Bots on your website: what they attack, what we block, and how to protect yourself

Last week, in SWPanel, we observed notable bot activity, especially from artificial intelligence. Although most of the traffic on websites comes from real people, bots also play an important role, and not always as friends. In this bulletin, we explain what we saw, what it means, and how you can protect yourself without technical complications.

What we saw in SWPanel

This week (October 18-25, 2026), we analyzed bot traffic on websites with BotLock active, our system for detecting and blocking malicious bots. Here are the key data:

• Real people generated 55.9% of the total traffic. Although most visits are from regular users, 2.7% of these visits were blocked due to suspicious behavior, representing 19.9% of all blocks.
• Artificial intelligence (AI) bots were the most active, with 23.2% of the total traffic. Of these, 19.1% were blocked, which equals 59.0% of all blocks. This means that AI bots made the most malicious attempts.
• Scrapers, bots that copy content, represented 9.9% of the traffic, but only 1.2% of them were blocked, which equals 1.6% of all blocks.
• Search bots, such as Googlebot or Applebot, generated 9.5% of the traffic. Of these, 13.5% were blocked, which equals 17.2% of all blocks.
• SEO tools, such as those that analyze website rankings, generated 1.5% of the traffic. Of these, 11.5% were blocked, which equals 2.3% of all blocks.

The most blocked bots

Some bots stood out due to the percentage of blocks:

• Googlebot (search engines): 11.5% of its requests were blocked.
• Kimi (AI): 26.6% of its requests were blocked.
• ChatGPT (AI): 26.0% of its requests were blocked.
• Bytespider (AI): 23.1% of its requests were blocked.
• Amazonbot (search engines): 18.9% of its requests were blocked.

These bots, although they may seem legitimate, can behave inappropriately, such as making too many requests or trying to access sensitive files.

Suspicious requests

We also observed an increase in certain types of requests:

• Scanner probes: attempts to access files like .env, .git, or phpmyadmin, which can reveal sensitive information. This week, 22.5% of suspicious requests were of this type, compared to 16.5% last week.
• Attempts to access forms, such as wp-login.php or xmlrpc.php, represented 0.5% of suspicious requests, with slight stability compared to last week.
• Code injections, such as SQL or XSS injection attempts, slightly decreased from 1.7% to 0.8%.
• Blocked requests in total were 5.8% of all requests, compared to 4.5% last week.

How we got here

Last week, bot traffic showed a clear trend: AI bots increased their presence, while injection attempts decreased. This may be because AI bots are more active in data collection, while traditional attackers are reducing injection attempts due to improved website protection.

If the trend continues, it's likely that AI bots will remain a significant source of traffic and blocks. An optimistic scenario would be that detection systems continue to improve and that blocks remain stable. A pessimistic scenario would be that AI bots increase their activity and scanning attempts also rise. Signs to watch for would be an increase in suspicious requests or a higher number of AI bot blocks.

What's happening behind the numbers

Artificial intelligence bots, although they may seem useful, can behave aggressively. For example, they may try to access sensitive files, make too many requests in a short time, or even try to train models using your website content without your consent. On the other hand, search bots, although usually legitimate, can behave inappropriately if not configured correctly.

AI bots are particularly concerning because they can automate tasks that previously required humans, such as scanning websites for vulnerabilities. This means attacks can be faster and more frequent.

How it can affect your website or business

Imagine you have a WordPress online store. If an AI bot tries to access files like .env or .git, it could obtain sensitive information such as passwords or API keys. If you don't have protection measures in place, it could use that information to attack your website or even sell it to third parties.

Another scenario: if a scanning bot finds that you have an outdated plugin, it could exploit that vulnerability to inject malicious code into your website. This could cause your site to display unwanted ads, lose user trust, or even steal your customers' data.

It's also possible that your website could be affected by an increase in bot traffic, which can slow down your site and affect the experience of real users. In the worst case, if you don't act in time, your website could crash or even be penalized by Google for unwanted behavior.

How to protect yourself and prevent attacks

1. Activate BotLock: If you have BotLock active, you're already blocking malicious bots. If not, consider activating it to protect your website from unwanted bots.
2. Use a web firewall: The SWPanel firewall filters malicious requests before they reach your application. If you don't have it active, it's a simple and effective measure.
3. Update your CMS and plugins: If you installed your website from SWPanel, you can activate automatic WordPress and plugin updates. This ensures you're protected against known vulnerabilities.
4. Use strong passwords and 2FA: Weak passwords are an open door for attackers. Use long, unique passwords and enable two-factor authentication (2FA) in WordPress.
5. Review website access: If you have access to WordPress, periodically check who has permissions and if there are inactive or suspicious users.
6. Enable backups: In case something goes wrong, backups allow you to quickly restore your website. SWPanel offers automatic backups.
7. Change your PHP version if needed: If you're using an unsupported PHP version, switch to a supported version from the hosting panel. This ensures you receive security updates.
8. Activate SWPanel's security analysis: The 360 Security analysis detects CMS, plugins, and versions with known issues. It helps you identify problems before they're exploited.
9. Subscribe to SWPanel's security bulletin: It keeps you informed about new threats and how to protect yourself.
10. Use a vulnerability scanner: If you have access to WordPress, use plugins like Wordfence or Sucuri to scan your website and detect issues.

What SWPanel tools can help you

• BotLock: Controls and blocks malicious bots and crawlers from your website. Use it if you want to protect yourself from unwanted bots.
• FireWall: Filters web attacks before they reach your application. Use it if you want an additional layer of protection.
• Automatic CMS updates: If you installed your website from SWPanel, you can activate automatic WordPress and plugin updates. Use it if you want to be protected against known vulnerabilities.
• Backups: In case something goes wrong, backups allow you to quickly restore your website. Use it if you want to be prepared for any situation.
• PHP version change: If you're using an unsupported PHP version, switch to a supported version from the hosting panel. Use it if you want to ensure you receive security updates.
• SWPanel security analysis: Detects CMS, plugins, and versions with known issues. Use it if you want to identify problems before they're exploited.
• SWPanel security bulletin and alerts: Keeps you informed about new threats and how to protect yourself. Use it if you want to stay up to date on the latest threats.

Quick summary

• AI bots are the most active and generate the most blocks.
• Search bots are also a significant source of traffic and blocks.
• AI bots can behave aggressively, such as trying to access sensitive files.
• Scanning bots and injection attempts have slightly decreased.
• Protect your website with measures like BotLock, a firewall, automatic updates, and backups.

Sources

This week's data was measured by SWPanel on the hosting platform and cloud servers.