The digital universe experienced unprecedented transformation in 2025, marking a pivotal year that fundamentally reshaped how we understand internet infrastructure, artificial intelligence integration, and cybersecurity threats. Cloudflare’s comprehensive Radar 2025 Year in Review report—the company’s sixth annual deep-dive analysis—offers extraordinary insights into the patterns, disruptions, and innovations that defined the internet landscape throughout the year. Drawing from Cloudflare’s massive global network spanning 330 cities across 125+ countries, processing over 81 million HTTP requests per second and handling 67 million DNS queries per second, this report represents the most authoritative perspective on internet evolution available today.
The Five Pillars That Defined 2025’s Internet Evolution
The 2025 internet landscape was characterized by five transformative pillars that collectively reshaped digital infrastructure: explosive traffic growth concentrated in the year’s second half, the unprecedented proliferation of AI-powered crawlers and bots fundamentally altering web traffic composition, revolutionary advances in post-quantum cryptography adoption protecting against future quantum computing threats, an alarming escalation in hyper-volumetric DDoS attacks reaching record-breaking scales, and a disturbing increase in government-mandated internet shutdowns affecting civil liberties worldwide.
Understanding these interconnected trends is essential for technology leaders, cybersecurity professionals, digital marketers, content publishers, and policymakers navigating the increasingly complex digital ecosystem. This comprehensive analysis examines each dimension with data-driven insights, contextual analysis, and forward-looking implications for 2026 and beyond.
Traffic Trends: Understanding the 19% Global Internet Growth Surge
The Anatomy of 2025’s Traffic Acceleration
Global internet traffic experienced remarkable 19% growth in 2025, significantly outpacing the 17% growth observed in 2024. However, the distribution of this growth revealed fascinating patterns that challenge conventional assumptions about internet usage evolution. Rather than steady linear growth, 2025 demonstrated distinct phases that illuminate changing user behaviors and technological adoption patterns.
The year began relatively flat, with traffic hovering within 2% of baseline values established during the second full calendar week of January (January 12-18). This baseline methodology, consistently applied across Cloudflare’s year-over-year analyses, excludes bot traffic to ensure accurate representation of human-generated internet activity. Through mid-April, traffic remained remarkably stable, suggesting a consolidation period following previous years’ explosive growth.
May initiated the first growth phase, with traffic climbing approximately 5% above baseline and maintaining this elevated plateau through mid-August. This represented steady but unremarkable expansion consistent with normal seasonal patterns and gradual technology adoption.
The most significant revelation emerged in late August, when traffic growth suddenly accelerated dramatically. From mid-August through November, traffic climbed steadily and substantially, ultimately peaking at 19% growth—representing a 10% higher growth rate than 2024’s already impressive expansion. This late-year acceleration pattern, while observed in previous years (typically starting in July during 2022-2024), occurred several weeks later in 2025, raising intriguing questions about the underlying drivers of internet usage growth.
Regional Variations: From Botswana’s 295% Surge to Tanzania’s Disruption-Driven Volatility
While global averages paint a broad picture, regional variations reveal the dramatic disparities in internet adoption and infrastructure development across different geographic contexts. Botswana emerged as 2025’s most remarkable growth story, experiencing an extraordinary 298% peak growth on November 8 and ending the measured period 295% above baseline. This astronomical expansion directly correlates with Starlink’s satellite internet service deployment, which we’ll explore in depth later in this analysis.
Sudan joined Botswana as the only other country exceeding 100% traffic growth year-over-year, highlighting the transformative potential of improved connectivity infrastructure in historically underserved regions. These explosive growth stories demonstrate that global internet penetration continues expanding into new populations, with satellite-based connectivity solutions enabling access in areas where traditional infrastructure deployment proves economically or logistically challenging.
Conversely, Tanzania’s 2025 traffic patterns illustrated the destructive impact of government-imposed internet shutdowns on digital economies and connectivity. On October 29, Tanzanian authorities implemented an internet shutdown responding to election day protests. Traffic that had grown over 40% above baseline ahead of the shutdown plummeted more than 70% below baseline—a rapid, devastating reversal. Although the initial shutdown lasted just one day, a subsequent extended disruption from October 30 through November 3 continued suppressing connectivity. Traffic recovered quickly after restoration, demonstrating both the resilience of internet demand and the severe immediate impacts of governmental connectivity interference.
Jamaica provided another compelling case study, where Hurricane Melissa’s arrival on October 28 triggered a different connectivity crisis. Internet traffic spiked dramatically ahead of the storm as residents prepared and communicated, then collapsed as power outages and infrastructure damage severed connections. The gradual recovery trajectory illustrated the challenges of restoring physical infrastructure in disaster-affected regions.
Starlink’s Transformative Impact: Doubling Global Traffic and Enabling Access in 20+ New Countries
SpaceX’s Starlink satellite internet service continued its aggressive global expansion throughout 2025, fundamentally altering connectivity landscapes in underserved and unserved regions worldwide. Cloudflare’s analysis of aggregate request traffic volumes associated with Starlink’s primary autonomous system (AS14593) revealed that Starlink traffic increased 2.3x across the year—effectively more than doubling.
This explosive growth wasn’t merely about existing users consuming more bandwidth; rather, it reflected Starlink’s geographic expansion into more than 20 new countries and regions throughout 2025. The typical pattern observed when Starlink service becomes available in a new location involves rapid, dramatic traffic growth within days of launch, as pent-up demand for reliable connectivity immediately materializes.
Countries newly added to Starlink’s coverage map in 2025 included Armenia, Niger, Sri Lanka, and Sint Maarten, each experiencing immediate traffic surges following service availability announcements. Additionally, Cloudflare detected Starlink traffic originating from numerous locations not officially marked for service availability on Starlink’s coverage map. This apparent discrepancy likely reflects Starlink’s roaming capabilities, which allow users to maintain connectivity while traveling internationally—a distinctive advantage of satellite-based internet services.
