The message arrived on a Wednesday morning. From: the mail server. Subject: undeliverable.<\/p>\n
A client\u2019s website had sent out a confirmation of receipt, as it does for every enquiry. However, the recipient\u2019s address did not exist. It had never been genuine. A programme had filled in the contact form during the night, using a made-up name and address, and the website had replied politely.<\/p>\n
That same morning, two comments were awaiting approval on another client\u2019s website; both contained promotional links in Cyrillic script and had been submitted within eight hours.<\/p>\n
Two websites, one morning, not a single person involved.<\/p>\n
The Bad Bot Report by Thales and Imperva has been tracking who is actually active online for thirteen years. The 2026 edition analyses 17.2 trillion requests from 2025.<\/p>\n
53 per cent of this came from machines. People: 47 per cent. Last year, the figure was 51 to 49, and the gap is widening.<\/p>\n
That\u2019s not a headline for security researchers, but a statement about your business. If your analytics show three hundred visits a month, half of those aren\u2019t people who could buy from you.<\/p>\n
The figure alone is misleading, as it lumps together two groups that could hardly be more different.<\/p>\n
Around 13 per cent are programmes that you need. Googlebot, which adds your pages to the index. AI crawlers that gather content for AI answers. Services that check whether your page is accessible at all. Without them, nobody will find you.<\/p>\n
The remaining 40 per cent are the problem. Programmes that scrape content, brute-force passwords and spam forms. Their share has risen from 37 to 40 per cent, marking the seventh consecutive year of growth. The driving force is obvious: AI-powered attacks have increased more than twelvefold within a year. Not because the attackers have got better, but because anyone can now use these tools.<\/p>\n
And they are harder to spot than they used to be. Around 41 per cent use Chrome, so they appear in the server logs as if they were visitors from Buchs. One in five uses connections from private households rather than data centres. Anyone looking for anomalies in Analytics will usually find none.<\/p>\n
Let\u2019s go back to Wednesday\u2019s error message, because that\u2019s where the real problem lies.<\/p>\n
A bot fills in the form. The website sends a confirmation to a made-up address. The external mail server rejects it and sends the message back. Experts call this \u2018backscatter\u2019, and from the perspective of the major email providers, it looks as though your domain is sending emails indiscriminately to non-existent addresses.<\/p>\n
It doesn\u2019t matter just this once. Over the course of weeks, your domain\u2019s reputation will decline. And once that reputation is damaged, even the emails you\u2019ve actually written will eventually end up in the spam folder. Quotes. Invoices. Appointment confirmations.<\/p>\n
The tricky thing is that it\u2019s invisible. The website is up and running, the form works, and the error messages seem like minor technical glitches. Until a customer rings up and asks why she never received a reply. I have shown how invisible this problem can be in Your website is working. Yet your enquiries never seem to get through.<\/a> using a real case.<\/p>\n I manage websites for businesses in Buchs, Werdenberg, the Rheintal and Liechtenstein. What actually arrives there is rarely spectacular. These four points cover the bulk of it.<\/p>\n Secure forms.<\/strong> A modern, invisible protection system intercepts automated requests without your visitors having to click on anything. The checks from the early 2010s, where you had to click on traffic lights, no longer stop today\u2019s programmes. On the websites I look after as part of my Hosting and maintenance<\/a> service, this is standard.<\/p>\n Sending emails via your own domain.<\/strong> Not via the web server, but via a proper mailbox. Plus the three DNS records SPF, DKIM and DMARC, which let recipients check whether an email really comes from you. This protects your reputation and, as an added bonus, stops anyone from sending emails in your name.<\/p>\n Confirmation emails come last.<\/strong> Anyone who switches them on before the form protection is in place is building in their own backscatter.<\/p>\n Disable the comments function,<\/strong> if you don\u2019t need it. On most company websites, it has never been used, yet it is still accessible.<\/p>\n This isn\u2019t a security package costing a few hundred CHF a month. It takes a few hours\u2019 work, after which it costs nothing.<\/p>\n For the 13 per cent you need, the opposite of a defensive approach applies. Clean markup, meaningful alt text and link text, and a layout that doesn\u2019t jump around whilst loading. This enables search engines to find your content, and it also enables the programmes that are now working on behalf of your customers to find it. I\u2019ve covered this in Your website is about to receive a visitor who isn\u2019t human<\/a> in more detail.<\/p>\n What is remarkable about this is that it is the same work as always. Accessibility, a clean structure, consistent presentation. None of this is new; none of it represents a gamble on the future.<\/p>\n The 47 per cent will continue to pay the bills. Nothing will change in this regard.<\/p>\n What\u2019s changing is the effort involved. A website is no longer just a shop window; it\u2019s also a door that\u2019s constantly being rattled by people who don\u2019t want to buy anything. Anyone who leaves this door open won\u2019t notice for a long time, and will later pay the price in terms of their deliverability.<\/p>\n A good first test will take you two minutes: have a look in your inbox. If you regularly find error messages there about undeliverable emails that you\u2019ve never written, you already know that your door is wide open.<\/p>\nFour things that are enough<\/h2>\n
And the good half<\/h2>\n
What remains<\/h2>\n