Bots have overtaken humans online. What does that mean for places?
For years, marketers treated website traffic as a reliable indicator of interest. More visitors meant greater visibility. More clicks suggested stronger engagement. More activity on a website was often seen as a sign that audiences were moving through the pipeline.
Times have certainly changed quickly. As of June 2026, Cloudflare reports that 57% of the internet traffic worldwide came from bots. This follows the 2026 State of AI Traffic & Cyberthreat report from Human Security in March showing the same trend. We have officially reached the point where bots have overtaken humans in share of website traffic, and we’re not heading back anytime soon.
This is an especially big challenge for place brands, IPAs and other location-based organisations that already had trouble measuring success, as many of them still rely heavily on website analytics as a sign of audience interest.
If more than half of all internet traffic is automated, how much of your location’s website activity really is coming from the people you want? Let’s explore.
What are bots?
When people hear the word “bot,” they often think of spam, fraud or phishing activity. Bots are just software programs that are designed to perform specific tasks on the internet without requiring any human input.
Some play a key role in keeping the internet functioning. Search engine crawlers such as Googlebot and Bingbot index websites and help users discover content through search results. Other automated tools monitor website performance, check accessibility, or support cybersecurity functions.
More recently, AI systems are becoming a source of automated traffic because these systems collect and process information from websites to answer questions, generate content, and train large language models.
In the meantime, there are more nefarious bots which are designed for scraping content, collecting data from multiple websites, generate fake traffic, and even submit spam forms.
As bot activity continues to grow, differentiating between useful and harmful bots is becoming very important.
Working with the momentum rather than against it
The goal is not to eliminate bots, as the good ones can help you surface on other channels of discovery. The challenge is protecting strategic data, maintaining reliable analytics, and ensuring audience pipelines are not disturbed by automated activity.
Here are several ways place brands and IPAs can strengthen their websites:
Improving bot detection
Organizations should consider adding additional layers of monitoring and verification, including:
Advanced bot detection platforms
Behavioural analytics
Traffic fingerprinting
IP reputation monitoring
Automated traffic filtering
Solutions from providers such as Cloudflare and Imperva are becoming more of a basic requirement for maintaining trustworthy analytics. You have probably already noticed a rise in other sites verifying your own visit.
Stronger data protection
Investment promotion websites often contain information such as incentive programs, workforce statistics, industry intelligence, operating costs, and available investment opportunities. Talent websites may have visa information and soft landing resources, while large real estate developments or masterplans may have detailed site plans.
Automated scraping tools can collect large volumes of this information within minutes, often without the website owner's knowledge, throwing off performance dashboards.
Several preventive measures can help reduce this risk:
Api controls: APIs are often used to provide access to datasets and digital services. Proper access controls can limit how information is retrieved while still allowing approved users and systems to access the data they need.
Rate limiting: Restricting how quickly visitors can request information makes it more difficult for automated tools to extract large quantities of content in a short period of time.
Dynamic content delivery: Presenting selected information in ways that are more resistant to automated scraping can help protect valuable data without creating barriers for genuine investors.
Protecting contact forms
Most investment promotion or talent attraction websites have contact forms that allow investors to submit project enquiries or contact the representatives directly. These forms are increasingly targeted by bots that can send spam messages, fake enquiries, and generate low-quality leads. The result is wasted time on qualifying the form submissions and reduced confidence in form submissions.
Several practical measures can help:
CAPTCHA Verification: Tools such as Google reCAPTCHA and hCaptcha can help confirm that form submissions are coming from users rather than bots.
Email Validation: Services such as ZeroBounce and VerifyBee can verify whether submitted email addresses are genuine before they enter CRM systems or lead databases. Preventing generic email submissions can also be arranged, depending on the audience.
Form Submission Limits: Restricting the number of times a single form can be submitted from the same IP address, or device helps prevent automated systems from generating large volumes of fake enquiries.
Tackling Click Fraud: Many IPAs and EDOs invest in paid advertising through platforms such as Google Ads and LinkedIn Ads. Bot-generated clicks are quite frequent and can consume advertising budgets, inflate campaign metrics, and create a misleading picture of performance. Tools such as ClickCease, CHEQ, ClickPatrol, and Lunio are designed to identify suspicious activity by monitoring patterns such as repeated clicks from the same source or unusually rapid click behaviour. When used correctly, any and all of these tools can improve traffic quality and provide more reliable campaign data.
Bots are not going anywhere
Bot traffic is now a part of the new internet technology and has been for some time. In many cases, it’s smart to build your website infrastructure around this knowledge to aid discovery on various search platforms.
Increasingly, AI assistants, search engines and enterprise research tools are becoming intermediaries between organisations and decision makers. The challenge is distinguishing between bots that help distribute your information and bots that distort analytics or exploit your content.
The need to protect your digital assets from undesirable activity is growing in importance. Good data strategy is good marketing, and what’s required for that is getting more complex.
Organizations that can reduce bot activities will be in a stronger position to measure performance accurately, improve lead quality, and identify real opportunities for boosting investment, talent and growth.