Among countries where Starlink service existed before 2025, Benin, Timor-Leste, and Botswana experienced the most dramatic growth, with traffic increasing 51x, 19x, and 16x respectively. Benin’s service availability was first announced in November 2023, Timor-Leste’s in December 2024, and Botswana’s in August 2024, suggesting that the first full calendar year following initial deployment often produces the most dramatic adoption curves as awareness spreads and equipment becomes available.
The broader implications of Starlink’s expansion extend far beyond simple connectivity metrics. Satellite internet services are fundamentally reshaping assumptions about infrastructure development, particularly in regions where terrestrial fiber deployment faces prohibitive geography, sparse population density, or political instability. Competing services including Amazon’s Project Kuiper, Eutelsat Konnect, and China’s Qianfan constellation continue developing their capabilities, promising further disruption to traditional telecommunications business models and potentially democratizing high-quality internet access globally.
The AI Revolution: How Artificial Intelligence Fundamentally Reshaped Web Traffic Composition in 2025
Googlebot’s Dominance: The Dual-Purpose Crawler Dwarfing All Competition
Perhaps no single trend better exemplifies 2025’s internet evolution than the dramatic proliferation of AI-powered web crawlers. Among these, Google’s Googlebot emerged as the undisputed heavyweight, responsible for more traffic volume than any other bot operator by a substantial margin. Critically, Googlebot serves a dual purpose—crawling web content both for traditional search engine indexing and for training Google’s artificial intelligence models—a controversial approach that raises significant questions about transparency and website owner consent.
Throughout 2025, Googlebot alone generated approximately 4.5% of all HTML request traffic to Cloudflare-protected sites. To contextualize this staggering figure: a single crawler operated by one company accounted for nearly one in every twenty HTML requests across millions of websites. Googlebot’s activity demonstrated clear seasonal patterns, increasing substantially from mid-February, peaking in late April, then gradually declining through late July before resuming steady growth into year-end.
Among verified bots (bots that conform to Cloudflare’s verification requirements and whose identity can be authenticated), Googlebot was responsible for over 28% of total traffic—more than one in every four verified bot requests. This dominant position reflects both Google’s continued search engine market leadership and its aggressive investment in AI model training, which requires vast quantities of web content for effective machine learning.
Other Google-operated bots contributing significantly to traffic volumes included Google AdsBot (monitoring websites serving Google advertisements), Google Image Proxy (retrieving and caching images embedded in email messages), and GoogleOther (used by various Google product teams for fetching publicly accessible content). Collectively, Google’s crawler ecosystem represented an overwhelming presence in 2025’s web traffic landscape.
OpenAI, Anthropic, and the Competitive AI Crawler Ecosystem
While Googlebot dominated absolute traffic volumes, other AI companies operated increasingly active crawler programs targeting web content for model training and search functionality. OpenAI deployed multiple specialized crawlers, each serving distinct purposes within the company’s AI ecosystem.
GPTBot, OpenAI’s primary training crawler that retrieves content potentially used in training generative AI foundation models, generated approximately 7.5% of verified bot traffic—making it the second-most active bot overall. GPTBot’s crawling activity proved highly volatile throughout 2025, exhibiting dramatic fluctuations particularly during the first half of the year, with peak activity occurring in June. By November, GPTBot’s crawl volume had stabilized at levels slightly above January baseline, suggesting either OpenAI’s training data requirements had been satisfied or the company implemented more conservative crawling strategies in response to growing publisher resistance.
ChatGPT-User, which visits web pages when users ask questions to ChatGPT or CustomGPTs, experienced sustained growth throughout 2025, with peak request volumes reaching 16x higher than year-beginning levels. This exponential expansion reflects ChatGPT’s deepening integration into educational and professional workflows. A clear weekly usage pattern emerged starting mid-February, with higher weekday activity and weekend decline—strongly suggesting predominant use cases centered on school assignments and workplace applications. A noticeable activity dip during the June-August summer period further supported this interpretation, aligning with academic vacation schedules and reduced professional activity.
OAI-SearchBot, used for linking to and surfacing websites in ChatGPT’s search features, demonstrated gradual growth through August followed by several dramatic traffic spikes in August and September. Starting in October, crawling activity accelerated substantially, with late October peak request volumes approximately 5x higher than year-beginning levels. This pattern suggests OpenAI invested heavily in expanding ChatGPT’s search capabilities during the second half of 2025, potentially positioning the product as a more direct Google Search competitor.
Anthropic’s ClaudeBot exhibited a different trajectory, effectively doubling crawling volume through the first half of 2025 but gradually declining during the second half, ultimately ending approximately 10% higher than year-start levels. This deceleration may reflect Anthropic’s shift toward alternative training methodologies, data partnerships, or simply that the company accumulated sufficient training data from open web crawling.
Perplexity’s PerplexityBot demonstrated impressive growth, increasing slowly through January and February before experiencing a substantial activity jump from mid-March into April. Growth continued more gradually through October, then accelerated significantly in November, finishing approximately 3.5x higher than year-beginning levels. This pattern reflects Perplexity’s rising prominence as a search-focused AI platform and its apparent strategy of aggressive content indexing to compete with established search engines.
The Explosive 15x Growth in AI User Action Crawling
Cloudflare’s analysis categorized AI bot crawling into three primary purposes: training (gathering website content for AI model training), search (indexing website content for search functionality available on AI platforms), and user action (visiting websites in response to user questions posed to chatbots). A fourth “undeclared” category captured traffic from AI bots whose crawling purpose remains unclear or unknown.
Training-oriented crawling remained responsible for the overwhelming majority of AI crawler traffic throughout 2025, heavily influenced by OpenAI’s GPTBot activity patterns. Training crawling reached volumes 7-8x higher than search crawling and 32x higher than user action crawling at peak periods.
Search-focused crawling exhibited strength through mid-March, then dropped approximately 40% and maintained more gradual growth thereafter, ending the surveyed period just under 10% lower than year-start. This decline may reflect AI platforms shifting toward partnership-based content access rather than aggressive crawling, or simply that initial indexing phases captured sufficient content for effective search functionality.
