State of the Internet 2026

March 13, 2026

What Changed, What Matters, and What You Can Actually Do About It

The internet changes faster every year. And 2025 said ‘hold my beer.’ 

How people find you, whether they trust you, if they even visit your website – all of it changed. Again.

When we talk about the state of the internet, we’re talking about the state of the internet as we build it. So, website focused.

Many of the changes we’re seeing are pushed by the adoption of AI and the behavior shifts it has influenced. We predicted them last year (can we get a heck yeah?). Here’s what we’re seeing in 2026:

1. The bot situation is officially out of control.

Bot traffic now sits between 30-50% of all web traffic. Let that sink in. Nearly half of your “visitors” aren’t even human. We’ve done two whole episodes about this phenomenon because it’s that big of a deal (Battling Bots, Tips to Stop Spam).

And Then There Are the Email Hackers

Bots and hackers aren’t just messing with your website traffic – they’re coming for your email too.

Stacy, our CFO and chief wearer of many hats, gets fake invoices constantly telling her our owner, Monica, approved a $30,000 invoice. The emails sometimes even look like Monica sent them.

On closer look though she finds that the email is sending from Monica’s name but not her actual email address. Or sometimes the “M” in mayecreate is actually an “r” and an “n” right next to each other. Sneaky.

There’s even new stuff where you don’t have to click on anything – you open the email and the code executes itself. 

What We Can Do About It

1. Don’t just Click. Ask.

This is our new office mantra. If something seems even slightly off about an email, text, or link – ask before you click. Things are getting worse all the time, not better.

2. For the love of all things holy, don’t turn off two-factor authentication.

As annoying as you might think it is, just don’t. Your privacy is increasingly your responsibility. Everything you touch every day is connected to the internet at this point, so we need to be vigilant in protecting ourselves and our family members.

3. Set up SMPT to make sure the emails sent from your website actually arrive.

Email systems are getting more and more intelligent to fight bots and keep bad stuff out of your inbox. Which is great, except now YOU need to take additional steps to prove you’re a real person and not just a bot sending spam.

SMTP matters more than ever. We use WP SMTP Pro to make sure our clients’ emails actually get delivered and don’t get flagged as spam. It’s essentially a secure way to send your emails that proves to email providers “yes, this is a legitimate email from a legitimate person.”

Without it? Your contact form submissions might never reach you. Your automated emails might land in spam. Your perfectly crafted newsletter might disappear into the void.

4. Protect your email from imposters by setting DMARC & SPF records.

DMARC and SPF records ensure that your emails are authenticated and trusted – basically proving that emails claiming to be from you ARE actually from you.

DMARC stands for Domain-based Message Authentication, Reporting and Conformance (we know, it’s a mouthful). It’s an email security protocol that prevents spoofing and phishing. Remember those fake invoices Stacy gets that look like they’re from Monica? DMARC stops those.

SPF (Sender Policy Framework) is like a guest list for your domain. It tells email servers “QuickBooks can send email on behalf of my domain. Google can send email on behalf of my domain. But anything else? Block it.”

If you don’t understand the DMARC and SPF stuff, that’s okay.

 Just talk to your email provider or DNS provider and have them implement it for you. They’ll do it, and you’ll sleep better at night knowing scammers can’t pretend to be you.

Without these protections, scammers can send emails that look like they’re from your business. And when your legitimate emails DO go out, they’re more likely to be flagged as spam because you haven’t proven you’re trustworthy.

2. Cookies are crumbling and privacy laws are multiplying.

Third-party cookies are different. 

They track you across different websites, powering retargeting ads and behavioral targeting. When they finally bite the dust, tracking people across the internet will get messy. Retargeting ads and behavior-based targeting will be limited and less accurate.

Online privacy laws are expanding.

As of early 2026, 20 states have implemented privacy laws similar to GDPR – including California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Texas, Florida, Montana, Oregon, Delaware, New Hampshire, New Jersey, Kentucky, Nebraska, and Rhode Island – and several more are on the horizon.

