1. Bandwidth: total bytes served to bots divided by 1GB, multiplied by $0.09/GB (AWS/Cloudflare blended average rate)
2. Compute: total bot requests divided by 1 million, multiplied by $0.40 (Vercel/Lambda average per million invocations)
Both rates are configurable assumptions — the real value is seeing the relative breakdown between bots and the order of magnitude of waste. Your actual cost depends on your specific hosting provider.
The spoofing problem is the hard one. Bots that fully spoof Chrome headers are invisible to any UA-based tool including this one. The honest answer is that BotCost catches the "polite" bots that identify themselves — which covers the major AI companies (OpenAI, Anthropic, Google, Meta) since they all self-identify. The truly malicious scrapers that spoof identities are a harder problem requiring behavioral analysis.
So it's accurate for what it is — catching known AI training and search crawlers — but not a complete bot detection solution.
0% of traffic is non-human · <$0.01/yr projected
Well, 0% of traffic is AI bots. 99% of traffic is vulnerability scanners actually.
Good news: 0% AI bot traffic on an unadvertised landing page makes sense — those bots tend to follow links and sitemaps. If you run it on a site with real content and traffic you'll likely see a different picture.
Vulnerability scanners on the other hand... that's a different problem worth solving too.
smy_smy•1h ago
plaintosapp•1h ago