Bot-Traffic übersteigt Menschen-Traffic: Was KMU-Websites jetzt ändern müssen

What Happened in June 2026

On June 3, 2026, Cloudflare CEO Matthew Prince announced at a conference what Cloudflare Radar data had already been showing for weeks: for the first time in history, bots exceeded human web traffic (golem.de). This isn’t a threshold that will be fallen below again tomorrow. The curve is rising steeply.

Important to note: Not all bots are the same. Three categories are intermingled.

• Search engine crawlers: Googlebot, Bingbot. They index pages for traditional search.

• AI crawlers: GPTBot, ClaudeBot, GeminiBot, PerplexityBot. They gather content for training and response generation.

• AI agents: ChatGPT operators, Claude agents, Perplexity actions. They conduct research on behalf of a human in real time.

The third category is the newest. It’s growing the fastest. According to Human Security 2025, AI agent traffic increased by 7,851 percent year-over-year. GPTBot alone grew by 305 percent. Automated traffic grew eight times faster than human traffic.

What This Means for Your Own Analytics

Anyone using Google Analytics or Matomo without bot filters will, starting today, be measuring mostly machines. Here are three observations from our experience.

First: Click counts are becoming less reliable.

Sessions with no duration, hits without JavaScript, requests without cookies. If you don’t set the filters, you’ll see traffic spikes that aren’t real. A supposed 30 percent increase could be purely GPTBot activity.

Second: Conversion rates appear worse.

If visitor numbers rise but purchases don’t keep pace, the conversion rate drops on paper. This leads to false conclusions about UX, pricing, or marketing. In reality, only the bot rate has increased.

Third: Heatmaps become unreliable.

Mouse-tracking tools like Hotjar also capture movements caused by agents’ headless browsers. The value of the visualization decreases when a third of sessions come from machines.

What’s Changing Our Understanding of SEO

Traditional SEO was based on the assumption that a position on page one brings clicks, and clicks bring conversions. This is no longer universally true. In June 2026, we’ll see three structural shifts.

AI agents read pages and provide users with answers. People only click on the source when a purchase decision or a specific detail is involved. Purely informational searches are increasingly disappearing within the AI interface.

On June 12, 2026, the Munich Regional Court handed down a ruling on misleading AI summaries, further intensifying the debate. The click-through rate on organic results is falling in many industries—from 15 percent two years ago to 8 percent today. Those in the number one position now earn half as much as they used to.

For SMEs, this means: Visibility no longer automatically translates to a click. A click no longer automatically translates to a conversion. The chain is getting longer and more fragile.

What Marketing and Sales Managers Should Do Now

We recommend six steps in this order.

1. Enable the bot filter in Analytics. In GA4, check the bot filter under “Data Streams.” In Matomo, enable the “Crawler” filter. Additionally, filter server logs for user-agent strings.

2. Introduce separate tracking for each bot class. GPTBot, ClaudeBot, and PerplexityBot get their own columns. Whoever sees growth here gains AI visibility. Whoever doesn’t show up here remains invisible.

3. Take log file analysis seriously for SEO. Server logs show which bots are accessing which pages. From this, you can deduce which content actually ends up in AI responses.

4. Shift conversion tracking to micro-conversions. Instead of just counting purchases, also track form submissions, demo requests, and file downloads. This automatically filters out bots.

5. Check out Cloudflare Bot Management or similar tools. If you want to specifically block bots or subject them to challenge checks, you need a bot management solution. Most major CDN providers offer this as part of their service.

6. Define your robots.txt and AI crawler policy. Which AI crawlers are allowed to access your content? Which ones aren’t? The robots.txt file is the most important control mechanism.

What Needs to Change on the Website

The website is becoming an API. We consider three specific adjustments to be essential.

Expand structured data. Use Schema.org for products, FAQs, how-tos, and organizations. Content that is clearly structured is more likely to appear in AI responses. JSON-LD is the format of choice.

Write content designed to be cited. Clear statements at the beginning. Specific numbers. A clean semantic structure. Long introductions without facts are less likely to appear in AI responses.

Take server performance seriously. AI crawlers often hit a page in waves. If the server crashes under these waves, content won’t make it into the database. A Time to First Byte under 600 milliseconds is the minimum.

Don’t forget security

According to Cloudflare’s 2026 Threat Intelligence Report, 94 percent of all login attempts on Cloudflare-secured websites come from bots. These aren’t just crawlers. They include credential stuffing attacks, vulnerability scanners, and spam bots.

Anyone who takes the bot wave seriously looks beyond just SEO. Website security benefits as well. Multi-factor authentication, login throttling, CAPTCHA for suspicious patterns, and an up-to-date WAF are standard today—not optional.

Forms are the second point of entry. According to Patchstack, 76 percent of spam entries in contact forms come from form bots. Adding a honeypot field that remains invisible to humans filters out most of them. CAPTCHAs are the more robust but less user-friendly alternative.

What the Next 12 Months Will Bring

We see three trends.

• The proportion of bots continues to rise. The curve isn’t flattening out. By mid-2027, we expect 65 to 70 percent of traffic to be from bots.

• AI agents will become the standard. Those who use browser plugins for ChatGPT or Claude today will be deploying an agent tomorrow. The website experience is shifting from humans to the AI interface.

• Analytics tools are responding. Plausible, Matomo, Fathom, and even GA4 will refine bot classification. Those who already maintain clean bot filters today have a head start.

Those who take this issue seriously today will have a competitive advantage in twelve months. Those who wait will continue to measure phantoms and plan based on them. We expect that by early 2027, every major analytics tool will feature its own AI agent category. Those who separate data cleanly today will save themselves the cleanup work in old dashboards and reports later on.

What really matters to our customers

In recent weeks, we’ve observed three typical reactions among SMEs. First group: Looking the other way, continuing to read click reports. Second group: Completely blocking AI crawlers out of concern about content theft. The third group: managing both worlds—that is, consciously sharing content, maintaining bot filters effectively, and simultaneously measuring AI visibility.

In our view, the third group comes out on top. Those who place content in AI responses build a new reach that doesn’t depend solely on Google rankings. Those who block access completely become invisible in AI search. The decision isn’t technical—it’s strategic.

We recommend checking the robots.txt file once a month and making bot classification a regular item in your marketing reports. If you don’t have the internal resources to handle this, you can outsource it. It’s important to visually review the logs monthly: Which user agents are new, which have disappeared, and which are sending an unusually high number of requests from a single IP range.