Bots on your website: who are they and how to protect yourself?

In summary

This week, bot traffic on websites with BotLock has decreased by 32.6% compared to the previous week, which is a relief. However, the overall trend of the last few weeks points to an increase in artificial intelligence bot traffic. Although most of this traffic is not dangerous, some bots may attempt to copy content, scan sensitive routes, or even try to access your website without authorization. It's important to stay alert and take preventive measures.

What we've seen in SWPanel

This week (from November 5 to 12, 2026), we analyzed bot traffic on websites with BotLock enabled. Here are the key figures:

• People (52.9%): Most of the traffic is from real users. Only 4.2% of this traffic was blocked, representing 82.1% of all blocks. This means that most of the blocks are due to unauthorized access attempts by real users, such as brute-force attacks or access to sensitive routes.
• Artificial intelligence bots (19.0%): These bots collect content to train models or respond in chats. Only 1.5% of them were blocked, representing 10.2% of total blocks. Although most of these bots are not malicious, some may attempt to copy content or scan sensitive routes.
• Search engine bots (18.6%): These bots index content for search engines. Only 0.7% of them were blocked, representing 4.6% of total blocks. Most of these bots are legitimate, but some may attempt to access sensitive routes or overload the server.
• SEO tools (4.7%): These bots analyze website content to improve its ranking. Only 0.3% of them were blocked, representing 0.6% of total blocks. Most of these bots are legitimate, but some may attempt to copy content or overload the server.
• Social media bots (3.0%): These bots share content on social media. Only 0.4% of them were blocked, representing 0.5% of total blocks. Most of these bots are legitimate, but some may attempt to copy content or overload the server.
• Scrapers (1.5%): These bots copy content from websites. 3.4% of them were blocked, representing 1.9% of total blocks. These bots may attempt to copy content to sell it or use it on other websites.
• Malicious bots (residual): Malicious bot traffic is very low (less than 0.1%). Reliable data on the percentage of blocks is not available.

How we got here

Over the last 6 weeks, artificial intelligence bot traffic has fluctuated:

1. 01/10 to 07/10: 171 (17.1%) AI bots, with 1.5% scrapers and 17.6% blocks.
2. 08/10 to 14/10: 229 (22.9%) AI bots, with 11.1% scrapers and 3.0% blocks. (+33.9%)
3. 15/10 to 21/10: 248 (24.8%) AI bots, with 12.2% scrapers and 8.1% blocks. (+8.3%)
4. 22/10 to 28/10: 313 (31.3%) AI bots, with 1.1% scrapers and 3.8% blocks. (+26.2%)
5. 29/10 to 04/11: 282 (28.2%) AI bots, with 19.6% scrapers and 10.1% blocks. (-9.9%)
6. 05/11 to 12/11 (this week): 190 (19.0%) AI bots, with 1.5% scrapers and 2.7% blocks. (-32.6%)

The average for the previous 5 weeks was 249 AI bots. This week, the number dropped to 190, representing a 23.6% decrease. The peak was 313 (22/10 to 28/10), and the minimum was 171 (01/10 to 07/10). This week is the second consecutive one in which AI bot traffic has decreased, which is good news. However, the overall trend is still upward, and if it continues, a 42.5% increase is expected next week.

What's happening behind the numbers

The increase in artificial intelligence bot traffic may be due to several reasons:

• Automated campaigns: Some companies and AI projects are increasing their activity to collect more training data.
• Recently published vulnerabilities: If a vulnerability has been recently published, it could be exploited by bots to try to access vulnerable websites.
• Current habits: There may be a temporary increase in AI bots due to the season of the year or specific events.

Although AI bot traffic has decreased this week, the overall trend is still upward. This means it's important to stay alert and take preventive measures.

What we can expect

If the trend continues, an increase in AI bot traffic in the coming weeks is expected. The optimistic scenario is that traffic stabilizes and does not continue to grow. The pessimistic scenario is that traffic continues to grow and more protective measures are needed. Warning signs to watch for are:

• A sustained increase in AI bot traffic.
• An increase in the number of blocks.
• An increase in malicious bot traffic.

How it can affect your website or business

1. Scenario 1: A website with an outdated plugin

• If your website has an outdated plugin and the administrator uses a weak or repeated password on other sites, a bot could attempt to access the website via brute force. If successful, it could steal customer data, change the website content, or even use it to distribute malware.
• Consequences: Loss of customer trust, GDPR fines, lost workdays to recover the website.

2. Scenario 2: An online store with a vulnerable contact form

• If your online store's contact form is not well protected, a bot could attempt to send spam or even steal customer email addresses.
• Consequences: Customer emails marked as spam, loss of sales, damage to brand reputation.

3. Scenario 3: A website with an accessible admin panel

• If your website's admin panel is accessible and not well protected, a bot could attempt to access it via brute force. If successful, it could take control of the website and change its content.
• Consequences: Website downtime, modified content, loss of Google ranking.

How to protect yourself and prevent attacks

1. Use strong and unique passwords: A strong and unique password for each account reduces the risk of an attacker accessing your website if another account has been compromised.
2. Enable two-factor authentication (2FA): 2FA adds an additional layer of security, requiring a second factor (such as a verification code) to access your account.
3. Update CMS, plugins, and themes regularly: Updates often include security patches that protect your website from known vulnerabilities.
4. Use a web firewall: A web firewall filters attacks before they reach your application, blocking suspicious requests.
5. Enable BotLock: BotLock is a tool that controls and blocks malicious bots and crawlers from your website.
6. Review sensitive routes: Ensure that routes such as .env, .git, wp-login.php, and xmlrpc.php are protected and not publicly accessible.
7. Enable backups: Backups allow you to recover your website in case it is compromised.
8. Use a security detection service: A security detection service can identify CMS, plugins, and versions with known vulnerabilities and mark your website in the panel.
9. Enable automatic updates: If you installed your website from SWPanel, you can enable automatic updates for CMS, ensuring you are always protected against the latest vulnerabilities.
10. Subscribe to the security newsletter: The security newsletter alerts you when a vulnerability is published that could affect your website.

Which SWPanel tools can help you

• BotLock: Controls and blocks malicious bots and crawlers from your website. Use it if you want to protect your website from bots that attempt to copy content or access sensitive routes.
• FireWall: Filters web attacks before they reach your application. Use it if you want to protect your website from brute-force attacks, SQL injections, and other types of attacks.
• Automatic CMS updates: If you installed your website from SWPanel, you can enable automatic updates for CMS, ensuring you are always protected against the latest vulnerabilities.
• Backups: Allow you to recover your website in case it is compromised. Use it if you want to have a backup of your website in case of an emergency.
• PHP version change: If your website uses an unsupported PHP version, you can switch to a supported version from the hosting service. Use it if you want to ensure your website is protected against the latest vulnerabilities.
• Security analysis in Security 360: Detects CMS, plugins, and versions with known vulnerabilities and marks your website in the panel. Use it if you want to know if your website has security vulnerabilities.
• Security newsletter and alerts: Alert you when a vulnerability is published that could affect your website. Use it if you want to stay informed about the latest vulnerabilities.

Quick summary

• AI bot traffic has decreased this week, but the overall trend is still upward.
• It's important to stay alert and take preventive measures to protect your website.
• Use strong passwords, update CMS and plugins, and use tools like BotLock and FireWall.

Sources

The data in this article has been measured by us on the SWPanel platform.