Bad Bots Up 124%: 5 Takeaways From DataDome’s 2026 Report
On this page
Bad bot traffic grew 124% in a year, about nine times faster than human traffic, according to DataDome’s 2026 bot report.[2] The bigger change for site owners is where those bots go now: login pages, signup forms and checkout, not just your blog posts.[3]
DataDome sells bot protection, so read its numbers as one vendor’s view of its own customers. Still, the trends line up with what other researchers reported the same week.[5] Here’s what the report found, what it means if you run a website, and five things to check.
What happened
On September 22, 2026, DataDome published its State of Bot & Agent Security Report 2026.[1] It’s based on more than a trillion requests across over 75,000 customer sites from July 2025 to June 2026.[3] In June 2026, the company also tested the homepages of 21,491 popular websites with 10 kinds of bots.[4]
| Finding | Number |
|---|---|
| Growth in bad bot traffic | 124% in 12 months[2] |
| Scraping’s share of bad bot traffic | 70.9%, up 185.2%[3] |
| Growth in fake account creation | 34.5%[2] |
| Growth in AI agent and crawler traffic | 82.3%[1] |
| AI requests to login, form, cart, payment and signup pages (H1 2026) | 605.6 million[3] |
| Tested sites that stopped none of the 10 bots | 65.3%[4] |
| Tested sites that stopped all 10 | 2.4%, down from 8.4% in 2024[3] |
Two details stand out. First, AI traffic to login pages rose from 11.9 million requests in January to 99.7 million in June.[3] Login pages now get 51.7% of AI bot visits to sensitive pages, up from 23% a year earlier.[3] Second, bots that pretend to be well-known AI crawlers got past more than seven sites in 10.[3]
Why bad bot traffic matters for your site
Most of the attention goes to scraping, and scraping is still the biggest category.[3] But for a small business, agency client or membership site, the costly part is the bots that act. They create accounts, try passwords, fill in forms and hold inventory.
Akamai saw the same shift. In a separate 30-day analysis, verified AI crawlers moved from reading pages to sending data, like logins and cart actions.[5] Online stores absorbed 44.8% of those AI bot transactions.[5]
DataDome’s Jerome Segura put the main weakness simply. Requests that claim to be GPTBot or ClaudeBot are “often let through on the name alone.”[3] A bot’s name is just a line of text it sends with each request, called the user agent. Anyone can type “GPTBot” there.
It’s growing fast, and it’s going deeper
Jerome Segura, DataDome [2]
5 things to check this week
None of these need a big security budget. Start with the pages where a bot can do something, not the pages it can only read.
1. Stop trusting bots by name
If your firewall, host or security plugin has rules that allow “good bots” through, find out how it decides who’s good. Matching the user agent alone isn’t enough. DataDome found that only 5.5% of tested sites caught a bot that faked a real browser’s network fingerprint.[3]
Real crawlers can be checked. OpenAI publishes the IP ranges for GPTBot, OAI-SearchBot and ChatGPT-User as JSON files.[6] Google tells you to verify Googlebot with a reverse DNS lookup, then a forward lookup that must return the same IP.[7] For example:
host 66.249.66.1
# crawl-66-249-66-1.googlebot.com
host crawl-66-249-66-1.googlebot.com
# 66.249.66.1If a “Googlebot” visit fails that check, it isn’t Google.[7]
2. Treat your login page as a target
Credential stuffing means trying usernames and passwords leaked from other sites. DataDome says it was flat for the year, but it comes in waves: it surged in summer 2025, fell 90%, then hit new highs by April.[3] Quiet months don’t mean it’s over.
- Turn on two-factor login for every admin and editor account.
- Limit failed login attempts per IP and per username.
- Don’t show whether the username or the password was wrong.
- Watch for spikes in failed logins, not just successful ones.
3. Make fake signups cost more
Fake account creation grew 34.5%.[2] On WordPress and most membership tools, a fake account is the first step to profile spam, comment spam and coupon abuse. Require email confirmation before an account can post, hold first posts for moderation, and turn registration off if you don’t need it.
4. Check your forms and checkout, not just your content
AI bot visits to forms, carts and payment pages are small in share but large in volume: 97.9% of AI bot requests still hit homepages and general content, yet the rest added up to 605.6 million requests.[3] Look at your form and order logs for bursts of submissions from the same IP ranges, blank or nonsense fields, and orders that never complete. Our guide to stopping contact form spam without a CAPTCHA covers the form side in more detail.[8]
5. Be realistic about robots.txt
Robots.txt is a request, not a lock. Well-behaved crawlers follow it, and OpenAI lets you allow or block each of its bots separately.[6] But OpenAI also says ChatGPT-User acts when a person asks, so robots.txt rules may not apply to it.[6] Bad bots that fake their name won’t read your robots.txt at all. Use it to state your preferences, then use verification and rate limits to enforce them.
What this report doesn’t tell you
These numbers come from DataDome’s own customer sites.[1] Those are businesses that pay for bot protection, so they may see more attacks than a typical small site. Your site won’t see 124% more bots just because the average did. The test of 21,491 sites also checked homepages only, so a site with protected login and signup pages could still count as “unprotected”.[4]
The useful part is the direction. Bots are moving toward the pages where they can take an action, and pretending to be a known AI crawler works on most sites. We wrote about the same pattern from another angle in our piece on OpenAI’s rogue agents and CAPTCHAs.
Where Zero Spam fits
Zero Spam won’t stop scraping or verify crawlers for you, and it isn’t a firewall. It checks registrations, comments and form submissions against known bad IPs and emails before they go through, using the free WordPress plugin or the API. That helps with checks 3 and 4. If that’s useful, start on the free Explorer plan. For a wider plan, see our guide to preventing website spam.
FAQ
Frequently Asked Questions
In DataDome’s 2026 report, bots and AI agents made up about 26.5% of the traffic it analyzed across its customers. Other studies use different methods, so their numbers differ.
DataDome measured 124% growth in malicious bot traffic over 12 months, about nine times the growth in human traffic. That’s across its own customer sites, so treat it as a trend, not a figure for every site.
Don’t rely on the user agent name. Check the IP address against the ranges OpenAI publishes for its bots, or for Googlebot, run a reverse DNS lookup and confirm it with a forward lookup.
No. Robots.txt only works for crawlers that choose to follow it. Bots that fake their identity ignore it, so you need rate limits, verification and form protection too.
Login pages let bots test stolen passwords and take over accounts. DataDome saw AI traffic to login pages grow from 11.9 million to 99.7 million monthly requests between January and June 2026.
Sources & References
- DataDome: State of Bot & Agent Security Report 2026, key findings (Sep 22, 2026)
- DataDome press release: malicious automated traffic growing 9x faster than human traffic (Sep 22, 2026)
- SiliconANGLE: scraping, login-page AI traffic, spoofed agents, protection test results (Sep 22, 2026)
- Help Net Security: 21,491 homepages tested, 65.3% stopped no bots (Sep 23, 2026)
- Help Net Security: Akamai sees AI crawlers shift to POST actions, 44.8% at e-commerce (Sep 22, 2026)
- OpenAI: Overview of OpenAI crawlers, published IP ranges, robots.txt and ChatGPT-User (accessed Oct 1, 2026)
- Google Search Central: Verifying Googlebot with reverse and forward DNS (accessed Oct 1, 2026)
- Zero Spam: Stop WordPress contact form spam without a CAPTCHA (accessed Oct 1, 2026)
