Bot Defence for Dubai Websites (2026): Why 40% of Your Traffic Is Hostile and GA4 Will Never Tell You
More than half of all web traffic is now automated and 40% is hostile. Why GA4 hides it, what scrapers and credential stuffers cost Dubai sites, and real AED prices for bot defence in 2026.
- PUBLISHED
- 02 NOV 2026
- READ TIME
- 12 MIN
- AUTHOR
- AQUARIUS · DUBAI
- UNIT
- REV 2026.09
Short answer: More than half of all web traffic in 2025 was automated, and 40% of it was malicious — the seventh straight year that bad-bot share has grown. If you run a Dubai website, store or API, roughly four in ten requests you pay to serve are scrapers, credential stuffers, card testers and scalpers. Your Google Analytics will never show you this, because GA4 silently deletes known bot traffic and gives you no way to see how much it removed.
That last sentence is the whole problem. Most Dubai business owners look at a clean GA4 dashboard, see sensible session counts, and conclude their traffic is human. The hostile half of the internet does not appear in that report by design.
The numbers Dubai dashboards hide
Three figures set the stakes, and all three come from measured traffic rather than vendor opinion.
- 53% of all web traffic was automated in 2025, up from 51% the year before — measured by Imperva (Thales) across 17.2 trillion blocked bot requests on its global network for the 2026 Bad Bot Report. Human traffic fell to 47% and is still falling.
- 40% of all internet traffic is now bad bots, up from 37% in 2024. That is the seventh consecutive annual increase. Good bots — Googlebot, uptime monitors, legitimate AI agents — account for the remaining ~17.5%.
- About 600,000 cyberattacks are blocked in the UAE every day, roughly 25,000 an hour, per the UAE Cyber Security Council (August 2026). One single day in September 2026 saw more than 640,000 attacks thwarted, and 128 confirmed cyber incidents hit UAE entities during 2026.
Now the part that catches people out. Google’s own documentation states that in GA4, “traffic from known bots and spiders is automatically excluded,” identified using Google research plus the IAB International Spiders and Bots List — and then adds: “At this time, you cannot disable known bot traffic exclusion or see how much known bot traffic was excluded.”
Most Dubai businesses get this exactly backwards. They audit bot traffic in the one tool that is blind to it by design. Your bot problem lives in your server logs, your CDN analytics and your cloud bill — never in GA4.
So the hosting invoice climbs, the API gets slower at 03:00, the login endpoint fills with failures, and nothing in the marketing dashboard explains why.
The six bot types that actually hit UAE sites
Bot traffic is not one problem. It is six, with different symptoms and different fixes.
| Bot type | What it does | Where you notice it |
|---|---|---|
| Price and content scrapers | Copies your catalogue, rates, listings or articles at machine speed | Competitor matches your price within hours; duplicate content outranks you |
| Credential stuffing / ATO | Replays leaked email-password pairs against your login | Login failure rate spikes; customers report hijacked accounts and drained wallet balances |
| Card testing | Runs micro-authorisations to find live stolen cards | Thousands of tiny declines, gateway risk flags, chargeback ratio climbing |
| Scalping and inventory hoarding | Holds carts, seats or slots so real buyers see sold out | High add-to-cart, near-zero conversion, abandoned sessions at scale |
| Form, OTP and signup abuse | Fake registrations and triggered SMS at volume | Junk CRM leads; SMS bill rises with no new revenue |
| AI crawlers | Harvests your content for model training and AI answers | Traffic in logs with no referral traffic coming back |
Three details matter when you choose defences. 27% of bot attacks now target API endpoints directly, bypassing the web interface and every JavaScript defence you put in it. 21% of bot attacks route through residential proxies, so they arrive from ordinary-looking home IP addresses in your own market — IP blocklists are nearly useless against them. And 55% of bot attacks are advanced or moderate in sophistication, with 41% fully advanced, meaning they execute JavaScript, hold cookies and imitate human mouse movement.
The AI-crawler category is a strategic decision rather than a straight block — we cover when to allow, block or charge in our guide to AI crawlers and your Dubai website.
Why Dubai is a bigger bullseye than most markets
Bad bots follow money and inventory, and Dubai has an unusual concentration of both.
