Fastly’s latest Threat Insights Report, AI, Bots, and the Agentic Future of the Web, explores how AI, bots, and automation are reshaping the internet – and found that nearly half of all internet requests now come from bots. One of the clearest takeaways from the report is that every industry is experiencing AI differently. Some are seeing more malicious automation. Others are navigating new operational and infrastructure challenges as “wanted” bots like AI completely shift their operating model.
But for e-commerce, AI isn’t another traffic shift – it’s introducing both strategic and operational challenges. Retailers must now invest more heavily in bot detection and mitigation tools to protect site performance, inventory, and data integrity. At the same time, the presence of automated traffic can distort conversion metrics and attribution models, leading to misguided business decisions.
That’s what makes e-commerce one of the industries facing the most immediate strategic implications from AI-driven traffic.
The state of bots in e-commerce
Bots are increasingly reshaping the digital retail landscape: They can simulate user behavior at scale, from product page visits to cart activity, and are often used for purposes like price monitoring, competitive intelligence, ad fraud, and even manipulating analytics. As a result, a growing share of traffic on e-commerce sites no longer represents genuine customer journeys, making it harder for businesses to accurately measure demand, optimize marketing spend, or interpret user behavior. Even desired or ‘wanted’ bots - those that e-commerce sites WANT on their websites - have broader implications organizations must consider.
The numbers in this quarter’s report reveal that e-commerce has:
5% more human traffic than the global baseline
5% less unwanted traffic than the global baseline
43% more wanted traffic than the global baseline
So what do these numbers mean? And what are the AI and bot traffic implications to e-commerce more broadly? We’ve provided our takes in the following sections.
The Current e-commerce Landscape
The following background helps provide context for the report’s findings and their implications for e-commerce sites.
The Challenge of Data-Reliability
AI traffic is fundamentally changing e-commerce: At a basic level, a growing share of site visits, product views, and even cart activity is no longer human - and site owners must be equipped to handle this. AI bots scrape product catalogs, monitor prices in real time, test checkout flows, and simulate user journeys at scale. This shifts e-commerce from a purely customer-driven environment to one where automation is introducing added complexity.
One major impact is on data reliability. E-commerce has long depended on behavioral signals (think clicks, time on page, and conversion rates) to guide decisions. When a meaningful portion of activity now comes from bots, those signals become blurry. Teams risk optimizing for behavior that doesn’t reflect human demand, which can distort everything from merchandising, to ad spend and overarching business decisions.
Implications to Competition
AI traffic is also accelerating price competition and market efficiency. Bots can track competitors’ pricing instantly and continuously, enabling dynamic pricing strategies. While this can benefit consumers with better deals, it compresses margins and creates a high-speed feedback loop where pricing advantages are short-lived.
Security Risks
Another shift is in infrastructure and security priorities. Handling large volumes of automated traffic puts strain on site performance and increases costs (infrastructure, bandwidth, compute). At the same time, retailers must defend against more sophisticated bots like scalpers targeting limited inventory, scraping bots extracting proprietary data, or credential stuffing campaigns looking to leverage saved information in personal accounts. This has made bot detection, rate limiting, and traffic filtering critical.
E-commerce is evolving from a human-centric environment to one where businesses must continuously distinguish, defend against, and strategically leverage automated interactions.
E-commerce Q1 Findings
With that context in mind, let’s dig into this quarter’s stats.
1. More ‘wanted’ bots means more strain
As traffic shifts to a nearly-equal split between automated and human, the 43% more wanted traffic than the global baseline of 1% noted for e-commerce should raise flags and prompts additional assessment.
Is this 43% truly wanted? Do organizations have adequate bot management policies and tools in place to ensure they can distinguish between this purportedly ‘wanted’ traffic and unwanted traffic? And is there a robust bot strategy in place that defines the business outcomes (both positive and negative) when this volume of automated traffic hits the website?
