Cloudflare Says Humans Will Be a Rounding Error. We Checked Our Own Logs and Could Not Tell.

SAN FRANCISCO, 9 AUG 2026 — Cloudflare's chief financial officer told analysts this week that within five years non-human traffic could run to a thousand times human traffic. "Humans will be a rounding error on the internet," Thomas Seifert said, "not because human traffic goes down, but that's just how fast we're seeing non-human traffic grow."

We went to check that against our own server logs. We could not, and the reason turns out to be the real story.

What Cloudflare said, and the correction inside it

The remark came on the company's second-quarter earnings call. The projection is a straight-line extrapolation of trends Cloudflare observes across a substantial share of global web traffic, and Seifert was careful about what it does not mean: human activity keeps growing in this forecast. It is simply outpaced.

The more useful detail is an error Cloudflare made earlier. It had previously forecast that machine traffic would overtake human traffic in 2027. Its own measurements put the crossover in May 2026, roughly a year ahead of the company's own prediction.

A forecaster with unusually good data, predicting its own market, underestimated by a full year. Keep that in mind when you hear any five-year projection, including this one.

We tried to check our own traffic

RECATOOLS runs first-party analytics: every page view writes a row. Since 5 June 2026 that table holds 321,536 hits. It seemed a reasonable place to ask what share of our own readers are machines.

It cannot answer the question. The user_agent column is empty on every one of those 321,536 rows.

The collector parses the user-agent string into browser, device_type and os, all of which are populated on 100% of rows, and then discards the original. As a privacy decision that is defensible — raw user-agent strings are a fingerprinting surface, and this project already hashes IP addresses rather than storing them. As a measurement decision it means every crawler that politely identifies itself, GPTBot and ClaudeBot and Googlebot alike, arrives, is parsed, and loses the only field that said what it was.

What is left in the data, and what it suggests

Eighteen. Across two months of a public website, exactly eighteen hits were classified as coming from Python.

That is not a plausible figure for a site that publishes tool pages, an AI directory and a news feed on the open internet. Scripted clients that announce themselves are a routine fact of running any public site, and a count of eighteen does not mean they were absent. It means they were not recognised.

Meanwhile 71.4% of hits are labelled Chrome and 79% are desktop. Both are what a browser-share table looks like when a large volume of automation presents a stock Chrome user-agent string, which is the default behaviour of most headless tooling. We are not asserting a bot share here — we are saying our data cannot distinguish one, and that its shape is more consistent with unclassified automation than with a genuine browser mix.

The crossover is the number that matters

Five-year multiples are the part of a forecast that travels, and they are the part with the least information in them. A thousand times is what you get by extending a growth curve and assuming nothing bends it — no pricing change, no crawler-blocking regime, no shift in how agents fetch pages. Plenty of things could bend it.

The crossover is different, because it already happened and can be dated. If Cloudflare's measurement is right, the web passed the point where most requests were not from a person in May 2026, and it did so while the best-instrumented company in the business was publicly expecting it a year later.

For a publisher that changes ordinary decisions rather than strategic ones. Page-view counts, the denominator under every engagement rate, and the traffic figures in an advertising conversation are all now quantities of unknown composition. None of that is new — the difference is that the unknown share has crossed half, which is the point at which "traffic" stops being a proxy for "audience" and starts being a proxy for nothing in particular.

It also reframes what a crawler-blocking decision is. Refusing AI crawlers used to be a question about content licensing. On these numbers it is also a question about whether you can measure your own readership at all.

Why this is the general case, not our confession

The reason to publish an unflattering fact about our own instrumentation is that it is almost certainly not unusual.

Cloudflare can make claims about the human-machine split because it sits in front of an enormous share of the web and retains the signals needed to classify traffic. An individual publisher sees only its own logs. Their analytics is either a script that many bots never execute, or a server-side collector like ours, built to measure an audience, not authenticate it.

So the industry's picture of how much of the web is machines rests, largely, on a small number of intermediaries with the vantage point to measure it. Everyone downstream is quoting them. That is not a criticism of Cloudflare's figures — it is an observation about who is in a position to check them, and the answer is almost nobody.

What we are changing

We have logged the gap rather than quietly fixing it mid-article, and the fix has trade-offs worth stating.

Retaining raw user-agent strings would let us classify traffic and would add a fingerprinting-adjacent field to a table we deliberately keep thin. The middle path is to classify at write time — record a boolean or a bot-name field derived from the user agent, then discard the string — which answers the question without retaining the identifier. That is the change we will make.

The general lesson for anyone running a site: the question "how much of my traffic is human" is not answerable later from data that was not collected for it. Parsed fields are lossy on purpose, and the loss is invisible until you ask.

What to watch

Whether Cloudflare publishes the May 2026 crossover with methodology attached, since a dated, documented crossing is more useful to the industry than a five-year multiple. Whether any independent measurement corroborates it, which currently requires infrastructure almost nobody else has. And whether analytics vendors start reporting a machine share by default, because at present most publishers are being shown an audience number that silently includes an unknown quantity of software.