The most dramatic revelation emerged in user action crawling patterns. Starting 2025 with the lowest crawl volume among the three defined purposes, user action crawling more than doubled through January and February, doubled again in early March, then continued accelerating throughout the year—ultimately increasing over 21x from January through early December. This explosive 15x+ growth trajectory maps very closely to OpenAI’s ChatGPT-User bot activity, suggesting ChatGPT’s evolution from a conversational interface into a research tool that actively retrieves and analyzes web content in response to user queries.
This shift carries profound implications for website traffic composition and monetization. Traditional search engines direct users to websites, generating page views, ad impressions, and potential conversions. User action crawling, conversely, extracts content for AI processing and synthesis, potentially satisfying user information needs without generating website visits—a dynamic that threatens publisher business models built on traffic-driven advertising revenue.
Post-Quantum Cryptography: The Silent Security Revolution Protecting Tomorrow’s Internet
Understanding the Quantum Threat and Post-Quantum Response
Post-quantum cryptography (PQC) represents one of 2025’s most significant yet underappreciated technological advances. The urgency stems from a looming threat: sufficiently powerful quantum computers could theoretically break current encryption standards that secure internet communications, financial transactions, healthcare records, government secrets, and virtually all digital security infrastructure.
The “harvest now, decrypt later” attack scenario poses particular concern. Adversaries with quantum computing ambitions can capture and store encrypted data today, waiting until quantum computers become available to decrypt historical communications retroactively. Sensitive information with long-term value—government communications, intellectual property, healthcare records, financial data—remains vulnerable to this future decryption threat unless protected with quantum-resistant encryption today.
Post-quantum cryptography employs mathematical approaches believed to resist attacks from both classical and quantum computers, providing security for data encrypted today against future quantum decryption attempts. In 2025, this theoretical concern transformed into practical deployment, with major technology companies implementing PQC at scale.
The Dramatic Doubling: From 29% to 52% Post-Quantum Adoption
Cloudflare’s analysis revealed that the global share of post-quantum encrypted traffic nearly doubled throughout 2025, accelerating from 29% at year-start to 52% by early December. This remarkable expansion means that by year-end, the majority of human-generated web traffic with Cloudflare utilized hybrid post-quantum key exchange, combining classical elliptic curve cryptography with quantum-resistant lattice-based algorithms.
Twenty-eight countries and regions experienced post-quantum encrypted traffic shares more than doubling throughout 2025, with Puerto Rico and Kuwait demonstrating particularly dramatic growth. Kuwait’s share nearly tripled from 13% to 37%, while Puerto Rico’s expanded from 20% to 49%.
A critical inflection point occurred in mid-September 2025, when Apple released operating system updates (iOS 26, iPadOS 26, macOS Sequoia) that enabled post-quantum encryption by default. According to Apple’s release notes, “TLS-protected connections will automatically advertise support for hybrid, quantum-secure key exchange in TLS 1.3.” This single deployment decision immediately affected hundreds of millions of devices worldwide, producing visible spikes in post-quantum traffic adoption across numerous countries where iOS devices represent significant market share.
Just four days after iOS 26’s official September 19 release, the global share of requests with post-quantum support from iOS devices surged from under 2% to 11%. By early December, more than 25% of requests from iOS devices employed post-quantum encryption—a testament to Apple’s platform influence in driving security standard adoption.
Countries with high mobile device penetration and substantial iOS market share—including Puerto Rico, Kuwait, and numerous others—experienced the most dramatic post-quantum adoption increases following Apple’s update. This pattern underscores the critical role major platform operators play in security technology deployment, with decisions by Apple, Google, Microsoft, and other ecosystem leaders producing immediate, measurable impacts on global cryptographic protection standards.
What Post-Quantum Adoption Means for Internet Security’s Future
The rapid post-quantum encryption adoption throughout 2025 represents a crucial milestone in proactive security infrastructure development. Unlike reactive security measures deployed after breaches occur, PQC deployment anticipates future threats, protecting today’s sensitive communications against tomorrow’s quantum computing capabilities.
However, challenges remain. Post-quantum encryption increases computational overhead and connection establishment latency—factors that may discourage adoption among performance-sensitive applications. The larger key exchange messages required by lattice-based algorithms consume more bandwidth, potentially impacting constrained network environments or devices with limited processing capabilities.
Additionally, standardization efforts continue evolving. NIST (National Institute of Standards and Technology) finalized initial post-quantum cryptographic standards in 2024, but ongoing research continues refining algorithms, identifying potential vulnerabilities, and developing alternative approaches. The cryptographic community’s understanding of quantum-resistant mathematics remains comparatively immature relative to classical cryptography’s decades of battle-testing.
Looking forward, 2026 will likely see continued PQC adoption acceleration, particularly as certificate authorities begin issuing post-quantum certificates (expected availability 2026, broader adoption 2027). Organizations should prioritize understanding their cryptographic inventory, identifying systems requiring quantum-resistant protection, and developing migration roadmaps to ensure security continuity as quantum computing capabilities advance.
Cybersecurity Under Siege: Record-Breaking DDoS Attacks and the Hyper-Volumetric Threat
The Aisuru Botnet: A New Apex Predator in DDoS Attack Infrastructure
2025 marked a watershed year for distributed denial-of-service (DDoS) attack evolution, with the emergence of unprecedented “hyper-volumetric” attacks reaching scales previously considered theoretically impossible. The Aisuru botnet—named after the Japanese word for “love”—emerged as the apex predator in this threat landscape, orchestrating record-breaking attacks that fundamentally challenged conventional DDoS mitigation assumptions.
In the third quarter alone, Cloudflare mitigated 1,304 hyper-volumetric attacks launched by Aisuru, representing a 54% quarter-over-quarter increase. Since the start of 2025, Cloudflare intercepted 2,867 Aisuru attacks across their global network. These weren’t merely numerous attacks; they were attacks of unprecedented magnitude.
