Bots Passed Humans in May. Ask Whose Counter.

David Martin Riveros · September 29, 2026 · 5 min read

There is no number for the share of the web that is bots. There are counters. Each counts its own customers' doors, in a unit it chose, and each sells the wall it counts through. Yesterday Cloudflare's founders wrote that automated traffic passed human traffic in May 2026, more than a year ahead of their own forecast. The sentence is true of one counter. On a second counter, bots crossed that line during 2025. On a third, humans were still the majority in January. On a fourth, humans outnumber AI bots thirty-one to one. The disagreement is the finding.

Every crawler I operate sits on the automated side of these charts. So I read the counting rules first.

One company, three dates

Cloudflare has published the crossover three times, with three answers. Its 2025 year in review, with data to December 2, put humans at 47 percent of HTML requests. Other bots were 44 percent and AI bots the rest. On that chart humans were already the minority last winter. In March, at SXSW, Matthew Prince said bot traffic would pass human traffic "in 2027". On June 3 he posted that bots had "now passed human traffic online for the first time in the Internet's history", at 57.4 percent. His caveat: the data was "a bit messy (so charts are too)". Yesterday's letter fixed the date at May and restated the original forecast as the second half of 2027.

Both can be right. The chart is one day. The announcement is a rolling read its author called messy. What the instrument counts is public, and it explains the rest. Radar gives every request a bot score from 1 to 99. Below 30 the request is "likely automated". At 30 or above it is "likely human". A machine-learning model makes most of the calls, from headers, session signals and browser fingerprints. A request with no User-Agent header scores 1. The published share uses only requests for HTML pages. Images, scripts, fonts and API calls are excluded, "to represent traditional web traffic". And the whole thing runs on the sites that use Cloudflare, about one in five. A bot that looks like a browser scores human. A blank-header script scores bot. The crossover date is the day that classifier, on that filter, on those sites, tipped.

Same question, six answers

Put the other instruments beside it and the number stops being a fact about the web.

Thales, which owns Imperva, reported in April that bots were 53 percent of all internet traffic in 2025, up from 51 percent in 2024. Bots passed humans on that counter a year before they did on Cloudflare's. Thales counts what its walls see and block, 17.2 trillion bad-bot requests in 2025 alone, and splits its 53 into 40 points "bad" and 13 "good".

Fastly, another delivery network, reported the opposite. In January 2026, 49 percent of the requests on its network came from bots and 51 percent from humans. Humans were still the majority. Look one layer down and the split moves again. Bots were 47 percent of requests served from cache and 60 percent of those that reached the origin server. Fastly adds one more line. It calls 99 percent of its bot requests "unwanted", meaning unverifiable, and finds that "only 1 out of 100 bot requests comes from a verified, identifiable source".

DataDome, which sells bot protection, published its report last Tuesday. Bots and agents were 26.5 percent of traffic across its 75,000 customer sites in the year to June. That is less than half of Cloudflare's figure, for overlapping months. HUMAN, another vendor, published no share in March, only growth: eight times faster than human traffic in 2025.

Then the publisher-side counters, which do not count requests at all. TollBit, which sells a paywall for bots, counts visits across 3,906 publisher sites. At the end of 2025 it found one AI bot visit for every 31 human visits. In Europe in the first half of 2026 it found 179 bot visits for every human an AI app sent back. Chartbeat counts referrals, the visits a site can trace to a source. AI apps delivered 0.01 percent of publisher traffic in the year to July, while Google search referrals fell 40 percent. Comscore counts people, on an opt-in panel of up to a million users, and reports shares of prompts, not requests.

The unit is the answer

The spread is not noise. It is the unit. A delivery network counts requests. A person loading one page fires one HTML request and dozens of asset requests. A crawler often fires the HTML request alone. Cloudflare drops the assets so the two look alike. Fastly keeps everything, so cache and origin disagree. An agent doing one task visits, in Prince's own example, 1,000 times the sites a person would. Counted in requests, that agent is a crowd. Counted in visits, it is one visitor who came back 1,000 times. Counted in referrals, it never existed, because it sent nobody anywhere. Counted in people, it is a fraction of one panelist.

The basket moves the number as much as the unit. Every instrument here measures its own customers. DataDome's 75,000 sites bought bot protection. TollBit's publishers joined a bot-measurement network. Thales counts at the walls it sells. Cloudflare's fifth of the web is the fifth that chose Cloudflare, which is not a random fifth. One counter on this list publishes its basket instead of a share. Common Crawl's September archive holds 2.17 billion pages from 33.2 million domains, fetched between September 4 and 17. You can download it and check. You cannot check a percentage.

Every counter sells a wall

Read the list of authors again. Cloudflare sells bot management and a pay-per-crawl toll. Thales sells the Imperva wall. Fastly and DataDome sell bot mitigation. HUMAN sells bot detection. TollBit sells the bot paywall. Each number is the top of its publisher's funnel, and each is true of its own network. Nobody here is lying. But a market that sizes itself from the sellers' counters will size itself high. It will also date the crossover to whichever counter tips first.

I have a stake in the unit. Under Fastly's definition my crawlers belong to the 99 percent that is "unwanted", because unverified means unwanted, whatever the intent. Two weeks ago I wrote about the name a bot gives at the door. On these counters the name is the difference between the two columns.

The letter's other number, 1,000 times human traffic within five years, will probably come true on that same counter. It will be quoted without the counter.

My position, dated so it can be graded: these counters will diverge further, not converge. By September 2027, one of the four network-scale instruments will headline an automated share above 60 percent. Another will headline one below 30 percent for overlapping months. Both will be quoted as the web. I am wrong if Cloudflare, Thales, Fastly and DataDome all land within ten points of each other. I am also wrong if any of them prints its unit and its customer basket beside the headline, so the numbers can be reconciled, and the others follow.