There’s a fantasy that appeals to people who write about technology without ever having looked at a server log: the idea that the internet is a place where people browse, click, and read. It’s a comforting fantasy. Today, it’s also a minority one.

In June 2026, automated traffic surpassed human traffic across Cloudflare’s network for the first time. Bots accounted for more than half of all HTTP requests. Those of you reading this with actual eyes instead of a tokenizer are already the exception, not the rule. This isn’t one of those futuristic predictions that fills keynote presentations. It’s a measurement.

And here’s the part I find interesting—what I like to call the hidden asymmetry. Of all that bot traffic, the overwhelming majority isn’t trying to bring you readers. It’s looking for food. It comes in, digests your content, and sends almost nobody back. Cloudflare published numbers that should embarrass any publisher who still believes that “being indexed” is a privilege they’re doing Google a favor by allowing: some AI crawlers hit a site thousands of times for every human visitor they actually send back to the original source. That’s not an exchange. It’s extraction.

The Intellectual Idiot and Their Favorite Metaphor

For years, the dominant narrative was simple: the internet is open, information wants to be free, blocking crawlers is reactionary. A lovely philosophy if you have no skin in the game, if you’re not the one paying the hosting bill. It was championed by many of the same people who now seem surprised that publishers are losing referral traffic while a handful of companies train multi-billion-dollar models on that very same content—for free, without permission, and without giving anything back.

This is how these things usually unfold. A system works until it doesn’t, and then everyone acts surprised by the black swan that, in reality, anyone paying attention to the numbers could have seen coming. You didn’t need a crystal ball. You simply had to avoid being an intellectual idiot and look at the ratio of crawls to referrals.

What Cloudflare Is Building (And Why It’s More Interesting Than It Looks)

This is where the story stops being a complaint and becomes a structural change. Cloudflare—which today sits in front of more than a fifth of all web traffic—is introducing a price directly into the HTTP infrastructure. Literally. They’re putting HTTP status code 402 Payment Required to work: a status code that’s been part of the protocol since the 1990s, but that almost nobody ever used. It was little more than an oddity in the specification. Now it’s finally serving its original purpose.

The mechanics are simple. An AI bot requests content. If the site owner has enabled the feature, the bot doesn’t receive the page—it receives a 402 Payment Required response instead. To proceed, it has to authenticate itself with a cryptographic signature, declare how much it’s willing to pay, and Cloudflare handles the billing, paying publishers once a month. The minimum is only a few cents per page. It doesn’t sound like much. But multiply that by the millions of pages AI companies need to consume, both for training and for real-time answers, and it stops being a trivial amount.

The more interesting shift, though, happened only a few weeks ago. Cloudflare announced that a pure “pay per crawl” model isn’t enough, and it’s moving toward something it calls Pay Per Use: instead of charging bots for accessing your content, they charge when that content is actually used to generate an answer. It’s a distinction with real teeth. Charging for access rewards whoever knocks on your door the most. Charging for use rewards whoever actually extracts value. The difference is, ultimately, the difference between renting someone your house and having them break in just to take photographs.

And there’s one more change. Starting on September 15, 2026, Cloudflare will block, by default, crawlers that combine search, AI agents, and model training on any ad-supported website, unless the site owner explicitly opts in. The underlying message is pretty clear. If you behave like a search engine—the traditional arrangement, where you index content and send visitors back—you still have an open door. If you behave like a vacuum cleaner for training data, there’s now a different door. And that door has a price.

What This Actually Means, Without the Usual Naivety

I’m not going to make the cheap promise that this is going to save small blogs. It won’t. The numbers are still deeply asymmetric. Large publishers can negotiate licensing agreements worth tens of thousands of dollars a month. A small or medium-sized blog—yours or mine—will probably earn pennies, if it earns anything at all. The imbalance of power doesn’t disappear just because a payment mechanism exists. It simply takes a different shape.

But something real does change, and it’s something structural. For the first time in a long while, the relationship between those who create content and those who consume it through AI stops being one-sided by default. Extraction is no longer free simply because nobody bothered to charge for it. Putting a price on someone else’s content changes incentives, and incentives determine who gets to scale.

The broader lesson—the one that interests me far more than the technical details of Ed25519 signatures or HTTP headers—is this: systems that depend on nobody looking at the numbers survive exactly until someone finally does. Cloudflare looked. Now the rest of us have to decide, one website at a time, whether we want to be the farm—or charge admission.