By year-end 2025, there was one AI bot visit for every 31 human visits to publisher sites. Six months earlier, that ratio was 1 in 50.
Publishers watched this happen and made an unexpected choice. Instead of building higher walls, they installed cash registers.
They’re not blocking the bots anymore. They’re charging them.
The Traffic Pattern Nobody Expected
AI bot scraping grew 29% from Q2 to Q3 2025, then another 20% from Q3 to Q4. By year-end, there was one AI bot visit for every 31 human visits.
That ratio was 1 in 50 in Q2 2025.
Arc XP, which powers The Washington Post and thousands of other sites, saw a 300% year-over-year jump in AI bot traffic. Media sites are getting hit seven times harder than average.
The traffic is real. The question is what to do with it.
Why Blocking Stopped Making Sense
I talked to publishers who tried the obvious approach. Block the bots. Protect the content. Maintain control.
It worked briefly. Then they looked at the numbers and realized the bots weren’t going away. They were getting smarter, more persistent, and backed by companies with serious resources.
One European retailer lost an estimated 7% of their margin to competitor price scraping before they changed approach. After implementing protection, they reduced malicious bot activity by 98% within the first month.
But that success cost them. The protection infrastructure, the monitoring systems, the constant updates to stay ahead of new scraping methods.
Publishers asked a different question: What if we stopped fighting and started charging?
The Monetization Experiment
Nearly 20% of TollBit’s network of 7,000 publisher sites has made money from its AI bot paywall. The amounts range from hundreds of dollars to tens of thousands monthly.
That’s not transformative revenue for most publishers. Early clients generate $500 to $5,000 per month from AI licensing, depending on traffic volume and content quality. For publishers with 1 to 5 million monthly visitors, that represents 1 to 3% additional revenue.
Small numbers. But they reveal something bigger.
The infrastructure being built around this caught my eye. Arc XP partnered with TollBit in March 2026 to let publishers monitor AI bot traffic, set licensing terms, and collect payments. This matters because Arc XP supports more than 2,500 sites globally and delivers billions of pageviews each month.
A large chunk of the publisher ecosystem can now activate AI bot monetization from a dashboard.
Imperva, one of the biggest names in web security, partnered with TollBit in December 2025. They’re not just blocking bots. They’re helping content owners monetize traffic from AI bots that would otherwise scrape without permission or payment.
The security companies are becoming payment processors.
The Detection Arms Race
I need to be honest about the other side of this equation.
The bots are getting better.
Detection methods in 2025 include device fingerprints, machine fingerprints, behavior analysis, TLS fingerprints, and header validation. We’ve moved far beyond simple IP blocking and cookie tracking.
55% of bot traffic comes from basic scripts. But 13.5% stems from adaptive bots that shift tactics mid session. AI scrapers are scaling fast, recording over 120 million automated requests in a single quarter.
Akamai reports seeing more than 150 billion bot requests daily across its platform. AI bot requests skyrocketed by 300% in just the first half of 2025.
AI search engines like OpenAI and Perplexity send 96% less referral traffic to news sites than Google search.
The bots are taking content but not sending readers back.
The Economics Don’t Add Up Yet
The commercial viability of bot paywalls is an open question.
AI licensing revenue models are early and unproven for most publishers. AI scrapers bypass publisher protections when it suits them. The commercial viability depends on AI companies choosing to pay rather than route around the paywalls.
That’s far from guaranteed.
TollBit takes a 15 to 25% commission on licensing revenue. For publishers making $500 to $5,000 monthly from AI bot monetization, that commission cuts into modest returns.
The math gets interesting at scale. But most publishers aren’t operating at scale. They’re experimenting with a revenue stream that might disappear if AI companies stop playing along.
What’s Really Changing
The shift I’m watching isn’t about money. Not yet.
It’s about infrastructure. More data is moving behind APIs with server to server tokens, signed calls, anonymous trust passes, and rate profiles by key, not by IP. In 2026, big sites favor risk scoring, trust tokens, and partner exemptions over CAPTCHAs.
They’re lowering friction for legitimate integrations via official channels.
CDN Security market projections vary widely, but multiple sources confirm rapid growth driven by increasing cyberattacks and the need for robust security.
Publishers are building pipes for controlled content distribution. They’re creating systems that track, measure, and monetize every piece of content that leaves their servers.
The open web is becoming the authenticated web.
The Hidden Cost of Control
I keep thinking about what this means for information access.
Publishers are moving from open access to restrictive systems that require authentication and payment for content retrieval. This creates barriers for smaller organizations or individuals who can’t afford API access.
Security concerns are real. The threats are escalating. Publishers need protection.
But every layer of protection is a layer of restriction. Every authentication requirement is a barrier. Every payment system is a filter that determines who gets to use the content and how.
We’re building a more secure internet. We’re also building a more controlled one.
What I’m Watching Next
The next six months will show whether AI bot monetization is a sustainable revenue stream or a temporary arbitrage opportunity.
I’m watching to see if AI companies continue respecting these paywalls or find ways around them. I’m tracking whether revenue grows beyond the 1 to 3% range into something that moves the needle for publishers.
I’m watching how authentication infrastructure evolves. Token-based systems are replacing IP blocking. Trust scoring is replacing CAPTCHAs. The technology is getting more sophisticated and invisible.
Most importantly, I’m watching how this changes the relationship between content creators and consumers. When everything requires authentication, when every access point has a price, when every piece of content is tracked and measured and monetized, we’re building a different internet than the one we started with.
Publishers found a way to charge the bots. Now we’ll find out if the internet they’re building to do it is one we actually want.