Recent research by Incapsula indicates that automated bots now account for 61% of all website traffic, a striking increase of 21% compared to last year.
Not all bot traffic is harmful. Many bots, like search engine crawlers, play a useful role by indexing content, enabling users to find pages more easily, and supporting services that improve the web experience.
Most of the growth is attributable to these beneficial bots. Examples include search engine crawlers that index sites, analytics tools that collect performance data, and preservation bots that help organizations archive web content.
Activity from these helpful bots rose by 55% over the year. This surge appears to be driven largely by search engines refreshing and reindexing content more frequently.
On the positive side, many types of malicious bot activity have declined.
Automated spam link postings have dropped by 75%, and activity from hacking-related bots — those used to distribute malware, steal payment information, or deface sites — fell by about 10%.
However, not all trends are favorable. The use of impersonator bots, which mimic legitimate sources such as search engines to evade detection, increased by 8%. These bots are often designed for specific attacks, such as DDoS (Distributed Denial of Service) campaigns aimed at knocking websites or online services offline.
Incapsula, a company that focuses on website performance and security, based its findings on data from 20,000 client sites and observed 1.45 billion bot visits over a 90-day period.
Dr. Ian Brown, associate director of Oxford University’s Cyber Security Centre, cautioned that measuring malicious visits involves some unavoidable uncertainty because attackers deliberately try to hide their origin. He also noted that the overall rise in traffic will increase load on website operators, though he believes that at this scale most organizations can manage the added strain.
These findings highlight a mixed picture: an accelerating presence of automated traffic driven largely by beneficial crawlers and analytics tools, alongside evolving threats such as impersonator bots. Website owners should remain attentive to bot behavior—optimizing for legitimate automated traffic while maintaining defenses against deceptive or malicious activity.
What do you think about Incapsula’s findings? Are they surprising or expected?