Snippet | Executive Summary (50–80 words)

Cloudflare Radar’s 2025 data shows that global Internet traffic grew by 19% year over year, AI crawler traffic continued to rise, IPv6, HTTP/3, and post-quantum encryption accelerated into real-world adoption, and 6.2% of global traffic was actively mitigated for security reasons. The Internet is rapidly evolving toward greater automation, stronger security, and mobile-first usage.

1. Why Cloudflare Radar’s Annual Data Matters

Looking at data from a single website, platform, or region often leads to incomplete conclusions. The value of Cloudflare Radar lies in its scope: it is based on real request traffic observed across Cloudflare’s global network, spanning millions of websites, applications, and network environments.

The 2025 Year in Review is not a forecast. It is a structured summary of what has already happened. These observations directly inform critical questions such as:

  • How is real-world Internet usage changing?
  • How are AI models and crawlers reshaping traffic patterns?
  • Are encryption, protocols, and security threats undergoing generational shifts?
  • Have mobile devices become the dominant access channel?

Everything that follows is derived strictly from the Cloudflare Radar 2025 Year in Review content, without external interpretation or added assumptions.

2. Global Internet Traffic: Growth Continues, Structure Changes

2.1 Worldwide Internet Traffic Grew by 19%

In 2025, Cloudflare observed a 19% year-over-year increase in global Internet traffic. This was not a short-term anomaly, but a sustained trend measured across the full year.

Importantly, the analysis begins in mid-January, not January 1. This avoids distortion from post-holiday normalization effects and better reflects baseline Internet usage.

Two conclusions follow directly:

  1. The Internet now functions as core infrastructure, deeply embedded in communication, commerce, education, entertainment, and transportation.
  2. Even amid global uncertainty, overall Internet usage intensity continues to rise.

2.2 Shifts in Major Internet Services

Generative AI services continued their rapid ascent throughout 2025. The data highlights Claude, Perplexity, and Gemini as major competitors alongside ChatGPT.

Across social and content platforms:

  • Facebook, Instagram, and TikTok remain dominant
  • Snapchat now outperforms X in overall activity
  • Roblox retains its leading position in metaverse-related services

Despite these shifts, Google remains the most accessed Internet service globally, while Instagram and YouTube moved into the global top ten in 2025. Rankings are derived from aggregated 1.1.1.1 DNS traffic data, not surveys or estimations.

3. Connectivity Evolution: From Terrestrial Networks to Satellites

3.1 Starlink Satellite Internet Traffic Trends

Cloudflare analyzed aggregate request volumes from SpaceX Starlink’s autonomous system (AS14593) throughout 2025.

Because Starlink is not yet globally available, traffic graphs are shown only for regions where Cloudflare observed meaningful volumes. All charts are normalized:

  • Max represents the peak observed request volume
  • 0 indicates no observed traffic

The focus is therefore on trend direction, not absolute scale. Even so, satellite Internet connectivity is clearly transitioning from niche coverage to a meaningful component of global Internet traffic.

3.2 IPv4 Traffic Distribution via Hilbert Curves

To visualize global IPv4 traffic distribution, Cloudflare uses a Hilbert curve, aggregating addresses at the /20 level.

This means:

  • Each cell represents 4,096 IPv4 addresses
  • Traffic can be explored by country, region, or autonomous system
  • Spatial continuity across the IPv4 address space is preserved

This approach provides a holistic view of where Internet traffic originates across the entire IPv4 ecosystem.

4. Encryption and Protocols: Security as a Baseline

4.1 Real-World Growth of Post-Quantum Encryption

Post-quantum cryptography (PQ) moved decisively beyond theory in 2025.

Key facts from the data:

  • Cloudflare enabled post-quantum key agreement by default in October 2022
  • Actual usage depends on browser support
  • As browsers enabled PQ by default, adoption rose rapidly

This confirms that encryption designed to protect against future quantum threats is now part of today’s Internet traffic.

4.2 HTTP Protocol Adoption in Practice

Cloudflare Radar shows real traffic distribution across HTTP versions in 2025:

  • HTTP/1.0 (1996)
  • HTTP/1.1 (1999)
  • HTTP/2 (2015)
  • HTTP/3 (2024, built on QUIC)

HTTP/3’s observed adoption reflects its practical advantages:

  • Faster connection establishment
  • Greater resilience to packet loss
  • Encryption by default

These benefits are no longer theoretical; they are visible in live production traffic.

5. AI Crawlers: Reshaping Content and Traffic Economics

5.1 AI Crawlers in robots.txt Files

Across the top 10,000 domains, Cloudflare successfully parsed 3,879 robots.txt files and analyzed AI crawler directives.

