By one measure, automated traffic already made up 53% of all web traffic in 2025. That’s Imperva’s Bad Bot Report, which counts app and API traffic alongside web pages. Cloudflare’s own numbers, tracking HTML page requests specifically, show something closer to a seesaw through 2025: bots pulled well ahead of humans for stretches of the year, then fell back behind by December. The clean, sustained crossover came later: on June 3, 2026, Cloudflare co-founder Matthew Prince reported automated traffic at 57.5% of HTML requests, a milestone Cloudflare had originally predicted for 2027 and hit 18 months early. However you slice the measurement, the direction is the same: most site owners still picture their traffic as mostly human, and by mid-2026 that stopped being reliably true.
What that looks like on a real WordPress site
The scale gets concrete fast once you look at actual request logs. In a single 24-hour period, bots hit add-to-cart URLs on one tracked site 7.67 million times. ClaudeBot alone was responsible for 3.75 million of those requests to shopping cart pages in that same window. On a separate site, one crawler generated 550 million requests over 30 days before it was stopped.
None of that is malicious in the traditional sense. Most of it is AI companies’ crawlers indexing content or gathering data. But “not malicious” and “not costly” are different things: every one of those requests still has to be served, whether or not it ever benefits a human visitor.
Why “unlimited bandwidth” undersells the real cost
The bandwidth number is the part everyone measures because it’s the easiest to see on a bill. It’s also the smaller part of the actual cost. Every one of those millions of requests still triggers PHP execution, a database query, session handling, and whatever plugin logic runs on that page — the same backend work a real visitor would trigger, whether or not a human ever sees the response. A site can stay technically online and look stable in uptime monitoring while still absorbing meaningfully higher server load than its traffic dashboards suggest, because dashboards built around human visitor metrics don’t always separate that load out.
AI-driven bot traffic isn’t a one-time spike, either — the 550-million-request crawler and the 7.67-million add-to-cart hits above both happened within single, short windows, on top of whatever a site’s regular bot traffic already looked like. That’s a trend line, not a blip.
What this means when you’re picking a plan
This is exactly why bandwidth caps on shared hosting are a worse deal today than they were five years ago. The traffic hitting your account was never entirely under your control to begin with, and now a majority of it isn’t human at all. AllCloudHost’s shared hosting plans include unlimited traffic specifically because bot load shouldn’t be the thing that pushes a legitimate small business site into an overage charge.
The practical takeaway isn’t to panic about bots — most of it is unavoidable background noise of running a public website in 2026. It’s to stop assuming your hosting plan’s traffic allowance was sized for a web that’s still mostly human, because it isn’t anymore. If you do want to reduce bot traffic hitting a WordPress site specifically, that starts with visibility — knowing which requests are bots in the first place — before reaching for blocking rules that might catch legitimate crawlers too.