Cloudflare: Machine Traffic Could Hit 1,000x Human Traffic In 5 Years
Skip to content
Subscribe
AMA with Reddit Experts: What's Working Now & How To Get Into The Threads AI Cites
Register Now
SEJ
SEO
Slobodan Manic
August 14, 2026
8 min read
Slobodan Manic<br>Founder of No Hacks and machine-first website optimisation consultant at No Hacks
Bio
Follow
207
READS
The single largest AI crawler on my website over the past day was not an AI crawler. It arrived roughly 1,500 times under Common Crawl’s name; it sent back nothing, and what it wanted was my SSH keys.
I went looking because of a number.
Cloudflare’s CFO Told Analysts Machine Traffic Could Reach 1,000 Times Human Traffic
Cloudflare’s Chief Financial Officer, Thomas Seifert, told analysts on the company’s second-quarter earnings call that “if the current trends continue, we think in five years, non-human traffic will be as much as 1,000 times as much as human traffic.” Then the line that will capture the headlines: “humans will be a rounding error on the internet, not because human traffic goes down, but that’s just how fast we’re seeing non-human traffic grow.”
Two things worth saying before anyone reaches for the pitchforks. First, Seifert added his own caveat, unprompted: “with the big caveat that I have called it wrong at every point along the way.” Cloudflare previously expected machine traffic to pass human traffic in 2027, and it happened in May 2026. His errors have run toward underestimating, which is the strongest argument for taking the projection seriously.
Second, the underlying measurement is real. Cloudflare’s own post published the same week says fewer than half of all HTML page requests now come from a human. I have no argument with that. The machine visitors are real and they are the whole subject of this website.
The argument is about what the number counts.
What One Day of Crawler Traffic on My Own Website Looks Like
I pulled Cloudflare’s AI crawler view for nohacks.co for the 24 hours ending the evening of August 7. About 3,000 requests, of which roughly a third were unsuccessful, a figure up more than 1,000% on the previous period.
By crawler: CCBot 1,510. ChatGPT-User 375. ClaudeBot 296. Googlebot 245. PetalBot 107. Thirteen others sharing 353 between them.
Image Credit: Slobodan Manic<br>CCBot is Common Crawl’s crawler, the long-running non-profit web archive whose corpus trained a good share of the models everyone now argues about. On paper, it being my largest visitor is unremarkable.
Then I exported the paths.
It Asked for My SSH Keys, Not My Articles
Here are the most-requested paths in that AI crawler traffic, with request counts, exactly as they came out of the export:
/.ssh/known_hosts (42 requests)
/phpinfo.php (31 requests)
/.boto (30 requests)
/.env.production (29 requests)
/.vscode/launch.json (28 requests)
/.env.test (27 requests)
/firebase-service-account.json (26 requests)
/.gitconfig (24 requests)
/server/.env (24 requests)
It continues like that for a hundred paths: /id_rsa, /id_ecdsa, /private-key, /ssl/localhost.key, /key.json, /serviceAccountKey.json, /.aws/config, /actuator/configprops, /api/v1/env, /Dockerfile, /values.yaml, and /@fs/proc/self/environ, which is an attempt at a known path-traversal bug in a development server.
Across those hundred paths: 1,028 requests, 6.7 MB transferred, and zero referrals. The number of requests to anything I have actually written rounds to nothing. The closest it came to my content was /blog/wp-login.php, a WordPress login probe aimed at a website that has never run WordPress, and two requests for /blog/null.
That last detail matters more than it looks. Whatever this is, it is not reading my pages before it asks for things. It is working through a list, the same list it works through everywhere, and my website is a row in a loop.
This is a credential scanner. Common Crawl follows links and fetches pages, and it has no reason to ask a podcast website for its Firebase service account key.
I could not verify the source addresses to prove impersonation, because per-request IP data is not something I can reach on my plan. Common Crawl publishes the test: genuine CCBot traffic comes from documented address blocks and reverse-resolves to hostnames ending in crawl.commoncrawl.org. Someone with those logs can settle it in a minute. What I can say is what arrived, what it asked for, and how it was labelled: Cloudflare’s AI dashboard attributes this to Common Crawl as the operator, and counts every request toward my AI crawler totals.
Which leads to the part that unsettles me most. I went looking for these requests in my security events and found nothing at all, because the security log only records requests that trip a rule. I am not blocking this traffic, so it passes through, gets served, and leaves no mark. It appears in exactly one place on my...