Crawler permissions were categorized as:

  • Fully allowed (Allow: *)
  • Partially allowed (specific paths)
  • Fully disallowed (Disallow: *)
  • Partially disallowed (specific paths)

This indicates that content owners are increasingly explicit about AI crawler access, rather than treating all bots equally.

5.2 Crawl-to-Refer Ratio: Crawling vs. Value Return

The crawl-to-refer ratio compares:

  • HTML crawl requests by platform-owned bots
  • Actual referral traffic sent back to websites

Displayed on a logarithmic scale, this metric highlights a key reality: AI and search-related crawling activity is growing far faster than corresponding referral traffic.

5.3 Three Distinct AI Crawl Purposes

Cloudflare classifies AI crawler activity into three clear categories:

  1. Training – collecting content to train large language models
  2. Search – supporting chat-based search and retrieval-augmented generation (RAG)
  3. User Action – executing tasks explicitly initiated by users

This distinction provides a more precise framework for understanding AI-driven traffic.

6. Devices and Usage Patterns: Mobile Is the Default

6.1 iOS vs. Android Traffic Share

In 2025, Cloudflare observed:

  • 35% of traffic from iOS devices
  • 65% from Android devices
  • Peak Android share reaching 97% in some regions
  • Peak iOS share reaching 70% in others

Mobile-first is no longer a design philosophy—it is a statistical reality.

6.2 Mobile vs. Desktop Access

Nearly 117 countries and regions recorded a majority of Internet traffic from mobile devices in 2025.

Desktop access, while still relevant, is now secondary in most parts of the world.

7. Internet Reliability: Global Connectivity Remains Fragile

7.1 Major Internet Outages in 2025

Cloudflare documented 174 major Internet disruptions worldwide in 2025.

Causes included:

  • Government-directed shutdowns
  • Power outages
  • Cable cuts
  • Technical failures
  • Misconfigurations
  • Maintenance events
  • Natural disasters
  • Cyberattacks

These events underscore that the Internet, while globally interconnected, is not immune to disruption.

7.2 IPv6 Adoption in Practice

IPv6 adoption rates were calculated based on requests for dual-stacked content served over IPv6.

Key drivers include:

  • IPv4 address exhaustion
  • Additional costs associated with IPv4 usage
  • IPv6’s inherent scalability advantages

8. Security Landscape: Bigger Attacks, Stronger Defenses

8.1 Mitigated Traffic Share

In 2025, 6.2% of global traffic was mitigated by Cloudflare’s systems.

Of that total:

  • 3.3% was mitigated specifically by DDoS protections or WAF managed rules

This means more than 6 out of every 100 requests required active security intervention.

8.2 Growth of Hyper-Volumetric DDoS Attacks

Cloudflare defines hyper-volumetric network-layer attacks as exceeding:

  • 1 Tbps in bandwidth or
  • 1 billion packets per second

In 2025, peak attack sizes increased approximately:

  • 10× when measured in bytes
  • 7× when measured in packets

8.3 Routing Security and RPKI Adoption

By the end of 2025, 53.9% of global IPv4 routes were RPKI-valid, an increase of 3.9 percentage points over 2024.

This represents steady progress toward more secure Internet routing.

9. Email Security: A Persistent and Concentrated Risk

9.1 Malicious Email Volume

Cloudflare found that 5.6% of analyzed email traffic in 2025 was malicious.

These messages targeted:

  • Credential theft
  • Data exfiltration
  • Financial fraud

9.2 Most Abused Top-Level Domains

As of November 2025, nearly 1,600 top-level domains existed globally.

Based on analysis of billions of emails, Cloudflare identified a subset of TLDs responsible for a disproportionate share of malicious and spam email traffic.

FAQ | Common Reader Questions

Is Cloudflare Radar representative of the entire Internet?

It does not observe every network, but its scale and global footprint make it one of the most representative real-traffic datasets available.

Have AI crawlers overtaken human traffic?

The report does not state a definitive crossover point, but it clearly shows sustained growth in AI crawler traffic throughout 2025.

Has IPv6 replaced IPv4?

No. IPv6 adoption continues to grow, but IPv4 remains widely used.

Conclusion: The Internet of 2025 Is Structurally Different

Cloudflare Radar’s 2025 Year in Review does not present isolated trends—it reveals a coherent structural transformation:

  • Traffic continues to grow, but automation is accelerating
  • AI is fundamentally reshaping how content is consumed
  • Encryption and security are becoming default assumptions
  • Mobile devices are now the primary gateway to the Internet

These are not future projections. They are measurable realities of today’s Internet.