Cybersecurity firm HUMAN Security released a report last week: AI bots and automated traffic now outnumber human users on the internet.
Automated traffic grew nearly 8x faster than human traffic in 2025. AI agent traffic shot up 7,851% year-over-year. OpenAI's crawlers account for 69% of observed AI traffic, followed by Meta at 16% and Anthropic at 11%.
If you run a business website in Malaysia, AI bot traffic in 2026 has real consequences for your analytics and your hosting bill.
AI bot traffic in 2026: half your visitors might not be human
The part that surprised us most: many AI crawlers don't execute JavaScript. They pull content straight from your HTML without triggering Google Analytics or any tag-based tracking tool.
Your GA4 dashboard could be showing 500 visitors a day while your server handles 1,500 requests. You're paying for that bandwidth, but you can't see it in your analytics.
For Malaysian businesses on shared hosting (which is most SMEs), that's a problem. More bot traffic means slower page loads and higher costs. Worse, inaccurate data could be driving your marketing decisions right now.
We've seen this with client projects. One e-commerce site had server CPU usage that doubled over six months while GA4 traffic stayed flat. The culprit: AI crawlers hitting the site thousands of times per day.
Should you block AI bots from your website?
Most articles give you a non-answer on this. So we'll be direct.
Block the training crawlers, keep the search crawlers. Not all bots are equal. Some scrape your content to train AI models (you get nothing). Others index your content so it appears in search results and AI answers. Block the wrong ones and you disappear from search.
Here's a quick reference:
| Bot | Type | Action | Why |
|---|---|---|---|
| Googlebot | Search crawler | Allow | Drives organic traffic |
| GPTBot | AI search | Allow | Shows up in ChatGPT answers |
| PerplexityBot | AI search | Allow | Shows up in Perplexity answers |
| ClaudeBot | AI search | Allow | Powers Claude's web search answers |
| CCBot | Training scraper | Block | Scrapes content for model training |
| Bytespider | Training scraper | Block | TikTok's crawler, no benefit |
If you're curious, our own robots.txt does exactly this. We allow Googlebot, GPTBot (for ChatGPT search), and PerplexityBot while blocking pure training crawlers like CCBot and Bytespider.
How to protect your business website from AI bots
You don't need an enterprise security budget for this. A few steps go a long way:
1. Audit your robots.txt. Add disallow rules for crawlers that only scrape for training:
User-agent: CCBot
Disallow: /
User-agent: Bytespider
Disallow: /
Remember: robots.txt is a request, not a wall. Good bots follow it. Bad actors ignore it.
2. Check your server logs. Your hosting panel (cPanel, Plesk) has raw access logs. Look for user-agent strings like GPTBot, ClaudeBot, or Bytespider. Thousands of daily requests from these? That's your invisible traffic.
3. Use Cloudflare's free tier. Cloudflare offers a free "AI Audit" tool that shows which AI bots hit your site and lets you block them with one click. For most Malaysian SMEs, this is the easiest option.
4. Compare server metrics with GA4. If your hosting dashboard shows way more traffic than GA4, the gap is likely bots. Not a bug in your analytics. Just the new normal.
How this affects Malaysian businesses specifically
Malaysia's Cyber Security Act 2024 puts obligations on designated critical infrastructure operators to maintain their digital security. It doesn't apply to most SMEs directly, but the direction is clear: cybersecurity expectations for all businesses are rising.
Many Malaysian SMEs run on budget hosting plans from local providers with bandwidth limits. If AI crawlers eat through your bandwidth, you're paying for traffic that will never buy anything, adding to the rising cloud costs businesses are already dealing with.
There's a flip side though. If your business shows up in ChatGPT, Perplexity, or Google's AI Overviews, that's a new discovery channel. Block everything and you miss out. Be intentional about what you allow and what you don't.
If you're running an e-commerce site or web app, worth doing a proper audit. We've helped clients set up bot management that keeps good crawlers while filtering the rest. It connects to cloud security basics we covered earlier. No cybersecurity setup yet? Good reason to start.
Thinking about how AI traffic affects your business? Let's chat, we'll give you an honest take, no sales pitch.
This article references publicly available data. For the latest guidance on Malaysia's cybersecurity obligations, consult a qualified legal professional.