Because of this, cookie popups have evolved from “we use cookies, deal with it” to “what do you want to do with this?” As a website owner, you’re now required by law to tell people what you’re tracking, for what purpose, and allow them to opt out.

In this arena we suggest playing it safe – set up your website to comply with any state you do business in.

Cookie popup acceptance is way up.

People are more aware of what enabling tracking means (or they’re just totally desensitized by all the boxes and buttons – jury’s still out on that one). A 2024 survey found that 66% of online shoppers now accept cookies – a huge shift from 2018 when 76% ignored them altogether.

That’s actually good news for website owners. 

When someone ignores a cookie popup (assuming it’s set up correctly), you’re not tracking them at all. But when they click “accept”? You can actually see what they’re doing on your site. So the shift from ignoring to accepting means website owners now have more trackable visitors and better data on user behavior.

GA4 is still the tracking king.

Google Analytics 4 is still the standard for tracking website performance. But remember all that bot traffic we just mentioned? It’s bloating your web traffic data right now.

Make sure you’re looking at demographics and sorting out the locations with zero engagement. Otherwise, you’re making decisions based on garbage data.

3. AI stole Google’s thunder (and your traffic).

Search behavior has fundamentally changed.

Remember back in the olden days (2024) when you needed an answer and your only solution was to “Google it”? That monopoly is shifting. In March 2025, ChatGPT was already handling 37.5 million search-like prompts daily creeping up on Google’s 14 billion. And ChatGPT more than doubled its users in the last year – now it’s up to 800 million weekly active users as of December 2025.

People are searching differently at different stages.

Early research = Conversational AI

People are thinking less in keywords and more in conversations when they’re learning about what you do. Instead of Googling “iPad types,” they’re asking AI: “Tell me which iPad would be best to buy for my 11-year-old.”

Ready to buy = Traditional search with location

When people are actually ready to buy, they still use traditional search. They’re looking for “iPad repair shop near me” or “iPad store in Camdenton, MO.” Those location indicators still matter – and just like before, they’re end-of-buying-cycle searches.

And when they do search Google, they click way less.

Mobile searches are up but mobile clicks are tanking.

Over 63% of all Google searches happen on mobile devices. But mobile users are far less likely to click through to your website. Only 17.3% of mobile searches, compared to 25.6% on desktop.

People are getting their answers from Google’s search results page, using Maps for directions, or watching YouTube videos – all without ever visiting your actual website.

4. Marketing is moving back to owned spaces.

People are moving back to owned spaces.

People are trending out of social media platforms and going back to spaces they control.

Median engagement on TikTok and Instagram posts declined year over year. And in a large survey, 74% of adults (half Gen Z and half Millenial) said they don’t really feel social media is “social” any more. Now “appstinance” is all over the news with people planning and trying to spend less time on their phones and social media. (Apparently it makes you happier, again, duh.)

Do you even need a website anymore?

Duh. When’s the last time a Facebook post showed up in your search results? But no really, yes, you do still need your website. Remember those “near me” and location based end of buying cycle searches? Over half of those people may just call you because they see you on the map or search results. The others? They’re headed to your site to check you out and see how you stack up against the competition.

Your Google Business Profile is critical (yes, really).

With zero-click searches dominating, if the wrong phone number shows up in your Google Business listing, you get nothing. People make their decision right there without ever visiting your site.

• Your hours need to be accurate. 
• Your phone number needs to be right. 
• Your photos need to be current. 

Because 60% of people will never click through to your actual website – they’re making decisions based solely on what they see in your Google listing.

Focus on what you actually own.

Your owned assets are worth more now than ever:

• Your email list (yes, still)
• Your customer database
• Your Google Business Profile
• Your actual website

These are the things you build and maintain yourself, not the things you rent space on.

So when Facebook changes the algorithm (again) or Instagram decides to hide your posts, you don’t lose everything. Your email list, website and Google Business Profile won’t just disappear.