Travel and retail are the most bot-targeted industries on the internet — and Dubai is one of the world’s densest travel-commerce markets. Dubai’s Department of Economy and Tourism recorded 6.97 million international overnight visitors between January and August 2026, with 21.61 million occupied hotel room nights and 66% occupancy. Every one of those bookings sits behind a rate page, an availability API and a loyalty login — precisely the three surfaces scrapers and account-takeover bots want.
On the commerce side, the UAE e-commerce market is around USD 12.3–12.4 billion in 2026, about AED 45–46 billion, serving 11 million-plus online shoppers across more than 45,000 active stores. High card penetration, high average order values and a large expat customer base with reused passwords make a rich target.
And identity attacks are landing here. CyberArk research found that 92% of UAE organisations suffered at least three successful identity-related breaches in the twelve months to April 2026. The UAE Cyber Security Council reports that more than 75% of breaches in the country start with a phishing email or fraudulent message — which is exactly how the credential lists that feed stuffing bots get built. Financial services alone absorb 24% of all bot attacks and 46% of account takeover incidents.
How to find out what is hitting you, in one afternoon
You do not need a procurement cycle to size this. You need an hour with the right log.
- Count requests, not sessions. Pull seven days of raw access logs from Nginx, Apache, your load balancer or your CDN and group by user-agent, network and path. Compare total requests against GA4 sessions. The gap is your bot load.
- Rank your endpoints by failure. Any login, OTP, search, availability or coupon endpoint with an abnormal error-to-success ratio is under automation.
- Check the 03:00 shape. Human Dubai traffic has a clear daily curve. A flat overnight plateau is machines.
- Watch one cost line. Egress bandwidth or serverless invocations per real order. If it rose while orders stayed flat, you are paying to serve attackers.
- Test your own API without a browser. If a command-line request can pull your whole catalogue or hit your login 500 times, so can everyone else.
The defence stack, layer by layer
Bot defence is a stack, not a product. Each layer is cheap on its own; skipping the last one is what makes the others fail.
| Layer | What it stops | Effort |
|---|---|---|
| Edge WAF plus managed bot rules | Simple, high-volume bots and known bad networks | Hours, config only |
| Per-endpoint rate limits | Credential stuffing, card testing, OTP abuse | 1–2 days |
| Managed challenge on risk signals only | Advanced bots, without punishing real buyers | 1 day |
| Behavioural bot scoring | Residential-proxy and browser-automation traffic | Vendor tier, tuning over weeks |
| API-level auth, quotas and schema validation | The 27% of attacks that never touch your pages | 1–2 weeks |
| ATO controls: MFA, device binding, breached-password checks | Logins that succeed with stolen but valid credentials | 1–3 weeks |
| Bot-aware analytics and alerting | Blindness — the actual root cause | 2–3 days |
Note what is not on that list: blocking by country. Geo-blocking is the first thing Dubai teams reach for and it fails twice over — residential proxies put attackers inside the UAE, while your real customers include seven million annual visitors and a diaspora of Gulf shoppers abroad. You will block revenue and keep the bots.
What bot defence actually costs in AED
Published list prices, converted at AED 3.6725 to the dollar. These are real vendor rates, not estimates.
| Option | List price | In AED | Best for |
|---|---|---|---|
| Cloudflare Pro, Super Bot Fight Mode included | USD 20/mo on annual billing, 25 monthly | ~AED 73/mo per domain | SME sites, brochure plus light commerce |
| Cloudflare Business | USD 200/mo on annual billing, 250 monthly | ~AED 735/mo per domain | Busy stores and booking sites |
| Cloudflare Bot Management, bot scores and granular rules | Enterprise add-on, no published list price | Quoted | Scraping-heavy travel and marketplaces |
| AWS WAF base | USD 5/mo per web ACL, 1 per rule, 0.60 per million requests | ~AED 18/mo plus AED 2.20 per million | Anything already on AWS |
| AWS WAF Bot Control, common level | USD 10/mo plus 1 per million, first 10M free | ~AED 37/mo plus AED 3.67 per million | Baseline bot filtering |
| AWS WAF Bot Control, targeted level | USD 10/mo plus 10 per million, first 1M free | ~AED 37/mo plus AED 36.70 per million | Advanced, proxy-backed bots |
| AWS Account Takeover Prevention | USD 10/mo plus 50–1,000 per million by tier, first 10,000 free | ~AED 37/mo plus tiered usage | Login and signup protection |
| AWS WAF CAPTCHA | USD 0.40 per 1,000 attempts | ~AED 1.47 per 1,000 | Risk-triggered challenges |
One correction to a common assumption: Cloudflare’s full Bot Management is not on Pro or Business. Those plans include Super Bot Fight Mode — definitely-automated and likely-automated rules, verified-bot handling, static-resource protection, JavaScript detections — with limited analytics. Bot scores and granular rule-building are an Enterprise add-on. For a large share of Dubai SMEs, Super Bot Fight Mode plus well-written rate limits is genuinely enough; for travel inventory and marketplaces it is not.
