What should I do first if I find AI bots on my site?

Start by measuring which AI operators are on your site, what they are doing and which pages they request most. That baseline lets you decide whether to serve the traffic, block selectively, publish terms or contact an operator. Do not assume that every AI request signals licensing demand, or that none does. Collect the evidence now so you can explain the decision later.

Step 1: get a baseline you can defend

Measure a normal week, rather than only the week someone noticed a problem. Establish the automated share of requests at the edge. Analytics removes most of those requests before reporting.

Supertab Connect deploys into your existing CDN, including Fastly, Cloudflare and CloudFront, or through a free WordPress plugin. Classification requires no proxy subdomain, DNS change or agreement with an AI company. Most sites are live in hours, and the first report uses their own traffic.

Step 2: separate the operator from the activity

Break the traffic down by operator, then by activity. You need to know who sent each request and what they were doing.

The same company often carries out several activities that you would treat differently. Cloudflare put mixed-use operators at over 36% of activity in July 2026. Grouping only by company leaves more than a third of the traffic without the detail needed for a decision.

Step 3: find where the interest concentrates

Identify the URLs behind the requests. Most reports do not provide this detail, although it often changes how people view the traffic.

Interest is rarely even across a site. It tends to concentrate in a section, a format or a set of pages built over years. Internally, that content may not be considered especially valuable. The requests show what an operator actually wants, based on its behaviour.

The four options, and what each one costs

Serve it. Access is free and you retain discovery. You accept the load because you consider the exposure worthwhile.

Block selectively. It is cheap, narrow and reversible. The response can also tell you whether the operator needed your content.

Publish terms. Use the open RSL 1.0 standard to put machine-readable licensing terms on your own domain, where operators can see the cost of access. Supertab offers this separately. You do not need it to use classification.

Open a conversation. This takes the longest and is the only option that can lead to a contract. Having 3 months of your own data makes the discussion easier.

‍ Look again in 30 days

Operators appear and change behaviour quickly. A name you did not recognise in March can account for a fifth of your automated traffic by September.

Set a reminder to review the same report monthly, especially for agents appearing on your site for the first time. Over the next 2 years, publishers will need to recognise when their 2026 policy no longer fits the traffic they receive.

Written by the Supertab Team