The crown jewel of Aisuru’s destructive capability came in October 2025, when Cloudflare detected and mitigated a 29.7 terabits-per-second (Tbps) DDoS attack—shattering all previous records and establishing a new benchmark for attack volume. To contextualize this extraordinary scale: 29.7 Tbps represents more bandwidth than many entire countries’ aggregate internet connectivity. The attack also reached 14.1 billion packets per second (Bpps), demonstrating not just volumetric intensity but also the sophisticated packet-generation capabilities of Aisuru’s botnet infrastructure.
The Hyper-Volumetric Era: From Gigabits to Terabits
The evolution from gigabit-scale to terabit-scale attacks occurred with frightening rapidity. Throughout the 2010s, DDoS attacks measuring hundreds of gigabits per second represented major threats requiring significant mitigation resources. The industry’s first terabit-scale attack, detected in 2020, marked a concerning threshold crossing.
2025 transformed terabit-scale attacks from rare anomalies to regular occurrences. Cloudflare’s Q2 2025 data revealed over 6,500 hyper-volumetric DDoS attacks during that quarter alone—averaging 71 hyper-volumetric attacks daily. This represented not an unusual spike but rather a new baseline threat environment that organizations must prepare to defend against.
The mechanisms enabling these massive attacks involve several converging factors. First, the proliferation of inadequately secured IoT (Internet of Things) devices continues expanding potential botnet recruitment pools. Cameras, routers, smart home devices, industrial control systems, and countless other internet-connected devices with default credentials or unpatched vulnerabilities provide ready conscription into botnet armies.
Second, amplification techniques allowing attackers to multiply their effective bandwidth continue evolving. DNS amplification, NTP amplification, memcached amplification, and other reflection attack methodologies enable attackers to generate attack traffic volumes far exceeding their actual bandwidth resources. As organizations deploy more internet-accessible services with amplification potential, this attack surface expands correspondingly.
Third, the commoditization of DDoS-for-hire services democratizes access to sophisticated attack capabilities. Booter services and stresser platforms allow individuals with minimal technical knowledge to launch devastating attacks for nominal fees, dramatically lowering barriers to entry for cyber-aggression.
Targeted Sectors: Civil Society Organizations Under Digital Assault
Cloudflare’s analysis revealed that organizations in the “People and Society” vertical were the most targeted during 2025—a deeply concerning finding with troubling implications for civil liberties, democratic processes, and freedom of expression. This category encompasses civil society organizations, human rights groups, independent media outlets, election monitoring organizations, and other entities working on politically sensitive topics.
The targeting of civil society organizations represents a disturbing evolution in DDoS attack motivation. While financial institutions, e-commerce platforms, and gaming services have historically attracted DDoS attacks motivated by extortion or competitive sabotage, attacks against civil society groups often serve political censorship and intimidation objectives.
DDoS attacks against human rights organizations during critical reporting periods, election monitoring groups during voting periods, or independent media outlets covering controversial topics effectively silence dissent, suppress information flow, and undermine democratic processes. Unlike data theft or system compromise, DDoS attacks don’t require sophisticated exploitation techniques—making them accessible tools for repressive regimes and politically motivated actors seeking to silence opposition voices.
This trend aligns with broader concerning patterns observed throughout 2025, including increased government-mandated internet shutdowns (discussed below) and sophisticated phishing campaigns targeting activists and journalists. The convergence of digital threats against civil society suggests coordinated efforts to constrain information access and suppress dissent globally.
Internet Outages and Government Shutdowns: When Connectivity Becomes a Control Mechanism
174 Major Disruptions: The Scope of 2025’s Connectivity Crisis
Cloudflare’s monitoring capabilities detected 174 major internet outages across the globe throughout 2025—a staggering figure representing an average of more than three significant connectivity disruptions weekly. However, the most troubling revelation wasn’t the sheer quantity of disruptions, but rather their cause: almost half of these outages resulted from deliberate government-directed regional and national shutdowns of internet connectivity.
Unlike outages caused by technical failures, natural disasters, or infrastructure damage, government-mandated shutdowns represent intentional policies designed to control information flow, suppress dissent, prevent protest organization, or interfere with democratic processes. The weaponization of connectivity control represents one of digital infrastructure’s most concerning authoritarian applications.
Shutdown Season: Q2 and Q3’s Government-Directed Connectivity Suppression
Cloudflare’s quarterly internet disruption summaries revealed particularly concerning patterns during Q2 and Q3 2025. Government-mandated shutdowns occurred in Libya, Iran, Iraq, Syria, and Panama during Q2, with each instance tied to politically sensitive events—elections, protests, or civil unrest.
Iraq implemented multiple shutdowns throughout 2025, including a national connectivity suspension on September 11 between 6:00 and 8:00 local time to prevent examination cheating—a relatively benign justification compared to political suppression motivations observed elsewhere. However, Iraq also implemented shutdowns during politically sensitive periods, demonstrating governments’ willingness to deploy connectivity control for various objectives.
Syria’s chronic connectivity challenges throughout 2025 reflected the country’s ongoing civil conflict and infrastructure degradation. However, observable patterns in shutdown timing correlated with protest activity and military operations, suggesting deliberate government manipulation of connectivity beyond simple infrastructure failure.
Tanzania’s October shutdown responding to election protests, discussed previously in traffic analysis, exemplified governments’ willingness to sever entire nations from global internet connectivity to control political narratives and suppress opposition organization. The immediate, severe traffic impacts—from 40% above baseline to 70% below within hours—demonstrate these shutdowns’ devastating effectiveness at information suppression.
The Economic and Human Costs of Connectivity Suppression
Government-mandated internet shutdowns impose massive economic costs beyond political implications. Digital commerce, remote work, online education, healthcare telemedicine, financial services, and countless economic activities depend on reliable connectivity. When governments sever internet access, these economic activities cease abruptly, destroying productivity, disrupting commerce, and imposing hardship on populations.
Research organizations including Access Now, Internet Society, and various human rights groups have documented substantial per-day economic damages from internet shutdowns, typically measured in millions to tens of millions of dollars for national-scale disruptions. Over extended shutdown periods, accumulated economic damage can reach hundreds of millions of dollars—losses borne primarily by citizens and businesses rather than governments implementing shutdowns.