Yes, online ads still work. Use them to drive traffic. But ads without a strong website and email follow-up? That’s just throwing money at people who’ll forget you in 30 seconds.

5. Zero-click searches mean your listing IS your first impression.

Your Google Business listing is basically your storefront now. 

With 60% of searches being zero-click, people are making decisions from your Google profile without ever visiting your site. That means your hours need to be up to date, your phone number needs to be right, and yes, you need to update it for holidays.

There’s nothing worse than spending time getting to a place (whether you’re in a small town or a big town) and finding a piece of paper on the door that says “Sorry, we’re not going to be open tonight because of whatever.” You’re like, “You couldn’t have put that on social media, sent an email, AND updated your Google profile?”

Listing inconsistency is costing businesses customers.

One of our clients was complaining about a lack of leads calling in so we checked their listings – they had a different phone number in the top 3. What a mess.

Consistent name, address and phone are signals to Google that you’re a legit operation. And by consistent we mean you need to decide if you’re going to spell out ‘East’ or abbreviate it as ‘E.’ and do it the same way everywhere.

For situations like this we suggest paying MOZ Local for six months to a year to repair and auto-sync your listings. And honestly? With how important this is, it’s worth it.

Schema markup adoption is rising (because AI needs it).

This isn’t new – schema markup has been around since 2011. But it’s more important than ever because it tells AI bots specifically what’s on your website in a super easy way.

Schema markup tags identify different pieces of content on your site. It helps you appear in rich search results, and even if people aren’t clicking through, they’re going to see your content displayed.

Some of it happens automatically depending on your platform and how you add content. But if showing up in AI searches is important to you, you’ll need to learn about it and probably apply some tags manually. AI can help you prep for this, but you need a brain to pull it off.

6. Technical performance is your new gatekeeper.

Page speed now directly impacts whether you get found or forgotten.

Technical performance determines whether visitors stick around or bounce immediately – and Google is watching.

Google grades your site on every single page load. 

Every. Single. Time. Your site’s load time directly impacts your search rankings. Fast sites rank better. Period. A good site loads in 2.5 seconds. A page ranked on the first page of Google? It loads in an average of 1.6 seconds.

It’s tracking what people do on your site – do they stick around? Do they click? Do they go to more than one page? How long do they stay? Those are the indicators that show Google whether your site is what people wanted or not.

Outdated PHP is becoming a crisis (and nobody’s updating it).

72.2% of websites use PHP. With fewer than 25% running supported versions, that leaves more than half of the internet operating on unpatched, vulnerable infrastructure – sitting ducks for hackers. Totally fine. No big deal.

Right now, you should be running PHP 8.3 (or 8.4 if your server allows it).

PHP 8.1 is officially marked by WordPress as something you should not be using – it went out of support in December 2023. We have until January 2027 to run 8.2, but honestly, you should already be on 8.3.

Your website host isn’t going to automatically upgrade it for you. Because it can break your site. And the longer you wait, the more likely you will just have to completely rebuild your site.

It’s like when your kids start using so much lingo that you’re sure they’re speaking English, but you have no idea what they’re saying anymore. You’re becoming incompatible.

7. AI content is everywhere (and it all sounds the same).

AI is flooding the internet with generic content and people can tell. The bar for standing out just got higher because anyone can generate decent-sounding copy in seconds. Which means personality, specificity, and actual expertise matter more than ever.

Being forgettable just got way easier (so don’t be).

Here’s the thing: When a real human actually gets to your site, it loads fast, and then you serve junk content that clearly was written by ChatGPT – it’s like serving a styrofoam cake at a birthday party. 

Those people are not going to want to be friends with you.

You CAN use AI to help you write and plan your site. Please do. We wrote a whole post about using AI to write website copy to guide you. Just make sure you use your brain while you’re at it. 

Your business is built around you and what makes you different. 

A visitor should be able to feel your presence in the pages of your site – not generic corporate speak that could describe any company in your industry.

