How much of the internet is actually bots right now
More than you would guess. Imperva's 2025 Bad Bot Report found that automated traffic accounted for 51% of all web traffic in 2024, surpassing human activity for the first time in a decade. Within that figure, bad bots specifically (as opposed to legitimate crawlers like search engine indexers) made up 37% of all internet traffic, up from 32% the year before, the sixth consecutive year that share has grown. As Tim Chang, General Manager of Application Security at Thales, put it on releasing the report: "The surge in AI-driven bot creation has serious implications for businesses worldwide. As automated traffic accounts for more than half of all web activity, organizations face heightened risks from bad bots, which are becoming more prolific every day."
Why a JavaScript analytics tool already blocks most of it
Here is the part that works in your favour without you doing anything: tools like TrackTrendy and GA4 run by executing a small script in the visitor's browser, rather than reading raw server logs. A script that never runs JavaScript, which describes the majority of basic bots, search engine crawlers and simple scrapers, never fires the tracking call in the first place. Server-log-based analytics counts every request indiscriminately, bots included; a JavaScript snippet only counts what actually rendered a page, which is already a meaningful filter before you do anything else.
What still gets through
The bots worth worrying about are the ones built to look like a real browser. Headless browser tools (used for automated testing, uptime monitoring, and increasingly for AI systems that browse the live web rather than just crawling a static copy) execute JavaScript the same way a person's browser does, so they register as a session like anyone else. These tend to show up with telltale patterns: very short visits to the same one or two pages, traffic at perfectly even intervals (every hour, every six hours), sessions from data-centre IP ranges rather than residential or mobile networks, or a spike in visits with no referrer and no campaign source behind them.
Practical ways to spot it in your own reports
- Check for suspiciously regular timing. A visitor landing on the same page every hour on the hour is a monitoring script, not a person re-reading your pricing page.
- Look at geography against your actual audience. A sudden run of sessions from a country you have no customers, ads, or content targeting is worth a second look.
- Watch single-page, zero-engagement sessions from unfamiliar referrers. A few of these are normal; a sustained pattern from one source usually is not.
- Separate it from the bot traffic question for unique visitors. If a count still looks inflated after this check, see unique visitors in Google Analytics for how GA4 separately filters known bots from its own counts.
Keep this in proportion
Bot traffic is a real and growing share of the internet, but it does not mean your own dashboard is unreliable by default. Most of it never reaches a JavaScript analytics tool, and what does get through is usually identifiable by the patterns above rather than hidden inside normal-looking numbers. Treat it as a periodic check, the same way you would glance at the metrics that actually matter, rather than a reason to distrust every session in your reports.