Bot Traffic and Automated Attack Statistics Guide: Credential Stuffing and Scraping

More than half of web traffic is now automated, yet almost every bot statistic comes from a vendor counting traffic on its own customers' sites, so the same question gets very different answers depending on who measured it. This page collects the most cited recent figures on bot traffic, credential stuffing, scraping and AI crawlers from their original publishers: the Imperva Bad Bot Report (2025 and 2026 editions), the Cloudflare Radar 2025 Year in Review and Cloudflare login research, the F5 Labs 2025 Advanced Persistent Bots Report, and Akamai's State of the Internet research. Each figure carries its publisher, report and period. It is written for application security, fraud and identity teams who need defensible numbers for a business case, a threat model or a board paper. How to defend against bots is covered in the Bot Management Guide; this page sticks to the numbers and what they imply. Last reviewed: November 2026.

Key takeaways

• Bots now outnumber people on the web. Imperva measured automated traffic at 51% of all web traffic in 2024 and more than 53% in 2025, with human traffic at 47% (Imperva Bad Bot Report 2025 and 2026).
• Login pages are mostly attacked by machines. Cloudflare reported in March 2026 that 94% of login attempts it observed over the previous three months came from bots, and that 63% of logins involved credentials already compromised elsewhere.
• Financial services is the top target for account takeover. Financial services accounted for 46% of account takeover incidents and 24% of all bot attacks in Imperva's 2026 data.
• APIs are a primary bot target. Imperva found 44% of advanced bot traffic targeted APIs in 2024, and 27% of bot attacks targeted API endpoints in 2025.
• AI crawlers are a fast-growing but still small slice. Cloudflare measured AI bots at an average of 4.2% of HTML requests in 2025, while Akamai reported AI bot activity up 300% in a year.

How to read bot statistics

Bot figures are not comparable across publishers. Each vendor sees a different customer base, defines "bot" differently and counts different units (requests, sessions, login attempts or attacks).

• Mitigated versus unmitigated traffic: F5 notes most of its customers have run bot protection for years, so its data skews towards persistent bots that keep retrying. Its rates are lower than figures from unprotected sites.
• Share of traffic versus share of attacks: "bots are 53% of traffic" and "financial services is 24% of bot attacks" are different denominators. Never combine them.
• Good bots count too: automated traffic includes search engine and monitoring crawlers. Only part of it is malicious.

Share of traffic that is automated

• Why the figures differ: Imperva's 53% describes traffic reaching its customers' applications; F5's 10.2% describes transactions on flows that have been protected for years; Cloudflare's split covers HTML page requests only. All three are true for their own scope.
• Origin of bot traffic: Cloudflare found 40% of global bot traffic came from the United States, and that AWS and Google Cloud originated a quarter of global bot traffic in 2025. Cloud hosting makes IP reputation a weak signal on its own.
• Simpler bots, more of them: Imperva attributes the rise in simple bots to AI tools that lower the skill needed to build them. Volume grows even where individual bots are unsophisticated.

Credential stuffing and account takeover statistics

Automated login abuse is where bot statistics meet identity security. Credential stuffing (MITRE ATT&CK T1110.004) replays username and password pairs leaked from other sites; password spraying (T1110.003) tries common passwords across many accounts.

• WordPress exposure: Cloudflare reported that 76% of leaked-password login attempts against WordPress sites in its sample succeeded. Small sites without rate limiting or MFA are where stuffing pays best.
• The numbers are consistent in direction: two Cloudflare datasets a year apart and Imperva's account takeover growth all point the same way, even though the methods differ. That agreement is what makes the trend defensible.
• Real consequences: the 23andMe Breach 2023 began with credential stuffing against about 18,000 accounts and ended with data on nearly 7 million people exposed through a sharing feature. Login automation is a data breach path, not just a fraud cost.

Response steps for an active attack are in the Credential Stuffing Attack Response Playbook, and preventive controls in the Password Spraying and Credential Stuffing Defence Guide.

Bot attacks by industry and business flow

• Business logic, not vulnerabilities: most of these flows (login, search, gift card balance, booking, checkout) work as designed. The abuse is in volume and intent, which the OWASP Automated Threats to Web Applications project catalogues as OAT threat events and the OWASP API Security Top 10 2023 lists as API6:2023 Unrestricted Access to Sensitive Business Flows.
• APIs carry the weight: Imperva found 44% of advanced bot traffic targeted APIs against 10% targeting applications in 2024. Mobile and partner APIs often lack the browser signals bot defences rely on.
• Sophistication varies by sector: F5 found advanced bots made up 49.64% of web login automation in healthcare and 37.90% of web automation in banking, while overall advanced bots were just over 24% of web automation.

