Are AI Bots Inflating Your Managed WordPress Bill? (The 2025 Reality)
There is a gap that quietly shows up on managed WordPress invoices: the host's billed visit count climbs while Google Analytics stays flat. That gap, billing visits rising while human visitors hold steady, is what has a lot of managed WordPress customers asking the same thing in 2025: are AI bots running up my bill? The honest answer is more interesting than a yes or no, because the hosts already filter most bots, the ones that slip through are a real cost, and the billing model itself shifted in late 2025 specifically because of this.
How much of your traffic is actually bots
The backdrop is real and worth stating with numbers, because it is what makes this a 2025 problem and not a 2019 one. Per Imperva's Bad Bot Report, automated traffic crossed a line most people missed: bots made up 51% of all web traffic in 2024, the first time automated traffic out-requested humans. That was up from 49.6% in 2023. The driver is AI, training crawlers and retrieval bots from OpenAI, Anthropic, and others, plus the usual scrapers, all hammering sites harder each year.
You can see it in the horror stories: reports of single AI crawlers downloading tens of terabytes of HTML in a matter of days and running up four-figure bandwidth bills on the sites that got hit, and ByteDance's Bytespider reportedly crawling at many times the rate of GPTBot. So the instinct that "all these bots must be costing me something" is grounded. The question is whether that cost lands on your managed WordPress invoice, and that depends entirely on how your host counts a visit.
Do bots count as billable visits?
The surprise, if you have never read the billing fine print, is that the two biggest visit-based managed WordPress hosts already try to exclude bots. Neither one bills you for a crawler that politely identifies itself.
WP Engine defines a billable visit as one unique IP address per day (UTC) that requests dynamic content and is not blocked. It explicitly excludes static assets, known bots, and, as of September 2025, suspected bots (unrecognized user agents behaving like bots). In their framing, the metric is meant to track human traffic against server resources, not Google Analytics-style pageviews. Overage past your plan runs $2 per 1,000 extra monthly visitors.
Kinsta similarly counts the unique IP addresses seen per 24-hour period in its logs, and states it does not count visits from most well-known bot user agents. Its visit overage is $0.50 per 1,000 visits. So on paper, both hosts are on your side here: an honest Googlebot, Bingbot, or GPTBot crawl should not push your bill.
| WP Engine | Kinsta (visit plans) | |
|---|---|---|
| Billable visit | 1 unique IP/day (UTC), dynamic request, not blocked | Unique IPs seen per 24h in logs |
| Known bots | Excluded | Excluded (most well-known agents) |
| Suspected/disguised bots | Excluded since Sep 2025 | Some may still be counted (their words) |
| Static assets (CSS/JS/img) | Excluded | Not a visit (CDN/edge served still counts as visit) |
| Overage | $2 / 1,000 visits | $0.50 / 1,000 visits |
The gap: the disguised bots you really do pay for
Filtering "known" bots solves the easy half. The half that still hits your invoice is bots that lie. A scraper that sends a normal Chrome user agent from a residential IP looks exactly like a human visitor in server logs, it requests dynamic pages, it is a unique IP, and it is not on any known-bot list. Kinsta says this plainly in its own docs: some bots spoof user agents and "might be included in your total visits count." That is the real mechanism behind the bill that climbs while your analytics stay flat, because analytics tools run JavaScript and the spoofing scraper usually does not, so it shows up in billing but not in Google Analytics.
This is also why the host-counted number and your analytics number never match, and why "my GA says 40k but I'm billed for 70k" is a normal support ticket, not a billing error. The 30k gap is largely bots: some filtered, some not. On a $2 per 1,000 plan, a chunk of disguised bot traffic is the difference between sitting inside your plan and paying overage every month.
What actually changed in 2025
The reason this is worth revisiting now, and not a settled topic, is that the hosts moved in 2025 because bot traffic broke the old visit-based math. When bots are half your traffic and a growing share of them disguise themselves, "count the visits" stops being a clean proxy for "human demand on the server."
Kinsta responded by launching an optional bandwidth-based pricing model in November 2025, billed on actual data transferred rather than visit counts, and stated it would not charge for scrapers and bad bots under it. The pitch was explicitly that bot traffic had distorted the visits-to-bandwidth ratio, so customers could opt out of paying for it. WP Engine, on the visit-based side, tightened the filter instead, adding exclusion of suspected bots (not just known ones) in September 2025.
Both moves point the same direction: the industry is conceding that naive visit counting over-bills in the AI-crawler era, and adjusting. If you are picking or renewing a plan in 2026, this is a live differentiator worth asking about, not boilerplate.
How to check (and cut) your bot bill
You do not have to guess whether bots are padding your invoice. Three steps:
- Compare host visits to analytics. Pull your host's billed visit count and your Google Analytics users for the same month. A large host-over-analytics gap (host much higher) is your bot signal, because GA filters most bots via JavaScript and the host counts by IP.
- Read your access logs or host bot report. Both WP Engine and Kinsta surface bot/traffic breakdowns. Look for high-volume single IPs or repeated odd user agents hammering dynamic URLs. That is what is leaking past the filter.
- Put a filter in front of the host. A WAF (Cloudflare is the common one) blocks or challenges abusive traffic before it ever counts as a visit. Cloudflare's AI Crawl Control (general availability August 2025) lets you allow, charge, or block specific AI crawlers per bot. For honest crawlers you do not mind, robots.txt and crawl-delay help; for the disguised ones, only a WAF rule or rate limit actually stops the billing.
FAQ
Do AI bots count toward my WordPress hosting visit limit?
Mostly no. WP Engine and Kinsta both filter known bot user agents before counting billable visits, so an honest GPTBot or Googlebot does not count. Disguised bots that spoof a real browser can still slip through and count. WP Engine added suspected-bot filtering in September 2025 to narrow that gap.
Why is my host's visit count higher than Google Analytics?
Because they measure different things. Your host counts unique IPs in server logs (including some bots that beat the filter), while Google Analytics runs JavaScript that most bots never execute, so GA filters them out. The gap is largely bot traffic, and on visit-based billing you pay for the part that gets counted.
How much is overage on WP Engine vs Kinsta?
WP Engine charges $2 per 1,000 visitors over your plan; Kinsta charges $0.50 per 1,000 on its visit plans. For the same leaked bot traffic, that is a 4x difference. Kinsta also launched a bandwidth-based option in November 2025 that excludes scraper and bad-bot traffic entirely.
How do I stop bots from inflating my bill?
Put a WAF (such as Cloudflare) in front of your site so abusive traffic is blocked before it counts as a visit. Cloudflare's AI Crawl Control lets you allow, charge, or block individual AI crawlers. robots.txt helps with honest crawlers; only a WAF or rate limit stops the disguised ones that actually hit your bill.