# Bad Bots Are Now 40 Percent of Web Traffic: What That Means for Small Sites

Source: https://botbulwark.com/blog/2026-11-09-bad-bots-40-percent-web-traffic-2026.html

[Home](../index.md) / [Blog](index.md)


**Short answer:** Bots now generate more than half of all web traffic, and 40 percent of it is malicious. For a small site that means your analytics, your ad spend, and your checkout are all being touched by traffic that was never a customer. The question is not whether bots visit your site. It is which ones you can see.

## The number, and what sits behind it

Imperva's 2026 Bad Bot Report puts automated traffic at 53 percent of all web traffic, with 40 percent classified as malicious. That is not a rounding error and it is not a big-site problem. A small store sees the same share, just with smaller numbers, and the effects land harder because there is less real traffic to dilute them. A hundred bot sessions on a site that gets a thousand real visits a month moves every metric that matters.

DataDome's State of Bot and Agent Security 2026 adds the direction of travel. Scalping activity rose 290.7 percent between July 2025 and June 2026, with median daily volume nearly quadrupling. Only 2.4 percent of websites are fully protected against bots and spoofed AI agents, down from 8.4 percent in 2024. The protection gap is widening while the traffic grows. Most sites are not defended. Most site owners do not know it.

## Where the 40 percent shows up first

It shows up in analytics before it shows up anywhere else. Sessions climb, orders stay flat, and the conversion rate falls by half for no reason anyone can find. One Shopify merchant reported 16,105 sessions from Singapore in ten days, 41 percent of total traffic, with zero orders, a 99.29 percent bounce rate, and an average session duration of 0.75 seconds. Removing the bot sessions moved the apparent conversion rate from 0.35 percent to a credible 3 to 5 percent. The store was fine. The denominator was fake.

It shows up in ad spend next. Lunio's 2026 Global IVT Report measured an 8.2 percent invalid traffic rate on Meta ads. On $10,000 a month of spend, that is about $820 paying for nobody. The worse cost is data poisoning: fake PageView and AddToCart events train the ad platform to find more traffic that behaves like bots. [Segmenting bot traffic in analytics](https://botbulwark.com/blog/2026-11-07-segment-bot-traffic-analytics.md) is the first step, because you cannot fix a number you cannot see.

## What to do when you are the 97.6 percent

Start with measurement, not blocking. Shopify now ships a human-or-bot session dimension in its analytics, and since September 21, 2026, identified bot sessions are excluded from session reports by default. Add the dimension, switch the filter to include bots, and read how big the bot row is next to the human one. That one comparison tells you whether your traffic problem is bots, targeting, or the store itself.

Then block the obvious and challenge the rest. Known bad crawlers and datacenter ranges get a hard block. Everything else gets a challenge at the expensive actions: account creation, checkout, password reset. [Good bots and bad bots are not the same traffic](https://botbulwark.com/blog/2026-11-08-good-bots-vs-bad-bots-crawlers.md), and a block list that cannot tell them apart will take your search rankings down with the scrapers. The 40 percent is not going away. The sites that survive it are the ones that measure it first.

## Frequently asked questions

### How much web traffic is bots in 2026?

Imperva's 2026 Bad Bot Report puts bots at 53 percent of all web traffic, with 40 percent classified as malicious. Lunio measured an 8.2 percent invalid traffic rate on Meta ads in the same period.

### Why does bot traffic hurt small sites more?

A small site has less real traffic to dilute the fake sessions, so a hundred bot visits moves every metric. Conversion rate, bounce rate, and session duration all shift, and ad platforms learn from the fake events.

### How do I see how much of my traffic is bots?

In Shopify Analytics, add the human-or-bot session dimension to a report and switch the filter to include bots. Since September 21, 2026, identified bot sessions are excluded from session reports by default, so you have to switch them back in to see the size of the problem.

### What does fully protected against bots mean?

DataDome's 2026 report found only 2.4 percent of websites fully protected against bots and spoofed AI agents, down from 8.4 percent in 2024. Most sites have partial defenses or none, and many owners do not know which.

[Get a free bot-traffic audit](mailto:hello@botbulwark.com?subject=Free%20free%20bot-traffic%20audit)