, Q3 2026).

Is Anthropic still the #2 bot operator?

No. Meta has held second place since July 2026. Across Q3 2026 Anthropic is #3 at 8.84% of verified-bot requests, behind Google (26.91%) and Meta (17.06%), and September alone read 7.29%, its lowest month since it entered Cloudflare's operator table in June (Cloudflare Radar, radar/bots/summary/bot_operator).

Which company operates the most bots?

Google operates the largest share of verified bot traffic at 26.91% in Q3 2026, followed by Meta at 17.06%, Anthropic at 8.84% and OpenAI at 5.64%, per Cloudflare Radar. Google's share is down from 38.29% in Q3 2025. In September 2026 Microsoft (5.51%) passed OpenAI (4.69%) for fourth place.

What is the most active bot on the web?

GoogleBot is the single busiest bot at 12.93% of verified-bot requests in Q3 2026, followed by Meta-ExternalAgent (7.37%), BingBot (4.66%) and Anthropic's Claude (4.28%), per Cloudflare Radar. Claude is the agent Cloudflare listed as Claude-User until August 2026. It performs user-initiated fetches, and in September it ranked third at 5.72%.

How much of bot traffic is AI?

AI-related bot categories made up 32.49% of verified-bot traffic in Q3 2026: AI crawlers (22.12%), AI search (7.03%) and AI assistants (3.35%), against 26.14% for traditional search-engine crawlers (Cloudflare Radar, radar/bots/summary/bot_category). Cloudflare retired the AI assistant category in July 2026 and moved that traffic into AI crawler and page preview, so the combined figure is not like-for-like across that change.

What do AI crawlers do with the data they collect?

Most AI crawling, 47.62% in Q3 2026, collects data for model training, while 8.26% is for live search indexing and 38.86% is mixed-purpose (Cloudflare Radar, radar/ai/bots/summary/crawl_purpose, on Cloudflare's reclassified labels). In practice, the pages an AI crawler reads during training shape the answers an assistant gives later. Content absent from the training pass risks being missing from AI answers entirely.

Why do estimates of bot traffic range from 35% to 50%?

The range comes from different measurement methods, not contradictory facts. Cloudflare Radar measures verified and likely-automated requests across a neutral global network, reporting 35.49% for Q3 2026. Security vendors like Imperva (Thales) and HUMAN Security report roughly half or more, because they weight toward login pages, checkout flows, and APIs where automated abuse concentrates, using a broader automated-traffic definition.

Are good bots or bad bots more common?

The most active individual bots on the web are verified "good bots": GoogleBot, Claude-User, and BingBot lead the rankings (Cloudflare Radar, June 2026). But security vendors report large volumes of "bad bots" that spoof user agents and ignore robots.txt, which a verified-bot view filters out. The answer depends on whether you measure verified identity or total automated activity including impersonators.

How much of AI crawling is for training versus search?

AI crawling was 47.62% training and 8.26% live search in Q3 2026, with 38.86% mixed-purpose and the remainder user-action or undeclared (Cloudflare Radar). Cloudflare reclassified this series in September 2026, moving volume from search into training across its history, so the older ratios in this report (five to one, then four to one) are not comparable. On the new labels training leads search by almost six to one, but search grew fastest, from 1.32% in Q3 2025.

How often are AI crawlers blocked?

About 37.26% of crawler requests received a 4xx error in Q3 2026, more than one in three, while 46.68% got a successful 2xx response (Cloudflare Radar, radar/bots/crawlers/summary/response_status_category). September read 38.06% blocked, so the rate is still edging up; in Q3 2025 it was 14.39%. Much of this pushback targets AI crawlers through robots.txt rules and CDN settings, though over-blocking can remove a site from AI answers along with the unwanted scrapers.

Which country has the most bot traffic?

Singapore has the highest bot share of any major country at 76.6% of web traffic, followed by Ireland (72.9%) and the Netherlands (70.5%), because all three host large cloud data-center regions where automated traffic concentrates (Cloudflare Radar, June 2026). The United States (49.4%) and Germany (50.2%) sit near 50/50, while mobile-first markets like Mexico (11.8%), India (16.2%), and Turkey (16.5%) are the most human.

Do bots use mobile or desktop?