Beyond economics, shutdowns’ human costs prove immeasurable. Families separated by geography lose communication capabilities. Medical professionals cannot access telemedicine resources for patient care. Students cannot participate in online education. Citizens cannot access information about rapidly evolving situations affecting their safety. Emergency services may struggle to coordinate responses effectively.
The growing frequency and geographic distribution of government-mandated shutdowns throughout 2025 suggest this authoritarian tool has become normalized globally, with governments observing minimal international consequences for deploying connectivity suppression. Absent substantial diplomatic pressure, economic sanctions, or other accountability mechanisms, the trend toward increased shutdown frequency will likely continue accelerating.
Browser, Device, and Protocol Adoption: The Technologies Powering 2025’s Internet
Chrome’s Continued Dominance and Safari’s iOS Stronghold
Browser market share patterns remained relatively stable throughout 2025, with Google Chrome maintaining overwhelming dominance across most platforms and operating systems. Chrome’s superior performance, extensive extension ecosystem, cross-device synchronization, and deep integration with Google services sustained its market leadership despite emerging privacy concerns and increasing resource consumption.
However, Safari demonstrated continued strength specifically on iOS devices, where Apple’s operating system design and App Store policies ensure Safari’s default status and provide performance advantages over alternative browsers. In countries where iOS devices represent substantial mobile market share, Safari consequently shows much higher browser usage percentages than observed globally.
The browser landscape’s relative stability contrasts sharply with rapid evolution observed in other technology categories, suggesting browser choice has become largely settled for most users. Edge cases exist—privacy-focused users gravitating toward Firefox or Brave, developers preferring specific debugging tools—but mainstream users predominantly select Chrome for non-iOS devices and Safari for iOS devices.
Mobile vs. Desktop: The Ongoing Platform Shift
Mobile devices generated over half of request traffic in 117 countries and regions throughout 2025—continuing the long-established trend toward mobile-first internet consumption. This shift carries profound implications for web design, application development, content creation, and digital marketing strategies.
However, desktop computing retained significance for specific use cases: content creation, complex software applications, professional productivity tools, and extended reading or research sessions. The future likely involves continued coexistence rather than complete mobile dominance, with users selecting platforms based on specific task requirements and contexts.
HTTP/3 and HTTP/2 Adoption: Protocol Evolution Continues
The shares of global web requests using HTTP/3 and HTTP/2 both increased slightly throughout 2025, continuing the gradual migration toward modern protocol standards. HTTP/3, built on the QUIC transport protocol rather than traditional TCP, offers performance advantages particularly in challenging network conditions with packet loss or high latency.
However, HTTP/3 adoption faces technical challenges including middlebox compatibility, debugging complexity, and the need for server-side software updates. Consequently, HTTP/2 remains the predominant modern protocol, with HTTP/3 gradually expanding but not yet achieving mainstream dominance.
The continued coexistence of HTTP/1.1, HTTP/2, and HTTP/3 reflects internet infrastructure’s immense complexity and the extended timelines required for protocol migrations affecting billions of devices and millions of servers globally.
Looking Forward: 2026 Predictions and Strategic Recommendations
AI’s Continued Transformation of Web Traffic Composition
The explosive AI bot traffic growth observed throughout 2025 will almost certainly accelerate in 2026. As major AI platforms expand capabilities, increase user bases, and develop new search and research functionalities requiring web content access, crawler traffic volumes will continue climbing.
Website operators must develop sophisticated bot management strategies distinguishing beneficial crawlers (enabling search visibility and AI platform presence) from malicious bots consuming resources without providing value. Cloudflare’s Bots Directory and similar tools will prove essential for understanding and controlling which crawlers receive access.
Publishers should particularly monitor the evolution of “user action” crawling, which threatens to bypass traditional website visits by extracting content for AI synthesis. Developing licensing frameworks for AI training data, implementing technical protections for premium content, and potentially embracing AI platforms as distribution channels represent potential strategic responses.
Post-Quantum Cryptography: From Early Adoption to Universal Standard
The impressive post-quantum adoption momentum throughout 2025 will continue accelerating in 2026, particularly as certificate authorities begin issuing PQC certificates and major platforms expand default encryption. Organizations should prioritize:
- Cryptographic inventory assessment: Identifying all systems, applications, and data requiring long-term confidentiality protection
- Migration roadmap development: Planning phased transitions to quantum-resistant algorithms
- Performance impact analysis: Testing post-quantum implementations to understand computational and bandwidth implications
- Vendor engagement: Ensuring critical suppliers and partners have PQC migration plans
By 2026-2027, post-quantum encryption will likely transition from competitive differentiator to baseline expectation, with organizations lacking quantum-resistant protection facing increased scrutiny and potential compliance challenges.
DDoS Defense: Preparing for the Terabit Threat Landscape
The hyper-volumetric DDoS threat environment that crystallized in 2025 demands fundamental reassessment of defense strategies. Organizations cannot realistically deploy on-premises infrastructure capable of absorbing multi-terabit attacks; cloud-based DDoS mitigation services with global traffic distribution capabilities become essential rather than optional.
Key defensive priorities include:
- Cloud-based DDoS mitigation: Partnering with providers offering global scrubbing capacity measured in terabits per second
- Always-on protection: Avoiding “on-demand” mitigation models that require manual activation during attacks
- Rate limiting and access controls: Implementing application-level protections beyond network-layer flood mitigation
- Incident response planning: Developing clear escalation procedures and communication protocols for sustained attacks
Organizations in high-risk sectors—particularly civil society groups, independent media, and others facing politically motivated attacks—should treat DDoS defense as critical infrastructure rather than optional security enhancement.
Advocating Against Government-Mandated Shutdowns
The disturbing normalization of government-directed internet shutdowns demands urgent attention from technology companies, civil society organizations, and democratic governments. Meaningful progress requires:
- Transparency reporting: Technology companies publishing detailed shutdown incident data to increase visibility
- Economic impact documentation: Quantifying and publicizing the financial costs shutdowns impose on affected populations
- Diplomatic pressure: Democratic governments incorporating connectivity rights into foreign policy and trade negotiations
- Technical circumvention: Developing and distributing tools that allow citizens to maintain connectivity during shutdown attempts (recognizing this introduces complex legal and safety considerations)
The international community’s willingness to tolerate connectivity suppression as a “domestic issue” enables authoritarian practices. Stronger accountability mechanisms could potentially constrain governments’ willingness to deploy shutdowns.