Implementation is where budgets actually land. Aquarius engagement ranges: AED 9,500–18,000 for a hardening sprint on an existing site, covering log audit, edge rules, endpoint rate limits and bot-aware dashboards, and AED 28,000–65,000 for a full programme covering API gateway controls, account-takeover defences, challenge tuning and ongoing rule maintenance.
Do the arithmetic yourself. If your site serves 10 million requests a month and 40% are hostile, four million paid requests return nothing. Add card-testing declines pushing your chargeback ratio toward gateway thresholds — see our breakdown of chargeback fraud prevention for Dubai e-commerce — and junk OTP sends, which we covered in SMS pumping and OTP fraud in the UAE. The AED 37 per month line item is not the expensive part of this story.
How Aquarius approaches it
We start with measurement, because nobody should buy a bot product before knowing their bot load. Week one is a log-based audit that produces one number: what share of your requests are automated, broken down by endpoint. Then we tune from the cheapest layer upward — edge rules and rate limits before any new subscription — and we test every rule against Googlebot and Bingbot so SEO does not become collateral damage. Dubai-specific caveats are baked in: Arabic and RTL paths, UAE Pass and OTP flows, Ramadan and GITEX traffic spikes, and PDPL-aware logging so your defence data does not become a compliance problem. Fixed scope, fixed price, and the audit output is yours whether or not you continue.
FAQ
How much of my Dubai website traffic is probably bots?
Plan on about half. Across measured global traffic in 2025, 53% of requests were automated and 40% were malicious. Travel and retail — two of Dubai’s biggest digital sectors — sit above average. Your own figure comes from raw access logs, not GA4.
Why does Google Analytics show no bot traffic?
Because GA4 removes it before you see it. Google documents that known bot and spider traffic is excluded automatically using the IAB list, that you cannot turn the exclusion off, and that you cannot see how much was excluded. GA4 is the wrong tool for this question.
Is Cloudflare’s free plan enough to stop bots?
For a small brochure site, often yes — Bot Fight Mode plus sensible caching handles crude scrapers. The moment you have a login, a cart, an OTP or a public API, you need per-endpoint rate limits and risk-based challenges. Pro at roughly AED 73 per month adds Super Bot Fight Mode and is the usual first upgrade.
Will blocking bots hurt my SEO?
Only if the rules are written badly. Verified search crawlers should be explicitly allowed, and every bot rule needs testing against Googlebot and Bingbot before it goes live. Done properly it helps: your server stops spending capacity on hostile load, which also shows up in Core Web Vitals.
What is the single highest-value fix if I can only do one thing?
Per-endpoint rate limiting on login, OTP, search and checkout. It is configuration rather than new spend, it defeats the high-volume 45% of attacks that are simple and loud, and it immediately cuts credential-stuffing and card-testing throughput.
Do bot defences break Arabic or UAE Pass user journeys?
They can, if challenges are applied blindly. Challenge on risk signals rather than on every visit, exempt authenticated and government-identity callbacks, and test the RTL journey separately — Arabic-language sessions and UAE Pass redirects are the two flows most often broken by a careless challenge rule.
Find out what you are really serving
Aquarius builds and hardens Dubai websites, stores and APIs with bot defence treated as infrastructure rather than an afterthought — measured load, layered rules, protected logins and dashboards that show you the traffic GA4 hides.
See our transparent AED pricing, or send us your domain and we will tell you what share of your traffic is human.