Cloudflare's CEO isn't lying — but the truth is worse

Matthew Prince recently announced that 38% of all internet traffic is now AI bots — crawlers, scrapers, and agents hitting sites at scale. Founders saw the headline and split into two camps: panic, or ignore. Both are wrong. The real question isn't whether the number is accurate. It's what it means for your analytics, your CAC calculations, and every growth decision you're making right now.

Table of Contents

• What Prince actually said — and what he left out
• How bot traffic is wrecking your funnel metrics
• The paid ads problem nobody's talking about
• The flip side: AI crawlers as a growth lever
• How to audit your traffic in 20 minutes
• 5 Questions Founders Actually Ask
• Bottom Line

What Prince Actually Said — and What He Left Out

Cloudflare's data covers roughly 20% of all internet traffic — that's a legitimate sample size. When Prince says 38% of requests are automated, he's not fabricating a number. Cloudflare processes over 50 million HTTP requests per second globally. They have the data.

What he didn't say: that number includes everything from Googlebot (good) to credential-stuffing bots (bad) to AI training crawlers (complicated). Lumping them together creates a headline but obscures the decision you actually need to make.

The breakdown that matters for founders:

• Verified good bots (Googlebot, Bingbot): ~8% of traffic — these index you, don't block them
• AI crawlers (GPTBot, ClaudeBot, PerplexityBot): ~6-9% and growing fast — these feed LLMs
• Unverified/malicious bots: ~20%+ — these inflate your metrics and cost you money

The 38% figure is real. The implication that it's all a threat is where the narrative gets sloppy. As the AI agent economy accelerates, more of that bot traffic will be agents completing tasks — not just crawlers reading pages.

How Bot Traffic is Wrecking Your Funnel Metrics

Here's the specific damage: if 20% of your sessions are unverified bots, and your site gets 10,000 sessions/month, you're making growth decisions based on 2,000 ghost sessions.

What gets distorted:

• Bounce rate drops artificially (bots often hit multiple pages in sequence)
• Time on page skews — some bots linger, some exit in 0.3 seconds
• Conversion rate looks worse than it is (bot sessions don't convert, dragging the denominator up)
• Top pages report gets polluted — bots hammer specific URLs (usually /sitemap.xml, /robots.txt, /wp-login.php)

A SaaS founder running a 2% conversion rate might actually be running 2.5% — if 20% of their traffic is non-human. That's not a rounding error. That's a different growth trajectory.

DoableClaw's audit surfaces exactly this — drop your URL in and within 90 seconds you see which traffic segments are distorting your funnel data, with session duration filters already applied. No GA4 rabbit hole required.

The fix in GA4: create a segment filtering out sessions under 2 seconds with 1 pageview. That removes ~70% of low-quality bot sessions without touching legitimate traffic. Run your conversion rate on that segment. The number you see is closer to reality.

The Paid Ads Problem Nobody's Talking About

Google's own data shows invalid click rates between 11-14% across the display network. On competitive keywords (SaaS, fintech, D2C), that number climbs higher. You're paying for clicks that were never human.

Google does refund some invalid clicks automatically — but their threshold for what counts as "invalid" is conservative. Sophisticated bots that mimic human behavior (mouse movement, session depth) don't get caught.

For Indian founders running Google Ads: ₹50,000/month in ad spend with a 12% invalid click rate means ₹6,000 gone to bots every month. That's ₹72,000/year. Not catastrophic, but it's real money that's distorting your ROAS.

What to check:

1. Pull your Google Ads invalid click report (Campaigns → Columns → Competitive metrics → Invalid clicks)
2. Cross-reference with GA4 sessions from the same date range — if Ads shows 1,000 clicks but GA4 shows 820 sessions, the gap is mostly bots
3. Enable IP exclusions for known bot ranges — Cloudflare publishes these

This is also why understanding how AI is reshaping local and organic infrastructure matters — as more searches get answered by AI without a click, the traffic that does land on your site skews more bot-heavy by proportion.

The Flip Side: AI Crawlers as a Growth Lever

Here's what most founders miss in the bot panic: GPTBot, ClaudeBot, and PerplexityBot aren't just consuming your bandwidth. They're deciding whether your content gets cited when someone asks ChatGPT or Perplexity a question in your category.

This is Generative Engine Optimization (GEO) — and it's the actual growth lever hiding inside the bot traffic story.

If you've blocked all AI crawlers via robots.txt (a common Cloudflare misconfiguration), you've opted out of being cited in AI answers. For a B2B SaaS or D2C brand, that's a significant organic channel you've voluntarily abandoned.

What AI crawlers want from your site:

• Structured data (FAQ schema, HowTo schema, Article schema)
• Direct answers in the first 100 words of each section
• Named sources — they prefer content that cites specific data over vague claims
• Clean HTML — not JavaScript-rendered content they can't parse

The playbook: allow GPTBot and ClaudeBot explicitly in robots.txt, block unverified bots via Cloudflare's bot management, and structure your content for AI readability. You get indexed for LLM citations without paying for the bot traffic in server costs.

How to Audit Your Traffic in 20 Minutes

This is the 20-minute version founders can run today:

Step 1 — Check robots.txt (2 min) Go to yourdomain.com/robots.txt. If you see Disallow: / under User-agent: GPTBot, you're invisible to ChatGPT's crawler. Decide if that's intentional.

Step 2 — Pull GA4 session quality report (5 min) Explore → Free form → Dimension: Session source/medium → Metric: Sessions, Engaged sessions, Engagement rate. Any source with engagement rate under 20% is likely bot-heavy.

Step 3 — Check Cloudflare analytics (5 min) If you're on Cloudflare, Security → Bots shows your verified vs. unverified split. If unverified bots exceed 25% of requests, your analytics are materially distorted.

Step 4 — Cross-reference ad clicks vs. sessions (5 min) For any paid channel: clicks reported in the ad platform vs. sessions in GA4. Gap over 15% = significant invalid traffic.

Step 5 — Fix robots.txt and Cloudflare rules (3 min) Allow verified AI crawlers. Block unverified bots with Cloudflare's managed rules (free tier covers the basics). Done.

The OpenRouter funding round and the broader AI infrastructure buildout signals that AI agent traffic will only increase — getting your bot filtering right now is a one-time fix that compounds.

Conclusion

The 38% bot traffic figure is real, but the panic is misplaced. Your actual job: filter unverified bots from your analytics so you're making decisions on real human behavior, allow AI crawlers so you get cited in LLM answers, and audit your paid traffic for invalid click overlap. Run that 20-minute audit today. If you want the full picture fast, doableclaw.com scans your site and surfaces exactly which traffic segments are distorting your funnel — takes 2 minutes, no signup needed.