Bad bot

How does a bad bot work?

A bad bot is a program that visits your site to take or break something, and it usually hides what it is. Typical jobs include copying prices and text in bulk, testing leaked passwords on login pages and probing for outdated software. Good bots, by contrast, are published and verifiable. Cloudflare’s bot categories list search engine crawlers, uptime monitors and link-preview fetchers as examples.

Bad bots often copy a normal browser’s identity and rotate their IP addresses, so a block list of single addresses rarely holds. Defences look at behaviour instead: how fast requests arrive, which pages they hit and whether they behave like a person.

Why do bad bots matter for a small business?

Bad bots cost money and trust. Imperva’s 2025 Bad Bot Report puts bad bots at 37% of all internet traffic, within a total of 51% for automated traffic of all kinds. Imperva also says attackers now use AI to build bots, which lowers the skill needed to run one.

On your site, that shows up as slower pages, a larger hosting bill, customers locked out by failed logins and content copied elsewhere. Small sites are not exempt, because the attacks are automated and do not choose targets by size.

Read the full guide to bots and scrapers for how to recognise each type in your logs.