57.4% of HTTP requests are no longer human. An industry that pays per click needs to understand this before others.

In early June 2026, Cloudflare CEO Matthew Prince wrote a single sentence on X: "Welp, that happened faster than I predicted."

The catalyst was his own Cloudflare Radar data. From May 29 to June 4, 57.4% of all HTTP requests to HTML content were generated by bots. Not humans.

As early as March 2026, Prince had stated at SXSW that this would happen by 2027. It happened a year earlier.

For most industries, this is just a statistic. For iGaming and affiliate marketing, it's money. Because our industry pays for traffic on a per‑unit basis.

Where Are These Bots Coming From?

It is important to understand: 57% is not an army of fraudsters. It is the sum total of all internet automation.

Before the generative AI era, bots accounted for about 20% of traffic. These were search crawlers (Googlebot, Bingbot) plus some monitoring tools and a little fraud. Then LLMs arrived, and everything changed.

When a human searches for a product, they visit five websites. An AI agent performing the same task visits thousands. This multiplier (applied to millions of users who delegate tasks to AI) flipped the balance.

According to Cloudflare data, in 2025 AI bots alone generated an average of 4.2% of HTML requests. But that was only AI crawlers. Non‑AI bots, meanwhile, generated half of all requests to HTML pages (7% more than human traffic).

By mid‑2026, the point of no return has been crossed.

The breakdown by type looks roughly like this:

  • Search crawlers: Google, Bing, AI models (GPTBot, ClaudeBot, Perplexity). They scan content for indexing and training.
  • Monitoring and analytics bots: price scrapers, aggregators, competitive intelligence tools.
  • Agentic AI: bots that act on behalf of users (buying, searching, comparing).
  • Fraud bots: simulate clicks, registrations, and conversions.

According to the Cloudflare Threat Intelligence Report 2026, bots generate 94% of all login attempts across their entire network. Only 6% of login attempts are real people.

Read that again.

Why the Impact on iGaming Is Greater Than on Other Industries

Most industries get annoyed by bot traffic. iGaming loses money on it directly.

The scheme is simple. An affiliate buys traffic or generates it organically. The operator pays for a result (a registration, a deposit). Between the click and the FTD, there are several conversion points. Each is vulnerable in its own way.

Ad click. A bot clicks — the budget burns. The ad dashboard shows a CTR, the platform counts the click as real. The media buyer pays for traffic that never existed.

Site session. Bots inflate traffic metrics, spoil analytics, and break segmentation. Retargeting targets dead audiences.

Registration. Bots register, clog the funnel, and create the illusion of conversions. The affiliate sees registrations — the operator does not validate them as quality leads.

Deposit. The most protected point, but not completely. Drop card schemes and synthetic identities exist and are evolving.

The outcome is predictable. The affiliate does not receive validated conversions. The operator pays for junk leads. Relationships sour. KPIs get tougher. And no one really knows where exactly in the chain the money disappeared into the sand.

Basic Checklist: How to Filter Out Bots in Your Analytics

It is important to note that you will not be able to get rid of bots completely, but you can dramatically reduce their impact on your analytics and payouts.

1. Analytics settings (GA / alternative)

  • Enable built‑in bot filtering.
    In Google Analytics 4, filter known bot traffic using IAB lists. In log‑based analytics, apply filters by user‑agent and ASN.
  • Separate human vs. bot traffic in your reports.
    Create a dedicated view or dashboard where suspicious user agents, known datacenters, and proxies (Cloudflare, AWS, GCP, OVH, etc.) are filtered out.

2. Filters by source and technical patterns

  • Exclude obviously machine‑driven sources: datacenters, suspicious ASNs, traffic with no referrer.
  • Filter out unnatural user agents: empty strings, outdated browsers, odd "library‑style" user agents that hit the site in bulk.
  • Restrict suspicious countries or regions if there is no targeting there but traffic volumes are high.

3. Post‑click behavior (segmenting humans vs. bots)
Create separate segments:

  • "Human" signals:
  • "Suspicious" signals:

Then:

  • Calculate CTR / CR using only the "human" segment.
  • Regularly monitor the share of "suspicious" sessions per source, creative, and platform.

