Bot Traffic Exceeding Human Traffic | What Charities Need to Know

Bot traffic is set to exceed human traffic – what does this mean for your charity website?

Introduction

By some estimates, bot traffic will exceed human traffic on the web in 2025 or early 2026. If you’re running a charity website, this isn’t just a tech industry curiosity – it has real implications for how you understand your website’s performance, protect your data, and plan your digital strategy.

Not all bots are bad. Some are helpful (search engines indexing your site, accessibility tools, monitoring services). Others are neutral (research crawlers, archiving bots). But a significant portion, estimated at 30-40% of all bot traffic, are “bad bots” doing things you definitely don’t want: scraping your content, testing for vulnerabilities, inflating your analytics, or worse.

If you’re looking at your Google Analytics and making decisions based on those numbers, you need to understand how much of that traffic is actually human, and what the rest is doing to your site.

What bot traffic actually means for your charity

1. Your analytics are probably lying to you

The problem: That spike in traffic last month? Might have been a bot farm, not actual interest in your work. Your bounce rate might look terrible because bots land on a page and leave instantly. Your most popular pages might just be the ones bots find easiest to crawl.

Why this matters for charities: You’re making decisions based on this data. Where to focus content. What campaigns are working. Whether your website redesign improved things. If a significant portion of your traffic isn’t human, you’re making decisions on false information.

What to do about it:

Check your analytics for suspicious patterns (sudden spikes, perfect bounce rates, traffic from unexpected countries, very short session durations)
Enable Google Analytics 4’s bot filtering (Settings > Data Streams > Configure tag settings > Show advanced settings > Exclude all hits from known bots and spiders)
Look at your server logs to see what’s actually hitting your site vs what Google Analytics reports
Focus on meaningful metrics: conversion rates, donation completions, email signups – things bots can’t fake

Reality check: Your “100,000 monthly visitors” might actually be 60,000 humans and 40,000 bots. The humans are what matter.

2. Bad bots are costing you money

The problem: Bots consume bandwidth. They trigger your hosting limits. They slow your site down for actual humans. If you’re on metered hosting or CDN services, bot traffic is costing you real money for zero benefit.

Why this matters for charities: You’re operating on tight budgets. Every pound spent on hosting bot traffic is a pound not spent on your mission. And if bots are slowing your site down, you’re losing human donors who get frustrated and leave.

What to do about it:

Check your hosting analytics for bandwidth usage patterns
Implement rate limiting (restrict how many requests can come from a single IP in a short time)
Use a CDN with bot protection (Cloudflare’s free tier includes basic bot filtering)
Block the worst offenders at server level (your developer can help with this)
Consider managed hosting that handles bot mitigation for you

Example: A charity we work with was seeing 400GB monthly bandwidth usage. After implementing basic bot filtering, it dropped to 180GB. Same human traffic, half the hosting costs.

3. Content scraping is getting more aggressive

The problem: AI training bots are crawling the web scraping content to train language models. Your carefully written impact reports, case studies, research findings – they’re being ingested into AI systems without attribution, often without permission, sometimes in violation of your copyright.

Why this matters for charities: If you’ve spent time and money creating original research, reports, or resources, AI bots are taking that content and potentially regurgitating it elsewhere without credit. Your intellectual property, your stories, your impact data – lifted and repurposed.

What to do about it:

Add a robots.txt file that specifies which bots can access what (though not all bots respect this)
Consider using AI-specific blocking (e.g., blocking GPTBot, CCBot, anthropic-ai, etc.)
Use a “noai” or “noindex” meta tag on sensitive pages
Copyright notices won’t stop bots, but they give you legal standing if content is misused
For truly sensitive content, consider putting it behind authentication

The ethical question: Some argue that AI bots should have access to public information for training. Others say charities should control how their content is used. There’s no clear answer yet, but you should make an informed decision rather than defaulting to “let everything be scraped.”

How to block AI crawlers (example):

# In your robots.txt file
User-agent: GPTBot
Disallow: /
User-agent: CCBot
Disallow: /
User-agent: anthropic-ai
Disallow: /

4. Security risks are increasing

The problem: Bad bots probe for vulnerabilities. They test login pages, try common passwords, look for unpatched plugins, search for exposed data. As bot traffic increases, so does the volume of these attacks.

Why this matters for charities: You hold sensitive data: donor information, payment details, potentially vulnerable people’s details if you’re a support service. A security breach doesn’t just cost money to fix – it damages trust, potentially harms people, and can have legal consequences.

What to do about it:

Use strong security plugins (Wordfence, Sucuri, etc.) that include bot protection
Implement CAPTCHA or similar challenges on forms (but make sure they’re accessible)
Use two-factor authentication for admin logins
Keep WordPress, plugins, and themes updated (bots exploit known vulnerabilities)
Monitor failed login attempts and block persistent offenders
Use a web application firewall (WAF) if your hosting supports it

Signs you’re being targeted:

Sudden spike in failed login attempts
Slow site performance with no traffic increase
Unusual traffic patterns in analytics
Server resource warnings from your host
Forms being submitted with nonsense data

5. Your contact forms are being spammed

The problem: Bot form submissions. Dozens, hundreds, sometimes thousands of fake enquiries, newsletter signups, or donation attempts. They waste your team’s time, fill your inbox with garbage, and make it harder to spot genuine enquiries.

