Not all automated traffic is malicious, but a great deal of it is worthless to you and expensive to serve.
IDENTIFYING IT
cPanel > Metrics > Visitors shows recent requests with IP addresses and user agents. Raw Access gives the full log. Look for a single address requesting hundreds of pages, user agents naming unfamiliar tools, or sequential requests hitting every page in order.
Compare your cPanel statistics with Google Analytics. A large gap usually means most of your "traffic" is bots.
WHAT TO DO
Use Cloudflare. Its bot management, even on the free plan, stops a great deal of this before it reaches us, and it is far more effective than anything at the account level. Block specific persistent addresses with cPanel IP Blocker. Add a robots.txt to discourage well-behaved crawlers from expensive sections such as search result pages and faceted filters. Rate-limit expensive endpoints such as internal search. Enable caching so bot requests are served cheaply.
WHAT NOT TO DO
Do not block Googlebot, Bingbot or legitimate social media crawlers. Verify before blocking, as bad bots often falsify their user agent to impersonate them.
