Your B2B bot traffic tripled. Most of it is your buyers.
Your B2B bot traffic tripled. Most of it is your buyers.
Your B2B bot traffic tripled. Most of it is your buyers.
A dashboard alert lights up in mid-2026: bot traffic on your B2B site has tripled in 12 months. The first instinct is the wrong instinct. The default reaction (block, throttle, fingerprint, blacklist) treats your most valuable new audience as a threat.
The symptom
You see one or more of these:
- Bot share of total traffic moved from 5 to 15% to 30 to 45% in 12 to 18 months.
- Specific user agents (GPTBot, ClaudeBot, PerplexityBot, Google-Extended) account for the majority of the increase.
- Your security vendor flags the spike as a possible scraping attack and recommends blocking.
- Your CDN bill went up because edge caches are getting hit harder than humans alone could explain.
Three different teams (SecOps, web ops, marketing) reach three different conclusions. Nobody is right yet because the inputs haven't been classified.
The diagnosis
Bot traffic on a B2B site in 2026 is not one thing. It's three categories with completely different implications.
| Category | Examples | Right reaction |
|---|---|---|
| Threat bots | Credential stuffing, content scrapers reselling your data, vulnerability scanners | Block. Always block. |
| Search and SEO bots | Googlebot, Bingbot, ahrefs, Semrush crawlers | Allow. They're how you stay findable. |
| Buyer agents | GPTBot, ClaudeBot, PerplexityBot, custom assistants via MCP | Allow and serve them well. They're your buyers. |
The "tripling" most B2B sites see in 2026 is almost entirely category 3. Buyer agents dispatched by humans researching vendors. Block them and you remove yourself from the shortlists they're building.
How to tell them apart
User agent strings are the first signal but not sufficient. Threat bots routinely spoof legitimate user agents. Three additional signals matter:
- Request pattern. Buyer agents pull a small number of pages per session, often deep pages (pricing, security, comparisons). Threat bots either crawl the full site systematically or hammer a single endpoint repeatedly.
- IP origin. Major LLM providers publish IP ranges. Anthropic, OpenAI, Perplexity, and Google all do. Cross-checking against published ranges separates the legitimate agents from impostors.
- Behavior on auth pages. Buyer agents respect robots.txt and skip auth-gated pages. Threat bots probe them.
Most security vendors classify on user agent alone. That's why they often misflag buyer agents as threats. Your stack needs a second-pass classifier specifically for buyer agents, or you'll keep blocking the wrong thing.
What to do per category
The right response is different for each.
Threat bots: Block aggressively. Standard WAF rules. Your security vendor handles this well; nothing changes here.
Search and SEO bots: Allow with no special treatment. They're how Google ranks you. Don't break what works.
Buyer agents: This is the new work. Three things matter:
- Make sure they can read your deep pages (pricing, compliance, integrations) without JavaScript-rendering issues.
- Serve them clean, structured content. Not marketing copy. They extract facts, not stories. See agent-ready for the structural checklist.
- Capture what they ask. The questions agents bring to your site are the most valuable buyer intent data your company has access to. Most CRMs miss it entirely.
Why this matters now
The old "block all suspicious bots" default is going to cost B2B companies 20 to 40% of their incoming buyer-agent shortlist appearances over the next 18 months if they don't change it.
A blocked buyer agent doesn't retry. It moves on. The buyer asks ChatGPT for vendors. ChatGPT's agent visits five sites. Yours blocked it. The other four didn't. You are not on the shortlist returned to the buyer. You never know it happened.
The companies winning in 2026 are the ones that have explicitly stopped treating buyer agents as a security problem and started treating them as a marketing audience. The categorization decision is the cheapest, highest-leverage change you can make this quarter.