Even wanted bots (think search engine crawlers, fetchers, etc) can place short-term strain on e-commerce infrastructure when operating at scale. Unlike humans, these bots don’t browse casually; they systematically crawl large portions of a site, often hitting thousands of pages in rapid succession. This can drive up server load, increase bandwidth consumption, and degrade site performance for real customers, especially when combined with peak traffic periods.
For dynamic e-commerce environments with frequently changing inventory and pricing, bots may repeatedly request the same pages to stay up to date, amplifying the load even further. E-commerce also experiences more of the ‘traditional’ SEO-era scraping we are used to seeing, where established crawlers prioritize this type of content as part of their historical and ongoing routines: 36% of bot traffic to e-commerce sites came from Google.
The challenge is that this wanted traffic is often valuable; it powers search visibility, feeds AI discovery tools, and supports legitimate integrations. Therefore, outright blocking this traffic doesn’t cut it. Retailers must invest in sophisticated bot management tools and strategies that can help accurately assess this traffic, allowing them to make informed decisions on which traffic they truly want on their site(s).
2. More humans thanks to human behavior
With e-Commerce showing 5% more human traffic than the global baseline of 51%, this quarter’s numbers point toward the fact that humans are still actively shopping online. If you consider many other industries - take publishing for example - the new “AI era” has reshaped how people navigate the web. Browsing for a news story? You can probably get your questions answered by the AI summary at the top of your search page. Any industries providing knowledge (data, news, information) are seeing greater impacts to human traffic, as users no longer need to click through the host sites to satisfy their search queries.
We hypothesize that e-Commerce’s higher volume of human traffic is reflective of the nature of online shopping - genuine human users still enjoy browsing inventory, and the numbers this quarter show it. But, with 5% being a small number, it could also simply be reflective of the dynamic nature of traffic during our analysis. We will continue to monitor and report in subsequent quarters.
3. E-commerce less of a target
Perhaps most interesting this quarter was the finding that e-commerce saw 5% less unwanted traffic than the global baseline of 48%. This means that e-commerce had less unverifiable, potentially nefarious or questionable traffic on their sites than the rest of our sample.
Our report last quarter took a deep dive into headless automation - that is, fully functional automated browsers used to mimic real user behavior on websites, but at machine speed and scale. E-commerce saw the highest volume of headless traffic at 45% of total in our last report, likely partially due to the fact that e-commerce sites represent opportunities for attackers to compromise accounts, scrape for real-time inventory and pricing data to undercut and snoop on sales – all of which they can do with less security interference under the guise of legitimate traffic via headless clients.
The story here seems to be that while slightly better off than their peers, e-commerce is still a very ripe target for nefarious activity. We think the 5% this quarter is something likely reflective of general fluctuations, but should not be interpreted to mean that unwanted bots should receive any less attention. Even small numbers of nefarious bot activity can have outsized impacts given this was 5% more than our global baseline that found unwanted bots at 48% of all traffic globally.
What e-commerce orgs can do now
Adapting to AI-driven traffic isn’t about choosing between blocking everything or allowing it all. It’s about building a more intentional strategy around visibility, control, monetization, and protection.
Gain Visibility. Organizations need insight into: which bots are accessing content and what they’re retrieving, whether traffic is hitting cache or origin, and which activity aligns with business goals.
Go beyond blocking. Modern AI traffic requires more purpose-built controls than traditional allow/block approaches. Some automation may create visibility and revenue opportunities. Some may simply create cost and risk.
Consider monetizing AI traffic. As AI platforms continue seeking high-quality content, monetization strategies are becoming increasingly considered. Organizations with strong visibility and governance controls will be best positioned to decide how AI access supports their business goals.
Deceive the unwanted. Fastly’s Deception capabilities are designed to disrupt malicious automation by feeding attackers misleading signals and reducing the effectiveness of automated abuse.
Unlock Your Bot Strategy
AI is rapidly changing how information is discovered and consumed online, and e-Commerce is at the center of that shift. The organizations best positioned for what comes next won’t simply block all – they’ll strategically govern it.
Download Fastly’s latest Threat Insights Report to explore the evolving global bot landscape and learn how they’re redefining the web.