Kinsta Adds Free Bot Protection as Bots Pass Half of Web Traffic

For the first time, the typical website is built mostly for visitors who aren't people. According to Imperva's Bad Bot Report 2026, automated traffic passed 53% of all web traffic in 2025 — up from 51% the year before — leaving human activity at just 47% and falling. Cloudflare Radar paints it even starker for page content: in the seven-day window ending June 5, 2026, bots made up 57.4% of HTML traffic versus 42.6% for humans, with AI-crawler activity up roughly 300% year over year. Against that backdrop, managed WordPress host Kinsta has rolled out a free Bot Protection feature for every customer — a notable move because traffic filtering has traditionally been a paid add-on.

Why bot traffic became a hosting problem

Bots are not all bad. Imperva splits the automated half of the web into good bots (~13%) — legitimate search and monitoring crawlers — and bad bots (~40%), the scrapers, credential-stuffers, and fraud tools that have now grown for a seventh consecutive year. The newer pressure is AI: Imperva reports AI-enabled bot attacks rose 12.5x year over year, with the daily average of blocked attacks climbing from 2 million to 25 million.

The cost lands on infrastructure. Kinsta says it has seen automated traffic hit add-to-cart URLs 7.67 million times in a single 24-hour period, and one crawler generate 550 million requests over 30 days. That kind of load burns CPU, inflates bandwidth bills, and skews analytics — without a single sale behind it. Scaling servers to absorb it just pays for the abuse; the real fix is filtering it before it reaches the application.

When Bots Outnumber People: The AI Crawler Surge Hitting Your Website

What Kinsta's Bot Protection actually does

Bot Protection is built directly into the MyKinsta dashboard and is included free on all plans. Its core is four preset protection levels you can set per environment (so staging and production can differ), escalating in aggressiveness:

The challenges are CAPTCHAs powered by Cloudflare bot scores, and there's a dedicated Block AI Crawlers toggle for sites that don't want their content scraped for model training. To avoid breaking legitimate traffic, Kinsta ships a managed allow list that automatically covers common WordPress paths, WooCommerce routes, and trusted sources, with custom exceptions you can add by IP, user agent, or request path. A new dashboard tab breaks live traffic into verified bots, AI crawlers, automated traffic, and likely humans, so you can see what you're filtering before you tighten the screws. Kinsta also recently added a File Manager in MyKinsta for uploading and managing WordPress files directly from the dashboard.

The catch worth understanding

Two honest caveats. First, the engine underneath is Cloudflare's bot scoring — so this is Kinsta packaging and managing Cloudflare-grade detection inside its dashboard, not a wholly independent system. The value is that it's bundled and managed: customers who would otherwise buy a separate Cloudflare plan or WAF get enterprise-grade filtering at no extra cost, configurable without leaving MyKinsta. Second, bot management is a dial, not a switch — set it too aggressively (especially "Challenge Everyone") and you risk friction for real users and legitimate crawlers you actually want, like search engines. The per-environment tiers and the traffic-breakdown tab exist precisely so you can tune rather than blanket-block.

Who should turn it on

E-commerce and WooCommerce sites feel this most — Imperva found financial services alone absorb 24% of bot attacks and 46% of account-takeover incidents — so any store seeing inventory-checking, scalping, or add-to-cart abuse should start at "Block Malicious Traffic" and watch the dashboard. Content sites being scraped by AI crawlers can flip the Block AI Crawlers toggle. Smaller brochure sites may not need more than the lowest tier, but since it's free and per-environment, there's little reason not to enable baseline protection.

Bottom line

The web crossing the 50% bot threshold isn't a curiosity; it's a recurring line item on every hosting bill and a steady distortion of every analytics dashboard. Kinsta making managed, Cloudflare-powered Bot Protection free on all plans is a meaningful response — less because the technology is novel and more because it removes the cost and setup barrier that kept many WordPress sites unprotected. Treat it as future-proofing: bot traffic is trending one direction, and the tooling to manage it is now table stakes rather than a premium upsell.

FAQ

Is Kinsta Bot Protection really free?

Yes — it's included on all Kinsta plans at no additional cost, built into the MyKinsta dashboard, with four protection tiers configurable per environment.

Does it replace a separate Cloudflare or WAF subscription?

For many sites, effectively yes — it uses Cloudflare bot scoring under the hood and is managed inside MyKinsta, so customers who paid separately for that layer can consolidate it. Sites with advanced, custom WAF needs may still want a dedicated setup.

Will it block Google and other search engines?

Not by default. A managed allow list covers common legitimate paths and trusted traffic, and you can add exceptions by IP, user agent, or request path. The risk of blocking good crawlers rises mainly at the most aggressive "Challenge Everyone" tier.

What share of web traffic is actually bots now?

Imperva's Bad Bot Report 2026 puts automated traffic above 53% of all web traffic in 2025; Cloudflare Radar measured bots at 57.4% of HTML page traffic in early June 2026.

Sources and further reading

Try Kinsta