More Than Half of Internet Traffic Is No Longer Human: What's Hiding Behind the Numbers

Cloudflare's Chief Financial Officer, Thomas Seifert, shared a striking forecast while presenting the company's second-quarter financial results to analysts: "If current trends continue, within five years non-human traffic could outnumber human traffic 1,000 to 1. That's not because human traffic is declining, but because non-human traffic is growing so fast that people risk becoming little more than a statistical rounding error on the internet." This is already playing out: Cloudflare had previously forecast that machine traffic would overtake human traffic in 2027, but that milestone was already reached in May 2026 — according to the company's own published data, less than half of requests to HTML pages are now made by humans.

But Search Engine Journal writer Slobodan Manich personally examined his own website's traffic and uncovered an unexpected detail behind these figures. Over the course of a single day, the site received roughly 3,000 requests, a third of which failed — a jump of more than 1,000 percent compared to the previous period. The most active "AI crawler" turned out to be CCBot, run by the nonprofit Common Crawl (1,510 requests), followed by ChatGPT-User (375), ClaudeBot (296), and Googlebot (245).

But when the author checked which pages these requests actually targeted, he ran into an unexpected reality: most of the requests arriving under the CCBot name were not aimed at articles at all, but at sensitive data. The most frequently requested paths included /.ssh/known_hosts (42 times), /.env.production (29 times), firebase-service-account.json (26 times), and similar files containing passwords, access keys, and cloud service credentials. Across these hundred paths there were 1,028 requests in total — yet requests directed at the articles he had actually written were close to zero.

Even more troubling, the list also included newer paths such as /.mcp.json (30 times) and /.continue/config.json (24 times). These are MCP (Model Context Protocol) configuration files that connect AI agents to external tools, along with coding-assistant config files — both of which typically store API keys and access tokens. The author concludes that this is not an ordinary web-page crawler, but a scanner hunting for sensitive data while disguised as Common Crawl — and these requests left no trace in security logs, being recorded simply as "AI bot traffic."

The author also points to an analysis Cloudflare itself published this same week: the company's engineering blog noted that many "well-behaved" bots are also repeatedly requesting pages that haven't changed, generating billions of pointless requests. At the same time, the author highlights a contradiction in Cloudflare's position: the company, on one hand, is portraying — or perhaps inflating — the machine-traffic problem, while on the other hand selling the very services that solve that same problem. The takeaway is that the broad label "AI traffic" can lump together very different phenomena — useful bots, wasteful repeat requests, and even malicious scanners — which is why every website owner needs to examine their own logs personally.