Navigating the Increasingly Complex Digital Ecosystem
The 2025 internet landscape revealed itself as simultaneously more powerful, more vulnerable, and more politically contested than ever before. The 19% traffic growth and expanding connectivity through satellite services democratized internet access for millions previously underserved. Post-quantum cryptography adoption protecting against future threats demonstrated the technology sector’s capacity for proactive security infrastructure development. Protocol evolution and increasing encryption continued strengthening technical foundations.
Simultaneously, the hyper-volumetric DDoS threat environment, particularly targeted attacks against civil society organizations, revealed digital infrastructure’s weaponization for authoritarian purposes. Government-mandated shutdowns affecting millions demonstrated connectivity’s transformation from universal right to revocable privilege in many jurisdictions. AI crawler proliferation raised profound questions about content ownership, fair compensation, and whether AI companies can simply consume the open web for commercial model training without meaningful publisher consent or compensation.
For organizations navigating this landscape, several imperatives emerge clearly:
Security must be proactive rather than reactive. The post-quantum encryption adoption surge demonstrated this principle—protecting today’s data against tomorrow’s threats. Similarly, organizations cannot wait until experiencing hyper-volumetric DDoS attacks to deploy adequate defenses.
Bot management requires strategic sophistication. Blanket blocking sacrifices potential visibility in emerging AI platforms, while unlimited access permits exploitation. Differentiated strategies distinguishing beneficial from harmful bots prove essential.
Technical capabilities alone cannot solve political challenges. Internet shutdowns and civil society targeting require diplomatic, legal, and civil society responses beyond technical circumvention solutions.
Platform diversity matters for resilience. Overreliance on single providers, platforms, or access technologies creates fragility. Organizations should diversify infrastructure, content distribution, and connectivity mechanisms against disruption.
As we progress into 2026, these trends will likely intensify rather than moderate. The internet’s technological foundation continues strengthening, but its social and political dimensions face increasing contest. Success requires not just technical excellence but strategic awareness of the complex, interconnected challenges defining modern digital infrastructure.
The comprehensive data and insights from Cloudflare’s 2025 Radar Year in Review provide essential context for understanding where we’ve been and anticipating where we’re headed. Organizations, policymakers, and individuals who internalize these lessons and act on their implications will navigate the evolving digital landscape most successfully.
Frequently Asked Questions (FAQ): Understanding the 2025 Internet Landscape
Why did internet traffic growth accelerate so dramatically in the second half of 2025?
The specific drivers of 2025’s late-year traffic acceleration (starting in August rather than the typical July timing) remain somewhat unclear. Potential contributing factors include delayed 5G deployments finally reaching critical mass, pandemic recovery effects on commercial and educational internet usage, specific major platform launches or viral content phenomena driving sustained engagement, and possible methodological factors in how traffic is measured and categorized. The pattern appeared globally rather than concentrated in specific regions, suggesting broad rather than localized causes.
What percentage of internet traffic now comes from mobile devices?
More than half of request traffic originates from mobile devices in 117 countries and regions globally as of 2025. However, this varies dramatically by geography, with developing nations often showing even higher mobile predominance (70-80%+) while developed countries with established desktop infrastructure show more balanced distributions. The mobile-first trend continues strengthening year-over-year.
How does Cloudflare's data compare to other internet measurement sources?
Cloudflare’s perspective derives from their global CDN and security network handling millions of customer websites and over 81 million HTTP requests per second. This provides extraordinary breadth but reflects web traffic specifically rather than all internet activity (streaming video, gaming, IoT traffic, etc.). Other sources like Akamai, Fastly, internet exchange points, and ISP data offer complementary perspectives. No single source captures the complete internet picture; Cloudflare’s contribution provides particularly strong insights into web traffic patterns, security threats, and crawling behavior.
Should website owners block AI crawlers to protect their content?
This involves complex tradeoffs without universal answers. Arguments for blocking include: protecting premium content from unauthorized AI training, reducing server load and bandwidth costs from aggressive crawling, maintaining control over content usage and licensing, and philosophical objections to AI companies profiting from content without compensation. Arguments against blocking include: losing potential visibility in AI-powered search and answer platforms that may increasingly drive discovery, risking diminished search engine rankings if blocking inadvertently affects traditional search crawlers, and potentially missing partnership opportunities with AI platforms. Many organizations implement differentiated approaches: allowing search-focused crawlers while blocking training-focused bots, permitting verified crawlers while blocking unidentified bots, or implementing rate limiting rather than complete blocking.
What's the difference between Googlebot's search indexing and AI training activities?
Technically, both involve crawling and analyzing web content, but their purposes and implications differ significantly. Search indexing creates databases enabling search engines to quickly identify relevant pages for user queries, driving traffic back to original websites. AI training uses content to develop machine learning models, potentially enabling AI systems to answer questions without directing users to original sources. The controversy stems from Googlebot serving both purposes simultaneously without clear differentiation, making it difficult for website owners to selectively permit search indexing while prohibiting AI training. Cloudflare and various industry groups have advocated for separate crawlers with distinct purposes rather than dual-purpose bots.
How much bandwidth do AI crawlers consume compared to human visitors?
This varies dramatically by website type, content volume, and crawler behavior. Cloudflare’s data indicates AI crawlers collectively accounted for approximately 8.7% of HTML request traffic in 2025 (4.5% from Googlebot alone, 4.2% from other AI bots). However, this understates their bandwidth impact since crawlers typically access entire sites systematically rather than selective pages like human visitors, often retrieve content multiple times for updates, and may download resources humans never access. Some publishers report AI crawlers consuming 20-40% of total bandwidth despite representing smaller percentages of request counts. Implementing rate limiting and robot.txt restrictions can manage these impacts.
