Cloudflare: Over Half of Web Traffic Now from AI Agents — A New Challenge for Website Owners

In late September, Cloudflare published a report that is already making waves across the industry — "The Internet has a second audience" — revealing a structural shift in 2026 web traffic using real global CDN data: more than half of all HTTP traffic is no longer human-generated.

Three numbers stand out:

• AI agent daily requests surged 1,700% in just one year — and Cloudflare says this is only the beginning
• HTTP requests per second jumped from 63 million to 115 million, peaking above 150 million; over half are now non-human
• AI training crawlers rose from 22% last spring to 52% by June this year — more than half of all crawler traffic is feeding someone else's AI model for free

The Second Audience: Agents Are Neither Bots Nor Humans

Cloudflare introduced a new category: "agents". They sit between traditional bots and real humans — usually, there is a person behind them using a chatbot to search, book tickets, or compare prices, but the actual HTTP requests come from software. This traffic doesn't click ads, doesn't pay subscriptions, and doesn't stay on pages reading content — but it consumes bandwidth, compute, and origin resources.

Cloudflare's summary was sharp: "For businesses that learn to serve agents and capture value from them, agents are additive. For those who don't prepare, they are extractive."

Doubling Traffic, Declining Revenue — The Brutal Math

For thirty years, the website revenue model was simple: search engines send human visitors → visitors see ads or pay subscriptions → you pay CDN costs. That chain is now broken.

The new reality:

• Answer engines read your page and summarize it for users — but no one actually clicks through to see your ads
• In retail, software, IT services, and finance, human traffic has dropped up to 40% in less than a year
• Every automated request still costs bandwidth and compute, but generates zero revenue

In other words: your CDN bill goes up while your average revenue per million requests goes down. This is why "blocking invalid bot traffic" has moved from an optional optimization to a survival necessity.

"Block Everything" Is Not the Answer — You Need Precision Filtering

Cloudflare admitted their recommendation last year was to "just block all AI training crawlers." But this year's conclusion is more mature: "a blanket block is not nuanced enough". The reason is simple:

• Some agents are real customers — AI proxies booking flights, comparing insurance, purchasing datasets on behalf of humans
• Total blocking means losing this emerging "second audience"
• You need a tiered strategy: which to allow, which to challenge, which to block outright

What This Means for Small and Medium Businesses

Large enterprises can afford DataDome, Akamai Bot Manager, and other enterprise-grade solutions. But for SMEs with limited monthly operations budgets, the key isn't "how much you spend on tools" — it's "what mechanisms filter and block traffic before it even reaches your origin server".

An effective defense requires: WAF rules that auto-update (tracking latest Bot UA/behavior patterns) + high-defense CDN to wash away abnormal traffic layers + 24/7 monitoring that reacts instantly when costs spike. This isn't three products stacked together — it must form a closed loop: detect anomaly → auto-adjust strategy → verify results → keep learning.