4. Separate accounting for AI crawlers

  • Explicitly tag and separate traffic from GPTBot, ClaudeBot, Perplexity, Gemini, and other AI crawlers into its own layer.
    According to Cloudflare Radar, bots already generate approximately 57.4% of all HTTP requests to HTML content, and their share of login attempts reaches 94%.
  • Use robots.txt, header filters, or Cloudflare Rules to block crawlers from internal pages. But don't block them from content you actually want to be ranked.

5. Server logs and independent traffic verification

  • Enable log analysis or an anti‑fraud tool to detect:
  • Use third‑party verification tools. Many affiliate networks and large operators already rely on solutions that can flag suspicious clicks as early as the redirect stage.

From this checklist, it is easy to build an internal "minimum quality standard": what exactly you consider a human session and how such sessions are validated.

How Bot Traffic Is Changing the Advertiser‑Network‑Affiliate Relationship

1. Universal Pain, Different Impact

  • Bot levels have already surpassed human levels. According to Cloudflare, ~ 57.4% of HTTP requests to HTML content are made by bots, not users.
  • Separate reports show that automated traffic grew 8 times faster than human traffic in 2025, while traffic from agentic AI (bots that act on behalf of users) grew by roughly 7,800% year over year.

For iGaming, this is not theory, it is real money:

  • Media buyers pay for clicks and impressions, half of which could be bots.
  • Operators pay for registrations and deposits.
  • Affiliates get caught in the middle, trapped in disputes over "clicks exist — conversions don't."

"Many Clicks, Zero FTD" Cases Have Become the Standard

What used to be considered an exception has now become the backdrop:

  • Offers are rejected because the statistics show "too many clicks and registrations, but no FTD."
  • Many of these cases are actually the result of bot traffic at the top of the funnel: bots that click on creatives, create sessions with zero engagement, and sometimes even simulate registrations.

If neither side knows how to look beyond "clicks / registrations / FTD," affiliates simply get cut based on KPIs, without any real analysis of where a human dropped off and where a bot was present from the start.

Does the Industry Even Grasp What's Going On?

Based on the market sentiment:

  • Large operators and top affiliate networks are already aware of the issue. They read reports from Cloudflare, HUMAN, and others, and they see that 90%+ of login attempts to their systems come from bots.
  • Some affiliates and media buyers still operate in the "CTR = success" paradigm, failing to track post‑click metrics or separate human and bot segments.

The result:

  • Operators tighten rules and introduce holds.
  • Networks push risk further down the chain.
  • Affiliates often perceive this as "KPI pressure," even though objective risks have genuinely increased.

Next Steps in Communication and Processes

1. Formalize "human traffic" in contracts

  • Before launching an offer, agree on: minimum session duration, engagement depth metrics, acceptable share of suspicious sessions, and which anti‑fraud tools are used by whom.
  • Clearly state that disputed volumes will be assessed using logs or third‑party fraud reports (not "by eye").

2. Move from "trust" to shared analytics

  • Hold regular funnel review calls: source → clicks → sessions → registrations → deposits, segmented by human vs. bot.
  • Separately track the share of AI crawlers and agentic AI traffic, so they are not mistaken for "lost conversions."

3. Invest in knowledge, not just traffic

  • Networks and operators that educate affiliates on bot filtering and post‑click analytics end up with a cleaner partner pool and fewer offer disputes.
  • Affiliates who raise the topic themselves and come with ready‑made traffic quality reports receive better treatment, softer KPIs, and longer lifetimes.

A New Player: AI Crawlers

A separate story of 2026 is the growth of agentic AI traffic.

By the end of 2025, agentic AI accounted for only 1.7% of automated traffic. But over the course of the year, this category grew by nearly 8,000%.

GPTBot, ClaudeBot, Perplexity, Gemini — all of them actively scan websites. For SEO affiliates, this creates an entirely new reality.

On one hand, your content is being read by AIs that then answer queries from millions of users. If an article makes it into a training dataset or into a database for RAG search, you are present in AI answers without users ever clicking through to your site.

On the other hand, this traffic growth does not translate into real human visitors coming to your site. Website owners are actively losing real human traffic as a result.