Bots are overwhelmingly desktop: 87.28% of bot traffic was desktop-class in Q3 2026 against 12.64% mobile, because automated clients run on servers rather than phones (Cloudflare Radar). Human traffic is the reverse, at 54.36% mobile and 45.62% desktop. Because device type is harder to fake than a user-agent string, the mobile-versus-desktop split is one of the more reliable ways to distinguish bots from people.

Why does bot traffic skew so heavily to desktop, and does it matter?

Bots run on servers and headless browsers that present as desktop clients, so 87.28% of bot requests read desktop in Q3 2026 against 45.62% for humans (Cloudflare Radar). It matters because bots now bend blended statistics: the web's overall desktop share rose 6.15 points between Q3 2025 and Q3 2026, and about 65% of that came from bot composition rather than people switching devices.

What web browser do most people use?

Among human web traffic, Chrome is the most-used browser at 68.3%, followed by Safari (18.2%), Edge (6.5%), and Firefox (3.7%) (Cloudflare Radar, human-only, June 2026). Bots claim Chrome even more often (78.6%), because headless Chrome dominates scraping and AI fetching, so a very high Chrome share with no matching mobile traffic can itself be a sign of automation.

What is the bot-to-human ratio on the internet?

The bot-to-human ratio is roughly 1 to 2: bots made up 35.49% of web traffic in Q3 2026 and humans 64.51%, so there is about one automated request for every two human ones (Cloudflare Radar). The ratio is far higher in data-center-heavy countries (in the United States bots passed half of requests in September 2026, averaging 51.78% from 15 to 23 September) and much lower in mobile-first markets like Mexico, where bots were 11.8% of traffic in June 2026.

How can you tell bot traffic from human traffic?

The most reliable signals are device type and verification. Human traffic is 54.36% mobile, but bot traffic is 87.28% desktop, because bots run on servers rather than phones (Cloudflare Radar, Q3 2026). Bots also over-claim Chrome (78.6% vs humans' 68.3% in June 2026) and rarely use Safari. The strongest tell is identity: verified bots like GoogleBot and Claude confirm themselves through published IP ranges, while spoofed bots set a user-agent string they cannot prove.

What is the difference between a crawler and a bot?

A bot is any automated program that makes web requests; a crawler (or spider) is a specific type of bot that systematically fetches pages to index or collect them. All crawlers are bots, but not all bots are crawlers: chat-fetch agents, monitoring tools, and webhooks are bots that don't crawl. In Q3 2026 the two largest bot categories on Cloudflare's network are AI bots (32.49% of verified-bot traffic combined) and search-engine crawlers (26.14%).

Are AI crawlers legal?

AI crawling sits in a legal gray area. robots.txt is a voluntary standard, not a binding law in most jurisdictions, so ignoring it is not automatically illegal — but copyright lawsuits against major AI labs and rules like the EU AI Act are actively testing the limits. In practice, the enforceable control is technical: more than 1 in 3 crawler requests (37%) already gets a 4xx block, and many sites restrict AI bots by user agent. See which sites block which AI bots in our robots.txt blocking report.

Are bots taking a bigger share of web traffic than a year ago?

Yes. On full quarters, bots rose from 30.13% of all web traffic in Q3 2025 to 35.49% in Q3 2026, a gain of 5.36 points (Cloudflare Radar, pulled October 1, 2026). On matching calendar months the gain is larger: 29.35% in September 2025 to 36.15% in September 2026 (provisional), up 6.80 points. The sharper change is on the crawler side: 4xx blocks climbed from 14.39% to 37.26% between those two quarters, while successful 2xx responses fell from 73.06% to 46.68%.

Was Anthropic a major bot operator a year ago?

No. Anthropic does not appear in Cloudflare Radar's top nine bot operators for Q3 2025, where the ninth entry is Yandex at 1.90%, so its share that quarter was below 1.90%. It entered the monthly operator table in June 2026 at 12.69%, averaged 8.84% across Q3 2026 for third place, and read 7.29% in September (Cloudflare Radar, pulled October 1, 2026).

