Moving Beyond Bots and Humans in Online Detection

Humans interact with the digital world through devices, keyboards, screens, and browsers. What’s called "human detection" online involves recognizing patterns in how people use these tools. Recently, these patterns have shifted: CEOs summarize news via browsers, enthusiasts automate ticket purchases, visually impaired users customize screen readers, and companies route traffic through zero trust proxies.

Website owners aim to protect data, manage resources, control content, and prevent abuse. These challenges aren’t solved simply by knowing if a client is human or a bot. There are desired bots and unwanted humans. The focus should be on understanding intent and behavior instead of just identity.

Detecting automation remains crucial, but as distinctions between actors fade, systems must adapt to a future where "bots vs. humans" is no longer the main focus. What truly matters are questions like: Is this attack traffic? Is crawler load proportional? Is this user connecting from a new country? Are my ads being manipulated?

When we talk about "bots," we’re really discussing two issues. The first is whether website owners should allow known crawlers when they don’t generate useful traffic. The second involves new clients that don’t behave like traditional browsers, impacting systems like private rate limiting.

This piece explores how web protection works today and how it must evolve as the line between bots and humans continues to fade.