The attack types behind these flows are ranked in Top 10 Automated Bot Attacks.

AI crawlers and AI-driven bots

• Small share, large effect: AI crawlers are a single-digit share of requests, but crawl-to-referral ratios show they take content at scale while sending little traffic back. The cost falls on publishers and on anyone whose content or pricing is a competitive asset.
• Attribution is hard: F5 links its scraping increase to AI companies but states no independent investigation into the source was carried out. Treat claims about who is scraping as hypotheses unless the crawler identifies itself.
• Agents blur the line: AI agents acting for real users will make the human versus bot split less useful. The Bot vs AI Agent Traffic Management Guide covers how to tell them apart, and the Web Bot Auth HTTP Message Signatures Guide covers cryptographic bot identity.

Where identity fits

Every authenticated bot is using an identity: a stolen customer credential, a scraped session token, an API key embedded in a mobile app or a legitimate partner integration. Much of the abuse described above targets the login step or APIs, so bot defence and identity controls are one problem. Practical implications:

• Customer credentials: leaked-credential checks at login and phishing-resistant authentication remove most of the value of a stuffing list. See the Account Takeover Prevention Guide.
• API keys and tokens: keys shipped in client apps are machine credentials that bots extract and reuse. Treat them as non-human identities with scope, rotation and monitoring.
• Good bots need identities too: verified crawler programmes and signed requests give legitimate automation a provable identity, which makes blocking the rest easier.

What the numbers mean for defenders

Metrics worth tracking internally, because they turn industry figures into your own baseline:

1. Bot share of login attempts per application, compared with the 94% Cloudflare figure.
2. Leaked-credential hit rate at login and the share of those accounts forced to reset.
3. Account takeover rate per 10,000 active accounts, split by web and mobile.
4. Automated share of sensitive flows (search, gift card, checkout, booking) before and after mitigation.
5. Time to mitigate a new automated campaign from first detection.

Common mistakes when using bot statistics

• Quoting "half the internet is bots" as a threat figure: automated traffic includes search engines and monitoring. Use the bad bot share (37% in Imperva's 2024 data) when the point is malicious activity.
• Mixing denominators: share of traffic, share of attacks and share of login attempts are different measures and cannot be added or compared directly.
• Applying protected-customer rates to unprotected sites: F5's figures are measured after years of mitigation; an unprotected login page will see far more automation.
• Using secondary roundups: one news summary of the Cloudflare 2026 report gave a different leaked-credential figure from Cloudflare's own post. Always cite the publisher.
• Ignoring the identity angle: treating bots as a traffic problem leaves stolen credentials and exposed API keys valid after the traffic is blocked.

Practitioner checklist

• Cite every bot figure with publisher, report and period, and state what was counted.
• Measure the bot share of your own login, search, checkout and API traffic before buying or tuning a control.
• Screen logins against leaked credential data and force resets for confirmed matches.
• Apply per-client rate limits and quotas to every public API, including mobile back ends.
• Inventory API keys embedded in client apps and treat them as non-human identities.
• Decide a policy for AI crawlers (allow, rate limit, block or charge) and enforce it at the edge.
• Report account takeover rate and automated share of sensitive flows to the risk owner quarterly.
• Check the latest Imperva, Cloudflare and F5 editions before reusing these numbers.

Standards and references

• Imperva: Bad Bot Report 2026, Bots in the Agentic Age
• Imperva: 2025 Bad Bot Report, How AI is Supercharging the Bot Threat
• Cloudflare: The 2025 Cloudflare Radar Year in Review
• Cloudflare: Introducing the 2026 Cloudflare Threat Report
• Cloudflare: Password reuse is rampant, nearly half of observed user logins are compromised
• F5 Labs: 2025 Advanced Persistent Bots Report
• Akamai: AI Bots Threaten the Foundation of Web-Based Business Models
• OWASP: API Security Top 10 2023

Related NHI Mgmt Group resources: Bot Management Guide · Top 10 Automated Bot Attacks · DDoS Attack Statistics · API Security Statistics · Identity Attack Statistics Guide