Can websites detect and block AI bots that don't identify themselves?
Detection becomes significantly more challenging when bots deliberately obscure their identity, but various techniques exist. Legitimate AI crawlers typically identify themselves via user agent strings and respect robots.txt files (though respect isn’t universal). Advanced bot detection analyzes behavioral patterns: request frequency and patterns inconsistent with human browsing, JavaScript execution capabilities (many simple bots cannot execute JavaScript), mouse movement and interaction patterns, browser fingerprinting characteristics, and IP address reputation and historical behavior. Services like Cloudflare Bot Management, Akamai Bot Manager, and others employ sophisticated machine learning models trained on vast datasets to distinguish bots from humans with high accuracy. However, this becomes an ongoing arms race as bot operators develop increasingly sophisticated evasion techniques.
Will AI crawlers eventually replace traditional search engines?
This represents one of technology’s most consequential unanswered questions. AI-powered answer engines (ChatGPT, Perplexity, Google’s AI Overviews, Claude, etc.) increasingly provide direct answers rather than link lists, potentially reducing traditional search traffic. However, several factors may sustain traditional search: users often prefer evaluating multiple sources rather than trusting single AI-synthesized answers, commercial transactions typically require visiting actual websites, depth of research often exceeds AI context windows, real-time information requires live web access, and publisher pushback may limit content availability for AI training. The likely outcome involves coexistence with shifting balances: AI handling straightforward informational queries while traditional search remains important for commercial, transactional, and complex research needs.
When will quantum computers actually threaten current encryption?
Precise timelines remain highly uncertain and subject to ongoing debate. Conservative estimates suggest cryptographically-relevant quantum computers (capable of breaking widely-used encryption) may emerge within 10-15 years; optimistic projections suggest 20-30 years; some skeptics question whether practical cryptanalysis-capable quantum computers will ever be achieved. However, the “harvest now, decrypt later” threat means organizations cannot wait until quantum computers exist to implement protections—sensitive data encrypted today remains vulnerable to future decryption if quantum-vulnerable algorithms are used. This urgency drives current post-quantum cryptography deployment despite quantum computers remaining theoretical threats.
Does post-quantum encryption slow down internet connections?
Post-quantum cryptography does introduce additional computational overhead and connection establishment latency compared to traditional elliptic curve cryptography, but impacts vary by implementation. Hybrid approaches (combining classical and quantum-resistant algorithms) double certain computational operations. Larger key exchange messages (lattice-based algorithms require larger mathematical structures) increase initial handshake bandwidth. However, modern implementations have optimized performance substantially, and for typical web browsing, latency increases often prove imperceptible (milliseconds) to end users. Performance-critical applications or constrained devices may experience more noticeable impacts requiring optimization or alternative algorithm selection.
Are there different types of post-quantum encryption?
Yes, NIST’s post-quantum cryptography standardization process evaluated five primary mathematical approaches: lattice-based cryptography (CRYSTALS-Kyber for key exchange, CRYSTALS-Dilithium for signatures), code-based cryptography, hash-based signatures, multivariate cryptography, and isogeny-based cryptography. Lattice-based approaches received primary standardization, currently deployed in most PQC implementations including Cloudflare’s hybrid X25519Kyber768 key exchange. Different approaches offer tradeoffs between security margins, performance characteristics, key/signature sizes, and mathematical assumptions. Diversity across approaches provides hedging against potential algorithmic breakthroughs that might compromise specific mathematical foundations.
What happens if a post-quantum algorithm gets broken?
This represents a legitimate concern given PQC’s relative mathematical immaturity compared to decades of classical cryptography research. Hybrid approaches (combining classical and PQC algorithms) provide critical insurance: connections remain secure as long as at least one algorithm remains unbroken, so breaking PQC wouldn’t immediately compromise security if classical algorithms remain secure. This defense-in-depth approach explains why hybrid implementations represent best practice rather than PQC-only deployments. Additionally, cryptographic agility—designing systems enabling relatively rapid algorithm replacement—allows organizations to migrate quickly if specific algorithms prove vulnerable.
What is a "hyper-volumetric" DDoS attack?
While no universal formal definition exists, the industry generally categorizes attacks exceeding approximately 1 terabit per second (Tbps) as “hyper-volumetric” to distinguish them from conventional large-scale DDoS attacks measured in hundreds of gigabits per second. The term emphasizes not just volume but transformative scale—attacks exceeding most organizations’ total internet bandwidth capacity by orders of magnitude. The 29.7 Tbps record attack observed in October 2025 represents approximately 30,000 gigabits per second—enough bandwidth to simultaneously download approximately 3,700 full high-definition movies per second.
How do attackers generate such massive DDoS attacks?
Hyper-volumetric attacks typically combine several amplification factors. Massive botnets comprising hundreds of thousands or millions of compromised IoT devices, servers, and computers provide the attack infrastructure. Amplification techniques exploit protocols allowing attackers to send small requests that trigger much larger responses directed at victims—DNS amplification (up to 50-70x amplification), NTP amplification (up to 500x+ amplification), memcached amplification (up to 50,000x amplification), and other reflection vectors multiply effective attack bandwidth. The Aisuru botnet specifically appears to leverage compromised routers, IoT devices, and misconfigured network equipment across numerous countries, coordinated through sophisticated command-and-control infrastructure resistant to takedown efforts.
Can any organization defend against 29.7 Tbps DDoS attacks?
No single organization can deploy on-premises infrastructure capable of absorbing multi-terabit attacks—such defense requires global-scale distribution infrastructure. This reality explains cloud-based DDoS mitigation services’ critical importance. Providers like Cloudflare, Akamai, AWS Shield, Google Cloud Armor, and others operate global networks with aggregate capacity measured in tens or hundreds of terabits per second, capable of distributing attack traffic across hundreds of data centers globally. Attack traffic that would overwhelm any single location becomes manageable when distributed across globally-distributed infrastructure. Organizations facing DDoS risks must partner with providers offering capacity orders of magnitude exceeding potential attack sizes.
Why are civil society organizations being targeted so heavily?
