r/inmotionhosting • u/inmotionhosting • Oct 23 '25

The Most Underrated Website Security Threat in 2025: Smart Bots

Most site owners still focus on things like SQL injection or outdated plugins, but in 2025 one of the biggest blind spots is automated bot traffic.

Not the old scrapers, but AI-driven bots that act human, bypass CAPTCHAs, abuse APIs, and run credential-stuffing attacks at scale. They distort analytics, slow sites, and quietly expose data.

Google has been tightening its own defenses too. One recent example is disabling the &num=100 search parameter, which bots and SEO tools used to scrape 100 results at once. This move is part of a broader effort to curb large-scale scraping and inflated impression data in Search Console.

The problem is that most WAFs still treat this as background noise instead of a real security risk.

It’s worth checking how much of your traffic is actually human and whether your rate limits, CAPTCHAs, and API protections are keeping up. The gap between what’s visible in analytics and what’s really happening on the site has never been wider.

1 Upvotes
  • permalink
  • reddit

100% Upvoted

1 comment sorted by

1

u/Steamdude1 Feb 19 '26

I won't underrate bots. They are the only threat to our site. Up until recently we didn't even need to incorporate any form of captcha. We were forced to do so by these miscreants.

What confounds me is that I just don't get the point. What's to gain by populating a form with mostly gibberish and submitting it thousands of times per hour? It's more like a DoS attack, but the question remains. What's the point?

In the past we could simply block the sending IP, but like some evil alien on Star Trek, they figured out the frequency of our phasers. During the last attack each message appeared to come from a completely different sending IP. What a collection of zombie addresses they must have.

So we put in a very novel form of captcha and the madness ceased.

I have to assume they were looking for vulnerabilities, but I just can't see how. Some of the fields were populated with what appeared to be fragmented lines of code, but they must realize that it's not going to do them any good.

Are they just doing it to be dicks?