Methodology and Data Sources

Q3 2026 refresh (October 1, 2026). The Q3 layer uses calendar quarters Q3 2025 (2025-07-01 to 2025-09-30), Q2 2026 (2026-04-01 to 2026-06-30) and Q3 2026 (2026-07-01 to 2026-09-30), Q1 2026 (2026-01-01 to 2026-03-31) for the vertical comparison only, and calendar months January to September 2026 plus September 2025. Endpoints: radar/http/summary/bot_class, radar/bots/summary/bot_operator, radar/bots/summary/bot, radar/bots/summary/bot_category, radar/http/summary/device_type (unfiltered and with botClass), radar/bots/crawlers/summary/response_status_category, radar/bots/crawlers/summary/crawl_refer_ratio, radar/bots/crawlers/summary/vertical and radar/ai/bots/summary/crawl_purpose. Cloudflare refreshed September on October 1, so September and Q3 are provisional until our next re-pull. September's bot share was second-sourced: 36.15% on the summary endpoint against a 36.20% mean of daily buckets from radar/http/timeseries_groups/bot_class (the Q3 figures agree the same way, 35.49% against 35.46%). Before publishing we re-pulled the figures from earlier editions. Bot share, operator shares, crawler response codes and the human-only and bot-only device splits reproduced exactly. Two series did not: Cloudflare reclassified its AI crawl-purpose history and revised its blended device series, and both are annotated where they appear. Rolling 28-day figures from earlier editions reproduce only approximately, because a rolling window ends at the hour it was pulled. The Q3 envelope carries one Cloudflare data-pipeline annotation, on July 16, 2026 (about two hours of HTTP data). Detection counts come from TechnologyChecker's September 2026 crawl. The industry split covers the 50.8% of bot-defended domains we could match to company information, compared with the same match across all live domains.

August 2026 refresh. The What July 2026 Changed section and every figure marked "August 2026" or "trailing 28 days" was pulled on August 1, 2026. Two window types run side by side in this report and they are not interchangeable, so each figure carries its own label:

• Rolling windows (7d and 28d) are Cloudflare's own trailing windows and react fast to the latest week. The 28-day window used throughout the August layer covers 2026-07-04 to 2026-08-01; the 7-day window covers 2026-07-25 to 2026-08-01.
• Calendar months (July 2025, June 2026, July 2026) are used for the month-over-month and like-for-like year-over-year comparisons, so both ends of each comparison are the same length.
• Calendar quarters (Q2 2025, Q1 2026, Q2 2026) remain in the year-over-year section below as originally published.

Two headline figures were cross-checked against a second endpoint before publication, because Cloudflare occasionally revises a series after the fact. The trailing-28-day bot share reads 34.94% on radar/http/summary/bot_class and 34.96% as the mean of radar/http/timeseries_groups/bot_class daily buckets over the same window. The crawler 4xx rate reads 35.86% on the summary endpoint and 35.87% as the mean of the weekly radar/bots/crawlers/timeseries_groups/response_status_category series. Both agree.

Where Cloudflare does not publish a value we say so rather than estimating one. Anthropic is absent from the top nine bot operators for July 2025 (the ninth is Huawei at 1.80%), so its July 2025 share is expressed as a bound rather than a number. The same applies to Claude-User, which is absent from the July 2025 busiest-bot top nine. One labelling change is worth flagging: in the final week of July 2026, Cloudflare began reporting a separate Claude agent alongside Claude-User, so a single-label read of that week understates Anthropic's user-fetch volume.

Every figure in this report comes from the Cloudflare Radar API, pulled on June 22, 2026, with the year-over-year comparison added on July 3, 2026 and the July 2026 layer added on August 1, 2026. We re-pull these endpoints on publish and update the date stamps, because bot traffic shifts week to week and a year-old number is a stale number. Cloudflare Radar reports aggregate, anonymized traffic observed across Cloudflare's global network; it is one large, neutral vantage point on the web, not a census of all internet traffic. Read it as a high-quality sample, and read the security-vendor estimates as a different, attack-surface-weighted sample.

Watch one technical detail: Cloudflare normalizes some datasets as percentages and one as a ratio. The bot-vs-human, operator, busiest-bot, crawl-purpose, category, block-rate, country, device, and browser figures are all percentages. The crawl-to-refer figure is a ratio (pages crawled per referral), so it is never expressed as a percentage and never charted as a share. A value of 4,580 means 4,580 pages per referral, not 4,580%.

