AI Bot Traffic Turns into Infrastructure Problem for WordPress and WooCommerce Sites
Analyze your bot traffic logs to identify AI crawler patterns and add caching or rate limiting for dynamic endpoints.
Implement caching for dynamic WooCommerce endpoints, add rate limiting for add‑to‑cart and checkout URLs, and configure bot mitigation rules to block or throttle AI crawler traffic.
Summary
Over the past 18 months, Kinsta’s analysis of more than 10 billion requests has shown that bot traffic is no longer just a crawl problem but a resource drain that can push WordPress and WooCommerce sites into downtime.
AI crawlers such as GPTBot grew 305 % from May 2024 to May 2025, and by the end of 2025 they accounted for 4.2 % of all HTML requests on Cloudflare’s network, rising from 2.4 % in early April to 6.4 % in late June. A single ClaudeBot instance produced 3.75 million add‑to‑cart requests in a 24‑hour window, while a looping bot generated 550 million requests over 30 days—traffic that can exhaust PHP threads, flood the database, and trigger 504 errors for real users.
These dynamic endpoints—cart, checkout, filtered product pages, search queries, and AJAX interactions—force the server to spawn a PHP thread, run database queries, and create sessions for each request, turning every bot hit into real work that consumes hosting resources. The result is slower page loads, stalled checkouts, and higher hosting bills, turning bot management into a core infrastructure issue rather than a simple security concern. WordPress site owners must now treat AI crawler traffic as a performance problem and adopt targeted mitigation strategies.
Key changes
- AI crawlers grew 305 % from May 2024 to May 2025
- By end‑2025 AI crawlers made up 4.2 % of all HTML requests on Cloudflare
- ClaudeBot generated 3.75 million add‑to‑cart requests in 24 hours
- A looping bot produced 550 million requests over 30 days
- Dynamic WooCommerce endpoints consume PHP threads, database queries, and sessions per request
- Bot traffic can trigger 504 errors and slow legitimate users