AI agents now make up more than half of web traffic. Most major sites have no policy for them.

Automated services that answer questions, complete purchases, or scrape content for training now account for 57.5% of all web traffic in June 2026, passing the human share for the first time. A graded study of the 10,000 highest-ranked domains finds the rules meant to handle those visitors barely exist.

D3 Research scored each domain on four measures worth 100 points: answer eligibility (35), buyer access (35), content exposure (20), and identity controls (10). The median site scored 56, and 73% had no written rules for AI traffic. Among the 5,577 sites that did publish policies, 84% received a D or F; only 13 earned an A. Of the 100 largest sites, 93% landed in D or F territory.

The bottleneck is the identity score. D3 found that 95.8% of 2,175 known agents provide no extra information that lets a website verify who they are. Without that handle, a site cannot tell a buyer-bot from a training crawler, so it cannot set selective rules, and the rubric downgrades it.

Two sites prove the gap is not inevitable: Nvidia scored 93, Traveloka 90. Amazon scored 27. Agent traffic grew 7,851% year over year, per HUMAN Security data cited by D3. The policy layer is a generation behind the traffic mix.