Why this matters for charities: Your small team is already stretched. Time spent dealing with bot spam is time not spent on actual supporters, donors, or people who need your help.

What to do about it:

Use Google reCAPTCHA v3 (invisible, accessibility-friendly, effective)
Add honeypot fields (hidden fields that bots fill in but humans don’t see)
Implement form submission rate limiting
Use form plugins with built-in spam protection (Gravity Forms, WPForms)
Add simple verification questions that bots struggle with (but keep them accessible)
Block submissions from suspicious IP addresses or countries you don’t work in

Avoid:

CAPTCHA challenges that are difficult for humans (inaccessible, frustrating)
Overly aggressive filtering that might block legitimate enquiries
Making your forms so protected that genuine supporters give up

The good bots you actually want

Not all bots are bad. These are the ones you should welcome:

Search engine crawlers

Googlebot, Bingbot – indexing your site so people can find you
Allow these: They’re how people discover your work

Social media bots

Facebook, Twitter, LinkedIn crawlers that generate link previews
Allow these: They make your shared content look professional

Monitoring services

Uptime monitors, performance checkers, accessibility scanners
Allow these: They help you maintain your site

Accessibility tools

Screen reader bots, accessibility checkers
Allow these: They ensure your site works for everyone

Archiving services

Internet Archive, research crawlers
Consider allowing: They preserve your work for posterity

What this means for your content strategy

Implication 1: Write for humans first, bots second

SEO is still important, but if an increasing portion of your traffic is bots, optimising primarily for search engines becomes less relevant. Focus on:

Content that converts human visitors (donations, signups, engagement)
Clear calls to action
Compelling storytelling that moves people to act
User experience over keyword density

Implication 2: Protect your best content

If you’ve created original research, in-depth reports, or valuable resources:

Consider gating some content behind email signup (builds your list, limits scraping)
Use PDFs with copyright notices for important reports
Add watermarks or attribution to downloadable resources
Think about what you want freely available vs protected

Implication 3: Focus on owned channels

As the open web becomes increasingly bot-heavy:

Build your email list (you control access)
Invest in community building (members-only areas)
Consider newsletters as primary content distribution
Use your website as a hub, not your only presence

Practical steps you can take today

If you have 15 minutes:

Check your Google Analytics for suspicious traffic patterns
Enable bot filtering in GA4 if it’s not already on
Review your contact form submissions for spam patterns

If you have 1 hour:

Create or update your robots.txt file to block aggressive crawlers
Install a security plugin with bot protection if you don’t have one
Implement CAPTCHA on your forms if spam is a problem
Check your hosting bandwidth usage and identify unusual patterns

If you have a day:

Audit your analytics properly (compare server logs to GA data)
Implement comprehensive bot filtering at server level
Review and update your security measures
Create a content protection strategy for valuable resources
Set up monitoring for unusual traffic or security attempts

The bigger picture: what comes next

AI is changing how websites work

We’re moving from a web designed for human browsing to one where AI agents fetch, process, and summarise content on behalf of humans. Your website might be increasingly visited by AI assistants checking information rather than humans reading pages.

What this means:

Structured data becomes more important (help AI understand your content correctly)
Clear, factual information matters (AI will summarise and cite you, or not)
Your website becomes a data source, not just a destination

Implications for charities:

Make your impact data clear, structured, and easy to extract (so AI can cite it accurately)
Ensure your mission and services are described in plain, unambiguous language
Consider APIs or structured data feeds for key information
Think about how AI assistants will represent your work when asked

Should you be worried?

Short answer: Aware, yes. Worried, not yet.

Bot traffic increasing doesn’t mean your website is doomed. It means you need to:

Understand what your analytics actually represent
Protect your resources from exploitation
Secure your site properly
Make informed decisions about bot access

Most charities should focus on the basics:

Good security
Bot-filtered analytics
Form spam protection
Bandwidth monitoring

The more complex questions (AI training access, content protection strategies, structured data for AI) can come later once you’ve got the fundamentals sorted.

Getting help

If this feels overwhelming:

You don’t need to become a bot traffic expert. You need a developer who understands these issues and can implement sensible protections without making your site harder to use for actual humans.

Questions to ask your developer:

Is bot filtering enabled in our analytics?
Do we have security measures for bot attacks?
Are our forms protected from spam?
Is our hosting plan appropriate for our actual (human) traffic?
Do we need to block any AI crawlers?

If you don’t have a developer:

Most hosting providers offer security features (use them)
Install a security plugin (Wordfence free version is good)
Enable GA4 bot filtering (it’s a checkbox)
Use reCAPTCHA on forms (easy to implement)
Start with the basics, don’t get overwhelmed

The bottom line

Bot traffic exceeding human traffic is a milestone, but it doesn’t fundamentally break how websites work. It just means you need to:

Question your data – Your analytics need context
Protect your resources – Bandwidth, content, security
Focus on humans – They’re the ones who matter
Make informed choices – About bot access and content protection

Your charity website exists to support your mission. Whether it’s being visited by humans or bots, that purpose doesn’t change. But understanding who (or what) is actually using your site helps you make better decisions about how to build and maintain it.

Human

Kind

Bot traffic is set to exceed human traffic – what does this mean for your charity website?

Introduction

What bot traffic actually means for your charity