A new term for this reality has already appeared: zero‑click. You were read, but no one came to you.

Cloudflare's CEO speaks directly about the future: "Obviously, it will be pay to crawl" — meaning paid access for AI crawlers to website content. Cloudflare has already launched a platform that allows site owners to restrict AI crawlers and charge for access. The tool has not yet reached a mass audience, but the direction has been set.

What This Means for Every Market Participant

Media Buyer

When more than half of your traffic is bots, the real cost of a human user is higher than what your ad dashboard shows. CPM and CPC are still calculated on all traffic. That means you are overpaying.

Practical advice: stop looking at CTR as your main indicator. Sessions shorter than 5 seconds, zero scroll, and an instant bounce are bot signals. Post‑click metrics matter more than pre‑click metrics.

A separate signal: the growing number of operators introducing hold periods and stricter traffic verification is a direct consequence of rising bot activity in the funnel.

SEO Affiliate

Organic traffic is under double pressure.

First, AI crawlers read your pages, users get answers directly in search results, and they never visit your site. Google AI Overviews and AI Mode have already reached billions of users. This is no longer a test. It is the new reality of search.

Second, SEO is evolving from optimization for Google rankings to optimization for readability by AI systems. If an AI agent finds your content confusing, poorly structured, or difficult to extract data from, it will simply use a competitor's content.

Practical advice: structured data, clear headings, direct answers to specific questions — this is no longer about SEO optimization. It is about whether you will appear in AI answers at all.

Operator and Affiliate Program

The rise in bot traffic is a direct cause of stricter quality requirements. Distinguishing a real player from a well‑made bot is becoming more difficult.

Hence the growing number of post‑FTD checks, requests for behavioral metrics after deposit, and tougher KPIs from the start. This is not operator paranoia. It is a rational response to a real problem.

For affiliates, this means that transparency of traffic sources becomes a competitive advantage. Those who can provide clean analytics get better terms.

Anti‑Fraud Vendors

The only ones who benefit from this news. Demand for traffic verification, behavioral analysis, and bot detection solutions will only grow.

Immediate Actions to Take

Implement independent traffic verification. Do not rely solely on advertising platform data. It has a direct commercial interest in showing high traffic. Independent traffic quality analysis solutions are no longer optional.

Focus on post‑click behavioral metrics. Time on site, session depth, repeat visits, and funnel progression are signals of a real user. Bots do not simulate these convincingly.

Define "human traffic" parameters in contracts with operators upfront. Do this before campaign launch, not after the first hold period. What counts as a quality lead, what the hold period is, which verification metrics apply — all of this should be agreed in advance.

Adapt content for AI readability. Structured data, clear definitions, direct answers to specific questions — this is the new SEO standard. Not for Googlebot, but for AI agents that generate answers for users.

Monitor Cloudflare Radar. A free public tool that shows the real‑time bot‑to‑human traffic ratio. A good benchmark for understanding the broader landscape.

A Short Practical Checklist for You

  1. In analytics: Enable bot filtering / create a separate report for human vs. bot sessions / set up segments based on time on site and view depth.
  2. When working with networks and brands: Specify in the contract the criteria for a quality lead and the anti‑fraud services to be used / agree that in cases of "many clicks — zero FTD," a joint log analysis will be conducted before any offer is blocked.
  3. In reporting: In every campaign report, show not only clicks and registrations but also the share of suspicious sessions / mark traffic from AI bots as a separate layer (especially if you have a strong SEO component).

The internet has become predominantly machine‑driven. This is not a temporary anomaly. It is the new baseline.

Before the generative AI era, bots accounted for 20% of traffic. Now, they make up more than half. Moreover, the growth of agentic AI is only accelerating. Agents acting on behalf of users grew 8,000% year‑over‑year by the end of 2025.

For iGaming, this translates into specific changes in traffic economics. The real user costs more than your ad dashboard shows. The conversion funnel requires more precise verification at every stage. SEO content must be written not only for humans but also for machines, which now read it more often than people do.

Those who understood this earlier pay less for real users and earn more from each one.

You can track the bot‑to‑human traffic ratio in real time on Cloudflare Radar.