Published: June 21, 2026 | Sources: Kinsta data analysis, ETH Zurich + Cloudflare research report
According to the latest server data published by Kinsta, a single WordPress e-commerce site received 3.75 million AI bot requests against its shopping cart pages in just one hour. These automated scripts from large language model training machines don't produce a single sale — but they consume your CDN bandwidth, trigger backend processing logic, and ultimately show up on your monthly bill.
Hear that? According to research jointly published by ETH Zurich and Cloudflare in April 2026, approximately 32% of global web traffic is generated by automated AI crawlers. And this ratio continues to climb — because 2026 is the year of "Agentic AI."
Most enterprises think that using Cloudflare, AWS WAF, or Akamai is enough to block junk traffic. But the research reveals a deeper problem: AI crawlers are fundamentally bypassing traditional CDN caching mechanisms.
| Attack Method | Traditional CDN Cache Protection | AI Bot Workaround |
|---|---|---|
| Request Pattern | Fixed URL + random UA | Each request uses a different UA + renders content via JavaScript before requesting |
| Cache Busting | —— | Actively injects cache-busting parameters to force every request back to the origin server |
| Rate Limiting | IP-level throttling | Distributes across thousands of IP pools, each under the threshold |
| Cost Impact | —— | Enterprises pay 15-40% extra CDN costs for "fake traffic" |
In response to this problem, major CDN vendors are rolling out new solutions:
The issue is: most small-to-medium businesses simply don't have the resources to set up these complex rules. You don't need to write Cloudflare workers yourself, research every crawler fingerprint, or wake up in the middle of the night scared by your CDN bill.
This is the most ironic part: you pay CDN vendors to route traffic to your server. But that traffic isn't humans who might buy from you — it's AI models coming to "read" your content. AI companies profit (training data, SEO ranking), while you pay infrastructure costs with no return.
Kinsta's research shows that a single WordPress site can have up to 35% of its total traffic come from invalid crawlers. In other words: for every $100 you pay in CDN fees, about $35 goes toward serving someone else's AI.