More Than Half Your Website Traffic May Not Be Human. Here’s What That Means.

Automated traffic now outnumbers people online. Here is what it costs your business and which protections your site actually needs.

Picture Monday morning. Your website report shows traffic up 40% over last month, but the contact form inbox is full of gibberish submissions and sales calls are flat. None of that spike turned into business.

The likely cause is bots: automated programs that browse pages, fill out forms, and attempt logins with no human involved. The security firm Imperva tracks this traffic every year, and its 2026 report found that bots now make up more than 53% of all web traffic, with 40% classified as malicious. AI has made bots easier to build and harder to spot, and AI-driven bot attacks grew 12.5 times in a single year.

The costs add up quickly. Bots distort your website traffic metrics, fill your CRM (customer relationship management system) with fake leads, slow pages for real customers, and try to break into accounts. Here is how businesses protect themselves, and how to decide which protections fit your site.

Related reading: The Importance of Website Traffic: Key Metrics and Small Details That Make a Big Impact

Bot Mitigation: The Right Fit for Some Sites, Optional for Many

As bot traffic has grown, so has the industry built to stop it. Market research firms estimate businesses now spend about $1 billion a year on bot protection, with spending growing roughly 20% annually. Some of the most common options include:

• Cloudflare is one of the most widely used. Its free plan includes basic bot blocking, with more advanced bot management available on paid tiers.
• Akamai Bot Manager is an enterprise-level option, often used by large retail, travel, and financial websites.
• Imperva Advanced Bot Protection comes from the firm behind the annual Bad Bot Report and focuses on sites with heavy login and checkout activity.
• DataDome specializes in real-time bot and fraud detection, with a strong following among ecommerce and media companies.
• Sucuri is a website firewall popular with WordPress and other CMS-driven sites, often bundled with malware cleanup.

Protection comes with a price. Basic tiers are free or inexpensive, but advanced bot management is usually a paid add-on, and enterprise plans are typically quoted individually. At Media Genesis, some of our clients choose to pass on it because of that added cost, and for many of them it is the right call.

Plenty of sites simply do not need it. A company site with a contact form and no customer logins is usually well protected by reCAPTCHA, a secure host, and regular updates. Bot mitigation earns its cost when bots cause measurable harm, such as spam that gets past your forms, traffic surges that slow your site, login attacks, or checkout abuse. Settings matter too, because aggressive rules can block the AI crawlers that affect your AI search visibility.

Protect Your Forms with reCAPTCHA

Forms are the most common bot target on a business website. Google’s reCAPTCHA helps tell humans and bots apart before a submission goes through. Current versions mostly work in the background, scoring each visitor’s behavior and flagging likely bots without asking real people to click on traffic lights.

reCAPTCHA works best alongside a honeypot field (a hidden field people never see but bots tend to fill in) and a limit on how many submissions can come from one source. For many small and midsize sites, this combination stops most form spam on its own.

Logins and Paywalls Need Two-Factor Authentication

Every login on your site is a target, including customer accounts, member portals, paywalled content, and the admin login to your content management system (CMS), the software you use to update your site. Bots run credential stuffing attacks, testing usernames and passwords leaked in other companies’ breaches against thousands of sites. Because people reuse passwords, it works often enough to pay off.

Two-factor authentication (2FA) adds a second proof of identity, usually a code from a phone app or a text message. When Microsoft researchers studied business accounts showing suspicious activity, they found 2FA reduced the risk of compromise by more than 99%. Even for accounts whose passwords had already leaked, the reduction was over 98%.

For paywalled sites, 2FA also protects revenue, since hijacked subscriber accounts get shared and resold. And every administrator and editor account on your CMS should have it turned on.

Website Maintenance Is Part of Security

Bots constantly scan for outdated software, including old CMS versions, unpatched plugins, and aging server languages with known weaknesses. They check every site they can reach, so a small business site gets found as quickly as a large one.

Those update notices in your dashboard are part of your defense, as we explain in our post on why PHP updates matter for your website. When a platform reaches end of life, as with Drupal 7’s end-of-life deadline, security patches stop entirely. Treating CMS maintenance and management as ongoing work keeps every other protection in this post effective.

Matching Protection to Your Site

Go back to that Monday report. The spike that looked like growth came with real costs, and bots will remain a permanent part of the web. The good news is that the defenses are well understood and can be matched to your site: reCAPTCHA on forms, 2FA on logins, regular updates, and bot mitigation when the problem calls for it.

If you want to know how much of your traffic is real and which protections make sense for your site, Media Genesis can help you sort it out. Reach out at mediag.com.

Our Related Work

From Clicks to Clients: CCC’s Data-Driven Growth Strategy With Lead Tracking