Political motivation appears central to DDoS attacks against civil society organizations, human rights groups, independent media, and election monitoring bodies. These attacks serve several authoritarian objectives: silencing dissent by making opposition websites inaccessible during critical periods, intimidating activists and journalists through persistent disruption, preventing information dissemination about government abuses or controversial policies, and disrupting coordination capabilities for protests and civil society organizing. Unlike attacks against commercial targets (often motivated by extortion or competitive sabotage), civil society attacks frequently appear timed to politically sensitive events—elections, protests, international attention to human rights situations—suggesting deliberate censorship intent. The relatively low technical sophistication required for DDoS attacks compared to sophisticated hacking makes them accessible tools for repressive regimes lacking advanced cyber capabilities.
What should organizations do if they're experiencing a DDoS attack?
Immediate response priorities include: activating DDoS mitigation services if not already enabled (though “on-demand” activation may prove difficult during attacks—”always-on” protection is preferable), contacting your internet service provider or DDoS mitigation provider’s emergency response team, implementing rate limiting and access controls at application and network levels, communicating with stakeholders about potential service disruptions, documenting attack characteristics for subsequent analysis and potential law enforcement reporting, and monitoring for coordinated attacks across multiple vectors (DDoS often accompanies other attack types). For organizations in high-risk sectors, pre-positioning relationships with specialized DDoS mitigation providers and conducting attack simulation exercises prove invaluable for effective real-time response.
How do governments technically implement internet shutdowns?
Governments employ various technical mechanisms depending on infrastructure control and shutdown scope. National-level shutdowns typically involve directing domestic internet service providers (ISPs) to cease routing traffic, enforced through regulatory authority or legal mandates. Governments may order ISPs to disable BGP (Border Gateway Protocol) advertisements, effectively removing the country from global routing tables, or cease operating DNS services, preventing domain name resolution. Selective shutdowns targeting specific platforms often involve deep packet inspection equipment filtering traffic to particular services or IP addresses, DNS filtering preventing resolution of targeted domains, or BGP hijacking redirecting traffic to government-controlled destinations. The technical feasibility largely depends on government control over domestic ISP infrastructure and internet exchange points.
Can people bypass government-imposed internet shutdowns?
Circumvention difficulty varies by shutdown implementation comprehensiveness. For selective shutdowns targeting specific services, virtual private networks (VPNs) often enable access by encrypting traffic and routing through external servers, Tor network routing provides anonymized access to blocked services, and domain fronting techniques disguise blocked service traffic as legitimate cloud provider traffic. For comprehensive national shutdowns severing international connectivity, satellite internet services (Starlink, etc.) may provide access assuming equipment availability and service activation, international cellular roaming might work if cellular networks remain operational, and physical connectivity through neighboring countries is possible for border populations. However, governments increasingly deploy sophisticated detection and blocking of circumvention tools, and using circumvention tools in authoritarian contexts may carry serious legal risks.
Are internet shutdowns increasing or decreasing globally?
Unfortunately, evidence indicates increasing frequency and geographic distribution. Organizations tracking shutdowns including Access Now, Internet Society, and various research groups document growing adoption of shutdowns as authoritarian control mechanisms. The 174 major disruptions observed by Cloudflare in 2025, approximately half government-mandated, represents a substantial total. The normalization of shutdowns—governments observing minimal international consequences for implementing connectivity suppression—likely encourages broader adoption. Without substantial diplomatic pressure, economic sanctions, or other accountability mechanisms, the trend will likely continue accelerating as more governments add shutdowns to their social control toolkit.
What are the economic costs of internet shutdowns?
Economic damages vary by shutdown duration, geographic scope, and affected economy’s digital integration level, but typically prove massive. Research organizations estimate national-scale shutdowns in moderately-developed economies impose daily economic losses between $5-50 million, with cumulative costs reaching hundreds of millions for extended shutdowns. These damages encompass halted e-commerce transactions, disrupted digital service businesses, remote work impossibility, financial services interruption, agricultural and logistics supply chain disruptions, and tourism impacts. Costs fall primarily on citizens and businesses rather than governments implementing shutdowns. Beyond immediate economic losses, shutdowns deter investment and entrepreneurship, as businesses evaluate connectivity reliability when making location decisions.
What is IPv6 adoption progress in 2025?
IPv6 adoption continues gradual expansion, with global averages showing less than one-third of dual-stack requests made over IPv6 in 2025. However, regional variation is dramatic: India exceeded two-thirds IPv6 usage, while many other regions remain substantially lower. IPv6 deployment faces persistent challenges including limited perceived urgency (NAT and IPv4 address market solutions temporarily alleviate scarcity), compatibility concerns with legacy equipment and applications, and network operator training requirements. The slow pace suggests IPv4/IPv6 coexistence will extend decades rather than years, with gradual rather than rapid transition.
What browser and device statistics are most important for web developers?
Critical considerations include Chrome’s dominant desktop market share requiring prioritized compatibility testing, Safari’s iOS stronghold necessitating specific iOS/Safari attention for mobile optimization, mobile devices generating over 50% of traffic in most markets demanding mobile-first design approaches, and significant regional variations in device and browser preferences requiring locale-specific testing for international audiences. Developers should prioritize responsive design accommodating diverse screen sizes, progressive enhancement ensuring core functionality across capability spectrum, and performance optimization recognizing mobile users may face bandwidth and processing constraints.
How does Starlink's expansion affect traditional telecom business models?
Satellite internet services fundamentally challenge traditional telecommunications infrastructure economics by decoupling service availability from physical infrastructure deployment. Traditional models require enormous capital expenditure constructing fiber networks, cellular towers, or copper cable infrastructure—investments economically viable only in sufficiently dense population areas. Satellite services provide connectivity anywhere within coverage footprint regardless of population density, potentially serving previously unprofitable rural and remote areas. This poses existential challenges for traditional operators in sparse regions while creating competitive pressure in denser areas. The competitive response will likely involve incumbents emphasizing superior latency and bandwidth for fiber-feasible areas while de-emphasizing or abandoning service to sparse regions where satellite proves economically superior.
