More than half of web traffic is not human: why AI agents are the new audience for a company website
According to Cloudflare, non-human traffic passed half of the total in 2026, and requests from AI agents grew 1,700% in a year. In the sectors AI reads the most, human visits dropped by as much as 40%. An agent reads a page on behalf of someone who asked a question: turning it away means turning away a customer.
In brief
- On Cloudflare’s network, more than half of traffic in 2026 is non-human for the first time, and requests from AI agents grew 1,700% in a year. Imperva, on a different network, puts automated traffic at 53% as early as 2025.
- In the sectors AI reads the most, namely retail, software, IT services, and finance, human traffic has dropped by as much as 40% in less than a year.
- An AI agent opens a page because a person asked a chatbot a question: turning it away means turning away whoever sent it. Fewer than 1% of sites block search crawlers; 17% block training.
For thirty years a website had one audience that mattered: people. On September 30, 2026, Cloudflare, the company that more than 20% of the web runs through, wrote that this audience is now the minority: this year, for the first time, more than half of traffic is not human. A second audience has arrived alongside people, made of software that reads pages on their behalf. For a company, that changes who the site is for, what visits measure, and who is worth letting in.
Index
The numbers: two networks, one direction
At the end of 2024, Cloudflare’s network handled an average of 63 million requests per second. Today it handles 115 million, with peaks above 150 million. The growth comes from machines: in one year, daily requests from AI agents rose by more than 1,700%, and in 2026 non-human traffic passed half of the total.
A second measurement comes from Imperva, which protects websites and applications from bots. In its 2026 report, released on April 29, automated traffic accounts for more than 53% of web traffic in 2025, up from 51% in 2024; human traffic has fallen to 47%.
The two sources disagree on one point: Imperva dates the crossover to 2024, Cloudflare to 2026. They measure different networks with different methods, and both sell the tools for managing the trend they describe, so the numbers should be read with that in mind. On the direction, though, they agree: the human share shrinks every year.
Fewer people on the page
Cloudflare’s second figure hits the bottom line harder. In the sectors AI crawlers read the most, namely retail, computer software, IT services, and financial services, human traffic has dropped by as much as 40% in less than a year. The machines keep coming; the people, who are the ones who buy and subscribe, come less often.
The reason lies in how people search. An answer engine reads the text and hands back a summary, and the person who asked often stops there: when an AI summary appears in Google results, searchers click through to a site 8% of the time versus 15%, according to the Pew Research Center. For the site, the costs stay, because every automated request uses bandwidth and server capacity, while the visit that used to bring a lead or a sale is gone.
What an AI agent is
An AI agent is software that acts on a person’s behalf. Someone who asks a chatbot to compare three vendors, book a table, or find a quote sets off a program that opens pages, reads them, and reports back. It sits between a person and a traditional bot: it doesn’t look at ads, but there is someone behind it with a job to get done.
Cloudflare separates agents from the crawlers that collect text to train models. Those pass through, copy, and leave. An agent comes back every time someone asks about that content: its traffic follows human routines, with a weekly rhythm and a dip over the summer holidays, and it grows with the number of questions people ask, not with the number of pages published.
That leads to the most useful line in Cloudflare’s whole analysis: turning an agent away may mean turning away the person who sent it. Imperva reaches the same conclusion by a different route and calls agents a new category of internet participant, one that retrieves data, executes tasks, and completes purchases.
Search, agents, training: three different visits
The label “AI bot” covers very different visits, and what matters is what each one does. AI-related automated visits come in three kinds. Search crawlers read pages so they can cite them in answers. Agents open them when a user asks. Training crawlers collect text to build models.
The balance among the three has shifted fast. In spring 2025, 22% of crawler requests stated training as their purpose; by June 2026 it was 52%. Site owners have drawn the line accordingly: fewer than 1% of sites on Cloudflare block search crawlers, while 17% block training. They want to be found without giving their content away.
The tools follow the same split. Since July 2026, Cloudflare has offered three separate controls, for search, agents, and training, on every plan including the free one, and since September 15 an instruction that keeps a site in search while opting out of training, which Apple, Google, and Microsoft have committed to honor. The same goes for the robots.txt file: OpenAI runs separate bots for search and training, and you can allow the first and disallow the second.
What changes for a company
The first consequence is that the site has two audiences. A page designed only for the eye, with information inside images or behind menus that open on click, is half empty to a machine. On US retail sites, product pages are on average only 66% readable by AI: a third of the content never reaches the system that has to summarize it.
The second concerns the numbers you look at every month. With more than half of traffic made of machines, visits no longer measure interest. A spike may be a bot rereading the price list; a drop may hide customers who got their answer inside a chat and had no need to click. Imperva says the same: engagement, conversion rates, and demand signals are getting harder to read. Alongside visits, you need to measure the brand’s presence in the answers.
The third: agent traffic grows with questions. What drives it is the page that answers the question a customer actually asks, with the facts and figures a model can report.
The fourth is a check to run right away: make sure you haven’t locked the door by mistake. Until July, Cloudflare offered a single switch, “block AI bots”; anyone who had turned it on should look at how it was carried over into the three new controls, because agents and search are the two channels that bring a brand into the answers. For a company that sells products or services, the sensible choice is to leave search and agents open and decide separately on training.
Then there is payment. Cloudflare is testing two systems for charging AI companies for the use of content, after more than 50 deals signed since 2023, almost all between large publishers and large AI companies. That matters to businesses that live on content. For a company that sells something else, the math is different: the value lies in being read and cited, and charging for entry would mean dropping out of the answers.
Where to start
Before touching the site, you need to know where things stand: whether AI names the brand when a customer asks for a recommendation, what it says, and which sources it draws on. That is the job of an AI Brand Audit: 80 questions across 6 AI platforms, with the sources behind each answer and a comparison with competitors.
Then the measurement has to be repeated, because agents come back with every question and the answers shift with every model update: the IntentIQ platform compares answers from 6 AI platforms on the same questions, over time. Agent traffic grew 1,700% in twelve months: a measurement taken once goes stale fast.
Frequently asked questions
It is software that acts on a person’s behalf: it opens pages, reads them, and reports back when someone makes a request to a chatbot, such as comparing vendors or finding a quote. It differs from the crawlers that collect text to train models, because it comes back every time someone asks a question.
More than half. Cloudflare writes that in 2026, for the first time, non-human traffic passed 50% on its network. Imperva puts automated traffic at more than 53% in 2025, up from 51% in 2024. These are two different networks, measured with different methods.
It depends on which ones. Blocking search crawlers and agents removes the brand from AI answers: fewer than 1% of sites on Cloudflare do it. Blocking training crawlers is a legitimate choice, made by 17% of sites. The three types are managed separately, in robots.txt and in the Cloudflare dashboard.
No. That theory claims that most content and users online are fake. The Cloudflare and Imperva data say something else: more than half of the requests sent to websites come from software. A growing share of that software works for real people who asked a chatbot a question.
