Data Platform/Data Lake/Data Issues/2026-06-10 Nov 2025 spike in bot traffic
Nov 2025 spike in bot traffic
| Status | Resolved |
| Severity | High |
| Business data steward | Kate Zimmerman |
| Technical data steward | Andreas Hoelzl |
| Incident coordinator | Guilherme Gonçalves |
| Incident response team | Marcel Ruiz Forns, Hamid Ghani, Omari Sefu, Andreas Hoelzl |
| Date detected | December 2025 |
| Date resolved | April 4, 2026: deployment of new bot detection heuristics
May 15, 2026: backfill completed |
| Start of issue | November 2025 (large increases observed) |
| Phabricator ticket | T413027 (December 2025 detection by Movement Insights)
T413949 (January 2026 detection by community members) T421735 (Backfill plan) |
Summary
As Wikipedia traffic comes in, we classify it as coming from either humans (“users”) or bots (“spider” or “automated”). Some bots attempt to bypass rate limits or other restrictions with increasing sophistication.
In December 2025, we observed an unusually large increase in our measurement of user pageviews for November 2025 (T413027). After investigation, it became clear that this increase was due to non-human (bot) traffic. The bot activity was predominately geolocated to 4 countries (Vietnam, United States, Philippines, and India) and employed spoofed user agents that appeared as desktop users in our metrics.
At its peak, the bot activity accounted for ~10% of global pageviews, with the most visible impact to smaller language wikis. As of February 2026, the bot activity had decreased to ~3% of pageviews. The bot activity continued to distort our metrics until April 2026, when we deployed new bot detection heuristics.
While we have been able to isolate the anomalous traffic and build controls to classify it as automated for the impacted period and going forward, some of the raw traffic data necessary for a full repair had already been deleted as part of our Privacy Policy. Due to this, we were not able to make corrections to the November 2025 data.
Impact on metrics
| Metric | Month | Pre-correction | % of automated traffic (now corrected) |
| User pageviews | Dec/2025 | 15.13B | 9.07% |
| Jan/2026 | 16,09B | 10.67% | |
| Feb/2026 | 13.50B | 3.10% | |
| Mar/2026 (first 10 days) | 4,76B | 2.86% | |
| Unique devices | Dec/2025 | 1.79B | 6.21% |
| Jan/2026 | 1,79B | 5.69% | |
| Feb/2026 | 1,79B | 4.25% | |
| Mar/2026 | 1,88B | 5.85% |
Note: Post-correction metrics better reflect user behavior. Previous metrics were skewed by non-human activity.
Findings
Signals indicating bot traffic
Large amounts of traffic that diverged from standard browsing behavior.
Root cause
A new pattern for bot traffic emerged that was not being detected by our existing heuristics.
Affected datasets and services
The full list of datasets and services is available in T421735.
- actor datasets (webrequest & pageview)
- browser_general_daily
- browser_metrics_weekly
- clickstream_monthly
- interlanguage_daily
- referrer_daily
- pageviews datasets (hourly & daily; per project, per article, top articles, top articles per country)
- projectview_hourly
- projectview_geo
- unique_devices datasets (hourly & daily; per domain & per project family)
Resolution & decisions
In addition to correcting the data going forward, we decided to backfill historical data with corrections where possible.
New heuristic: We developed a new heuristic to identify bot traffic based on the signals we identified in our investigation. This heuristic was deployed on April 4, 2026.
Backfill to correct historical data: The backfill of publicly-available pageview and unique device data going back to December 1, 2025 started on April 28, 2026 and completed on May 15, 2026.