Date: July 1, 2026 ｜ Source: Kinsta《AI & Bot Traffic: Findings from 10 Billion Requests》, Cloudflare Radar 2025 Year in Review, Akamai Digital Fraud & Abuse Report 2025
Kinsta recently published a heavyweight research report analyzing over 10 billion HTTP requests, revealing a chilling reality for webmasters: the real threat to your servers and CDN costs is not malicious attacks, but poorly behaved AI crawlers.
These bots are not trying to hack your system or launch a DDoS — they're just "dumb." And because they're dumb, the damage is worse.
Kinsta's infrastructure logs captured a set of unbelievable numbers: a single bot (meta-externalagent, i.e., the Meta AI / Facebook AI crawler) sent up to 76.7 million requests to a site's cart URL (?add-to-cart=) in just 24 hours.
To put it another way: approximately one request every 23 milliseconds, around the clock, nonstop.
These are not cached static pages — each request triggers a full PHP thread, database query, and session handling. Your server is doing "virtual checkout" for an AI crawler.
Kinsta CTO Daniel Pataki pointed out in the report that the root cause lies not in "malice" but in "behavioral flaws":
Modern websites (especially e-commerce, WooCommerce, booking systems) generate countless query string variations based on filters, sorting, pagination, etc. To a human, these are the same page; but to an AI crawler, every URL variant is an entirely new page.
What a human sees as one product page, a bot might see as six completely different URLs. The result? The bot finds a link → follows it → generates a new URL variant → follows again → keeps generating more — creating an infinite loop with no exit.
"It doesn't look like an attack — more like a bot stuck in an endless loop. Some of these loops ran undetected for multiple days before infrastructure rules caught them." —— Kinsta CTO Daniel Pataki
Kinsta's research also revealed a concerning breakdown: of the 76.7 million cart requests, 48.9% came from Google-family crawlers (Googlebot + Google-Extended). In other words, the crawler you absolutely cannot block is equally responsible for massive无效 requests.
Cloudflare Radar's 2025 Year in Review confirms this trend:
A common first response is "just add a CDN." But Kinsta's research makes it clear: caching static pages does nothing against these requests.
Because bots are not hitting your homepage or blog posts — they're hitting:
?add-to-cart= — cart action endpointsAll of these are dynamic endpoints that cannot be cached. Every request consumes full server resources: PHP threads, database queries, session handling.
David Belson, former Head of Data Insights at Cloudflare, gave the most precise summary in the report: "The problem isn't bot volume — it's bot behavior."
He points out that the key solution is neither "block everything" nor "let it all in," but rather — "put a bouncer at your door to decide who gets in, who doesn't, and what behavior needs to be restricted."
Another staggering figure from Kinsta: a single loop rule filtered 550 million requests over 30 days. This means that with proper bot behavior detection and rate limiting, hundreds of millions of无效 server loads can be eliminated.
For budget-conscious SMBs, there are two paths: