Short answer: Not by looking. Bots now send more web traffic than people do, and the image-grid CAPTCHA on most small-business forms can be beaten by free AI models running on an ordinary computer. The checks that still work rest on something a bot cannot get for free: a piece of trusted hardware, a payment, a real government ID, or a track record built over time. If you run a small business website or a public booking portal, decide which of those four you are willing to require, and ask for it only at the step that costs you money.
Bots write more of the internet than people do now
Two large, independent trackers say close to the same thing from different angles.
Imperva's 2026 Bad Bot Report, published 29 April 2026 on full-year 2025 data, puts automated traffic at 53% of all web traffic that year, up from 51% in 2024. Human traffic fell to 47%, down from 49%. By Imperva's count, that is the second year in a row that bots outnumbered people.
Cloudflare's numbers moved faster. Its Radar 2025 Year in Review put non-AI bots at 44% of HTML requests as of 2 December 2025, against 47% human, with AI bots at a further 4.2%. Six months later the line was crossed: on 3 June 2026, CEO Matthew Prince posted that bots had overtaken humans on requests for web content, 57.5% to 42.5%, well ahead of the 2027 date he had given at SXSW three months earlier.
Neither number means half your visitors are attackers. Search crawlers, uptime monitors and AI answer engines summarising your pages are bots too, most not trying to steal anything. But the direction is the same everywhere it gets measured. Nikita Bier, who stepped down as X's head of product in August 2026 and stayed on as an adviser, wrote on 22 September 2026 that "bot detection & human verification will be one of the most urgent demands for businesses over the coming years," and that "agent swarms will suffocate every website and form; small companies and government websites are most vulnerable." When his team at X looked for a vendor, "there was not a single company that brought together all the latest technologies so we had to do it all in-house." Most businesses do not have that budget. This series is about what the rest of us do instead.
Every "prove you're human" test has a shelf life
For two decades, the assumption behind a CAPTCHA was simple: a puzzle a person solves by looking and clicking is hard for software to fake. Two recent papers show that assumption running out, at different speeds for different puzzle types.
Open CaptchaWorld, a May 2025 benchmark spanning 20 modern CAPTCHA types, found humans solving them correctly 93.3% of the time. The best multimodal AI agent tested, Browser-Use running on OpenAI's o3, managed 40.0%. On the newest, most visually demanding puzzle types, a CAPTCHA was still doing real work.
The older ones are not. A paper posted to arXiv on 16 September 2026, "Robot Visions: Breaking reCAPTCHA at Zero Cost and Zero Shot", built a solver entirely from free, locally run open-source models, CLIP and OWLv2, with no training and no paid API calls, and ran it against 500 real reCAPTCHA v2 sessions. It solved 92.6% of them. That is the standard image-grid CAPTCHA still sitting on contact forms and signup pages across the small-business web, beaten by software anyone can download for nothing. The authors conclude that "challenge-based visual CAPTCHAs may have reached the end of their useful life."
Read together, the two papers describe a race. The newest, most convoluted challenge types still slow an AI agent down. The one most small sites installed years ago does not. Is CAPTCHA still enough to stop bots on my website? has the full breakdown by product, Turnstile, reCAPTCHA, hCaptcha, and the proof-of-work alternatives now replacing them. The short version: a CAPTCHA is a speed bump. It buys you time and nothing more.
What actually can't be faked for free
If looking and clicking no longer proves anything, what does? Most serious verification methods come down to one of four things.
Hardware. A device vouched for by its own maker, checked with a Private Access Token or Android's Play Integrity API, is expensive to fake at scale because each fake needs its own real or emulated device.
Money. X's "Not a Bot" program, tested in New Zealand and the Philippines from October 2023, charged new unverified accounts $1 a year to post, reply or repost; anyone who skipped it could still read, just not act. A dollar is nothing to one person opening one account. It adds up fast for whoever is opening ten thousand.
Real identity. A phone number tied to a SIM, a government ID, in India an Aadhaar OTP or a DigiLocker document, costs real effort and often real money to acquire in bulk, and it is traceable back to a person if abused.
Time and history. An account, a payment method, or a device with six months of ordinary behaviour behind it is harder to manufacture than a fresh one, because the fraud only pays off once the reputation is built, and that costs the attacker time better spent elsewhere.
None of these is free to fake. That is also why an unmetered "we'll text you a code" step is an expensive door to leave open. Elon Musk said on a Twitter Spaces call on 20 December 2022 that the platform was losing roughly $60 million a year to telecom operators, 390 of them by his count, whose bot accounts triggered SMS verification codes to collect a cut of the messaging fee. The figure is Musk's own claim, not an audited number, but the mechanism is simple: an OTP text costs the sender real money and costs the bot almost nothing to request.
"Human vs bot" is the wrong line to draw
A growing share of the traffic reaching your site in 2026 is neither a person clicking nor a scraper stealing content. It is an agent, ChatGPT's browsing mode, Perplexity's Comet, an open-source Browser Use loop, acting on a real person's behalf: booking their flight, filling their form, buying what they asked it to buy. Block every non-human request and you block your own paying customers along with the attackers.
The line that matters is accountable versus anonymous. Can you tell who, or what company, is behind a given request, and can you rate-limit, bill or hold them liable if something goes wrong? Standards moving through 2026, Web Bot Auth (an IETF working group building on RFC 9421's HTTP Message Signatures), Cloudflare's verified-bot and signed-agent programs, and payment-side protocols from Visa, Mastercard, Google and Stripe with OpenAI, all try to answer that question by having the agent identify itself cryptographically rather than pretend to be a browser. Should my website block AI agents or let them in? covers what that looks like in practice, and when blocking the agent means losing the sale.
Put the check where it costs you something
A contact form that only produces a sales lead does not need the same defense as the button that sends an OTP, books a slot, or pays out money. Put friction at the front door of a low-value form and you lose real visitors to a puzzle that was never protecting anything expensive. Put the check at the step where a pass costs you something, an SMS sent, a slot reserved, a payout issued, and a bot has to clear it every time it wants to do damage, not once per session.
How do I stop bots from spamming my contact and signup forms? works through the practical version of this for a small business: a honeypot and a light challenge on the contact form, a tighter check before anything that sends an SMS or opens an account, and rate limits tied to an identity rather than an IP address that a dozen real customers might share.
Make the swarm pay per head, not per attack
The whole cost-gap argument collapses to one design rule: the attacker's cost has to rise with volume, roughly in line with yours. One person doing one thing should cost close to nothing; that is what makes a website usable. Ten thousand bots doing the same thing ten thousand times should cost ten thousand times as much, in money, in identity checks, in time. A flat CAPTCHA in front of the whole site fails that test, because solving it once and replaying the session is nearly free at any scale.
Public booking portals show what happens when that rule is ignored, and what fixing it looks like. Indian Railways has deactivated more than three crore suspicious IRCTC user IDs since January 2025, Railway Minister Ashwini Vaishnaw told the Lok Sabha in a written reply reported on 11 December 2025, after putting Tatkal bookings on 322 trains behind Aadhaar-based OTP verification; the minister said the time confirmed Tatkal tickets stayed available on those trains rose about 65%. The US Mission in India made the same call on a smaller scale: in March 2025 its consular team cancelled about 2,000 visa appointments made by "bad actors" in breach of its scheduling rules, and suspended the accounts behind them, saying it has "zero tolerance for agents and fixers." Both fixes tie the booking to a real, checkable identity instead of a session cookie, which is what makes grabbing ten thousand slots cost more than grabbing one. How can government portals stop booking bots without locking out citizens? goes through the accessibility trade-offs that come with doing this, because GIGW 3.0 and WCAG rules do not disappear just because the fraud is real.
What this means if you run a small business or a public portal
If you run a small business site, you almost certainly do not need X's in-house stack. You need to know which of your forms are cheap to spam and which are expensive, and put the stronger check only on the expensive ones: the signup that triggers an SMS, the quote request that reaches a salesperson's calendar. What does bot protection cost a small business in 2026? runs the published prices, Cloudflare's Turnstile is free, reCAPTCHA's own billing page gives you 10,000 assessments a month free, then an $8 flat fee up to 100,000, then $1 per 1,000 above that, against what an unfiltered bot problem costs in SMS bills, fake leads and server load.
If you run a public portal, the stakes are different: you cannot price out the people you dislike, because the citizens who need the service most are often the least able to absorb friction. The IRCTC and visa-appointment examples above point the direction that works: tie the valuable action to a real identity rather than a harder puzzle at the front door, and build in an accessible path for the people a biometric or OTP step would otherwise exclude.
Where this leaves Ready Bytes
Ready Bytes has not built a bot-protection product. We build web apps, back-office automation and integrations for owner-led businesses, the pattern behind AI back office for small business: what actually works. Nothing here is a case study.
What we can do is look at one specific form, booking flow or signup step you are worried about and tell you honestly whether the fix is a free setting change or real work.
- A free AI opportunity audit at /ai-audit: fifteen to twenty questions, about five minutes, no cost. Shyam reviews it and emails a written audit within two business days.
- A $500 full audit if the free one surfaces something: read-only access, your top 3 opportunities ranked by ROI, a 90-day roadmap and a fixed pilot quote, credited against the pilot if you proceed.
- A fixed-quote pilot, typically $3,000 to $8,000 over 2 to 6 weeks, scoped to one piece, most likely the single highest-value form or booking step on your site, not a full bot-protection rebuild.
- An ongoing relationship after a pilot has proved itself.
The most useful outcome is often a recommendation to spend nothing.
Start here
Do one count this week, before reading a single vendor page.
List every form, signup step and booking action on your site. Next to each, write two numbers: what it costs you if a bot completes it (an SMS charge, a fake lead someone has to call, a slot a real customer wanted) and roughly how many attempts a week look automated. Check your server logs or your inbox for the pattern: near-identical submissions, seconds apart, at hours no customer keeps.
Sort the list by that cost number, high to low. The top one or two items are where a real check belongs. Most of what sits below the middle of the list is probably fine with the honeypot or CAPTCHA you already have, if you have one at all. For most small sites, that ordering is the first fix, before any new product.
Shyam Verma founded Ready Bytes in 2009 and has been building software since 2005. He writes about back-office automation, legacy modernization and applied AI at readybytes.in/blog.
Shyam Verma
Full Stack Developer & Founder
Shyam Verma is a seasoned full stack developer and the founder of Ready Bytes Software Labs. With over 13 years of experience in software development, he specializes in building scalable web applications using modern technologies like React, Next.js, Node.js, and cloud platforms. His passion for technology extends beyond coding—he's committed to sharing knowledge through blog posts, mentoring junior developers, and contributing to open-source projects.