• Share examples of your actual work, add photos and the problems you solved to bring your product or service to life.
• Let your personality shine through so people can get to know you before they ever pick up the phone.
• Explain your unique perspective and expertise in a way they haven’t heard before – because you’ve actually done the work, not just researched online.
• Specialized tools (like our website estimator – ChatGPT can’t do that)

If you can swing it, invest in specialized tools. 

Calculators, configurators, assessments, interactive maps – things that give people real value without making them fill out a contact form first. For example, we built a website estimator that lets people get a ballpark number before we ever talk, AI can’t do that. 

AI can scrape content and summarize it, but it can’t build you a custom tool that solves a specific problem for your specific audience. And that tool can bring them back to your website time and time again.

AI has raised the bar for how content should be organized.

People are now trained by AI to expect neatly structured, easy-to-scan content. Bulleted lists. Clear sections. Segmented thoughts. The kind of formatting ChatGPT does automatically.

What this means for your website: You can’t hit them with a thesis paper that needs a decoder ring. If your content looks like one giant wall of text with no subtitles, no one’s reading it.

So look at how AI formats information – then emulate that in your own way, you’re golden. 

8. Sites that work for everyone but look really boring.

Accessibility is now the law (and easier to test than ever).

In April 2024, the ADA website accessibility mandate went into effect. So for many businesses and organizations that means they legally have to make their site work for everyone. Which in our opinion is pretty awesome.

Sites that are accessible:

• Work for everyone (not just people with disabilities)
• Load faster (good code is clean code)
• Show you care about all users (which matters to people)

Here’s what people miss about accessibility.

From a technical standpoint, building with accessibility in mind is just better practice. It makes your HTML cleaner, your code more maintainable, and your site more functional across all devices and situations. Even if you somehow don’t care about being inclusive (don’t be that person), it’s still the smarter way to build.

Inclusive design is a differentiator. It shows you actually care about people, which is never bad for business. And now it’s easier to test and many tools like Lighthouse, Wave and Contrast Checker are completely free so you don’t have an excuse not to.

But everyone’s playing it too safe (the blahification problem).

Here’s the trend we’re seeing: websites are getting boring. Really boring. The same beige, the same gray, the same safe layouts, the same generic wording. We’re calling it “blahification”.

Call it the “millennial gray of the internet” (shout-out to all the millennials with side parts). Everyone’s playing it safe because they think accessible = boring or fast = bland.

That’s a cop-out.

Sure, orange is legitimately tricky to make accessible (color contrast requirements are no joke), but tricky colors don’t justify boring design.

Here’s what’s happening: People get used to seeing websites that all look similar, so they start thinking that’s just how websites should look now. They gravitate toward what feels safe and familiar. But when your site looks exactly like your competitors’, you’re forgettable. And forgettable doesn’t get the call.

This applies to content too. Generic corporate speak that could describe any company? That’s blahification too. Your voice, your perspective, your actual personality? That’s what makes people remember you.

Express yourself. Be unique. Show personality in your design, your content, your imagery. Don’t be blah just because it feels safer.

So what’s the big picture here? 

The internet in 2026 isn’t the internet we built websites for five, ten, or fifteen years ago. Traffic is down. Tracking is harder. Half the “visitors” on your site aren’t even human.

But here’s the deal:

• Your website still matters – maybe more than ever. But it has to work harder. It needs to load fast, show up in the right places, and give people a reason to stay when they DO visit.
• Your owned audience is gold. Your email list, your Google Business Profile, your actual website – these are your most valuable assets now. Invest there.
• Security and data accuracy aren’t just IT problems – they’re your problem too. If you’re making marketing decisions based on analytics that are 50% bot traffic, you’re making decisions on bad data. Clean it up, pay attention to what’s real, and protect what you’ve built.
• Update your stuff. PHP, security patches, content – make sure you’re not leaving enormous holes for hackers or letting your site get so outdated it breaks. We’re not building houses here. It’s the internet, and it changes fast.
• And finally – personality wins. When every website looks the same and AI is writing everyone’s content, being distinctly YOU is your competitive advantage. People want to work with you because you are you. Let you shine.