The endpoints and windows used:

• Bot vs human: radar/http/summary/bot_class — 7d (2026-06-15 to 2026-06-22)
• Operator league: radar/bots/summary/bot_operator — 7d (2026-06-15 to 2026-06-22)
• Busiest bots: radar/bots/summary/bot — 7d (2026-06-15 to 2026-06-22)
• Crawl-to-refer ratio: radar/bots/crawlers/summary/crawl_refer_ratio — 28d (2026-05-25 to 2026-06-22)
• Crawl purpose: radar/ai/bots/summary/crawl_purpose — 28d (2026-05-25 to 2026-06-22)
• Bot category: radar/bots/summary/bot_category — 28d (2026-05-25 to 2026-06-22)
• Crawler block rate: radar/bots/crawlers/summary/response_status_category — 7d (2026-06-15 to 2026-06-22)
• Bot share by country: radar/http/summary/bot_class with a per-country location filter — 7d (2026-06-15 to 2026-06-22)
• Human vs bot device: radar/http/summary/device_type, filtered by botClass=likely_human and botClass=likely_automated — 7d (2026-06-15 to 2026-06-22)
• Human vs bot browser: radar/http/summary/browser_family, filtered by botClass — 7d (2026-06-15 to 2026-06-22)
• Human operating system: radar/http/summary/os, filtered by botClass=likely_human — 7d (2026-06-15 to 2026-06-22)

The August 2026 layer re-pulled the following on 2026-08-01, on the trailing 28-day window (2026-07-04 to 2026-08-01) unless noted: radar/http/summary/bot_class, radar/bots/summary/bot_operator, radar/bots/summary/bot, radar/bots/summary/bot_category, radar/bots/crawlers/summary/response_status_category, radar/bots/crawlers/summary/crawl_refer_ratio, radar/ai/bots/summary/crawl_purpose, and radar/http/summary/device_type with botClass filters. The same endpoints were pulled on calendar-month windows for July 2025 (2025-07-01 to 2025-07-31), June 2026 (2026-06-01 to 2026-06-30) and July 2026 (2026-07-01 to 2026-07-31). Verification used radar/http/timeseries_groups/bot_class (daily), radar/bots/timeseries_groups/bot_operator (weekly) and radar/bots/crawlers/timeseries_groups/response_status_category (weekly). All percentage endpoints return PERCENTAGE normalization; radar/bots/crawlers/summary/crawl_refer_ratio returns RATIO and is never charted as a share.

The year-over-year section uses full calendar-quarter windows instead of rolling ones, so both ends of each comparison are measured on the same-length window: Q2 2025 (2025-04-01 to 2025-06-30), Q1 2026 (2026-01-01 to 2026-03-31), and Q2 2026 (2026-04-01 to 2026-06-30). Those figures were pulled on July 3, 2026 from radar/http/summary/bot_class, radar/bots/summary/bot_operator, radar/bots/summary/bot, radar/bots/crawlers/summary/response_status_category, radar/ai/bots/summary/crawl_purpose, and radar/bots/summary/bot_category. Because a full quarter is a smoother, larger window than a rolling week, some full-quarter figures (for example the 33.2% bot share and Anthropic's #5 operator rank) sit below the latest 7-day readings quoted earlier in the report; both are correct for their window.

The country, device, browser, and OS splits use Cloudflare's botClass filter to separate likely-human from likely-automated requests. Browser and OS are read from user-agent strings, which bots can spoof, so the bot-side browser figures reflect claimed identity rather than verified bots.

Source for all Cloudflare figures: Cloudflare Radar (radar.cloudflare.com). The Imperva (Thales) and HUMAN Security estimates are cited for the methodology reconciliation only and use those firms' own broader definitions of automated traffic.

We bring our own vantage point to this too. TechnologyChecker detects the technologies and crawlers behind 29.6M domains, which is how we read operator patterns like these directly rather than secondhand. If you want to see what's running on a specific site, or which companies use a given technology, start with our technology detection & lookup data, or read how the detection works in our technology detection methods guide. For the broader picture of who is building on what, our most popular technologies by category rankings cover the live web behind these bots.

Update history