At 14:59 on Friday, November 7, 2026, the Google Analytics realtime report for Stamp Circuit, the philatelic auction site built and run by the Circuit Auction team, showed 124,003 active users in the last 30 minutes and 20,724 in the last five. The per-minute bar chart sat between 4,000 and 5,000 for the whole half hour. The map lit up over eastern China, the US east coast, Germany and Singapore. 83.3% of the page views were “Page Not Found”.
Those were not stamp collectors. Granted, more than 90% of that traffic was bots and AI crawlers, most of them requesting URLs that have not existed for years. But the site did not know that in advance, and it had to answer every one of those requests in real time, on top of the bidders who were actually there.
While the surge was running we opened PageSpeed Insights and tested the homepage. Desktop performance score: 97. First Contentful Paint 0.4 seconds. Largest Contentful Paint 0.4 seconds. Total Blocking Time 150 milliseconds. Cumulative Layout Shift 0.01. Speed Index 0.7 seconds.
This post is about why that result matters more than it looks, and about the setting most auction houses reach for when the same thing happens to them.
What Most Sites Do When This Happens
If you run an auction website on Cloudflare, the dashboard offers a big switch for exactly this moment: “I’m Under Attack”. Turn it on and every visitor gets an interstitial page, “Checking your browser before accessing…”, that runs a JavaScript test and lets them through after a few seconds. Cloudflare’s own documentation is careful about what it is for. It calls the mode “one of the last resorts when a zone is under attack” and says it “will temporarily pause access to your site and impact your site analytics”. Visitors need a browser that runs JavaScript to pass.
Many sites leave it on. It stops the bleeding, the server load drops, and nobody on the team is paid to turn it off again. We see auction and dealer websites that have been sitting behind the challenge page for months.
Here is the problem. Search engines and AI assistants are visitors too.
The Cost of the Challenge Page
Three things happen behind that interstitial that an auction house does not see until weeks later.
Google crawls less, or stops. Google’s crawler can execute JavaScript, but its own documentation explains that rendering happens “once Google’s resources allow”, in a queue, with a headless browser, and that “not all bots can run JavaScript”. A crawler that arrives with a budget of a few seconds per page and meets a five-second challenge has every reason to move on. Cloudflare’s Under Attack documentation does not list search engine crawlers as exempt from the challenge. Published accounts from site owners who left challenge modes on describe the same pattern: existing rankings hold for a while, fresh pages stop being indexed, and the indexed page count in Search Console drifts down.
AI assistants cannot see you at all. This is the part that is new. Cloudflare’s Radar 2025 Year in Review reports that AI “user action” crawling, where ChatGPT, Perplexity, Claude or Gemini fetch a page to answer a question somebody just asked, grew more than 15 times in 2025. Those fetchers mostly do not execute JavaScript. They request the page, get the challenge HTML, and tell the user the site had nothing useful on it. When a collector asks an assistant where to buy a particular stamp or who is auctioning a certain coin series next month, an auction house behind a challenge page does not exist.
Bidders feel it. A five-second wall in front of a catalog page is a five-second wall in front of a lot a bidder was sent a link to. On a timed sale closing in two minutes, that is a lost bid. The interstitial also breaks in any context where the browser expects a non-HTML response, which Cloudflare documents for AJAX and fetch requests: exactly the kind of request a live bidding screen makes every second.
So the switch that stops the bots also stops the two sources of new bidders that matter most in 2026: organic search and AI answers. For an auction house whose consignors are paying for reach, that is not a security setting. It is a marketing decision made by the on-call engineer.
How Much of the Web Is Bots Now
The surge above is an extreme version of what every auction site sees every day. Cloudflare’s Radar report for 2025 found that by early December, human traffic generated about 47% of HTML requests on its network and non-AI bots about 44%, with AI bots averaging 4.2% over the year. Googlebot alone produced 4.5% of all HTML requests, more than all other AI bots combined. Search engine crawlers made up 40% of verified bot traffic and AI crawlers 20%, with GPTBot at about 7.5% of verified bot traffic on its own.
Auction catalogs are especially attractive. They are large, structured, full of images and descriptions, priced, and change every week, which is everything an AI training crawler, a price tracker and a search engine want. They also accumulate years of old URLs from past sales, which bots keep requesting long after the lots have gone. That is why 107,344 of the views in our half hour were 404 pages. A site that spends a database query and a rendered template on each of those is one scraper away from falling over.
Why Stamp Circuit Stayed Fast
Nothing clever happened during the surge. The decisions had been made earlier. Stamp Circuit runs on the Astro Auction Website, the front end Circuit builds and hosts for auction houses, and every site on it works the same way. None of it is secret.
Serve 404s from the edge. A request for a page that does not exist should be answered by the CDN, from a cached response, without reaching the application or the database. During the surge, the 404 was the most-served page on the site and it cost almost nothing to serve. If the bots had been hitting rendered catalog pages, the catalog pages are cached at the edge too.
Challenge patterns, not people. Rate limits and firewall rules are written against behaviour: hundreds of requests a minute from one network, requests for URL patterns no human uses, user agents that lie. Visitors who look like visitors, and crawlers that verify as the crawler they claim to be, are never challenged. Cloudflare maintains a list of verified bots, which includes the major search engines and the AI assistant fetchers, and those stay on the allow list in normal operation and in a surge.
Separate the bidding engine from the pages. Bids, bid increments, the auction clock and the live auction console do not run on the same resources that serve catalog pages to anonymous visitors. A flood of anonymous page requests cannot slow down the bidders who are logged in and bidding.
Keep headroom. The infrastructure is sized for a multiple of normal peak, not for normal. A 10x spike is absorbed, not survived. This is cheaper than it sounds when the pages are cached and the 404s are free, because the expensive part of the stack never sees the spike.
Measure under load, not at 3 a.m. The PageSpeed test above was run during the surge, on purpose. A performance score taken on a quiet Sunday says nothing about the day a sale closes and a scraper discovers you at the same time.
The result on November 7 was a site that read, to Google, to Perplexity and to every human bidder, exactly as it reads on any other day: 0.4 seconds to the largest element on the page, 150 milliseconds of blocking time, no layout shift. All three are well inside the thresholds Google treats as good (LCP under 2.5 seconds, blocking time under 200 milliseconds, layout shift under 0.1), and the security level on the zone never moved from its normal setting.
What This Means for an Auction House Choosing a Platform
Most platform demos show you the clerk console and the cataloging screen. Few show you what happens to the bidder-facing site when traffic goes wrong, and none show you a page speed report taken while it is going wrong. But the questions are easy to ask.
- Where are 404s and catalog pages served from? If the answer involves the application server for every request, the site is only as strong as that server on its worst day.
- What happens to search engines and AI crawlers when you mitigate an attack? If the answer is “we turn on Under Attack mode”, ask how long it stayed on the last time and what happened to indexing.
- Is the bidding engine isolated from public page traffic? A sale should never slow down because a scraper is busy.
- Can you show me a PageSpeed result from a busy day? Not a quiet one.
- Who owns the domain and the traffic? On a marketplace, the operator decides when to challenge visitors and which crawlers to allow, and your sale is subject to those decisions. On your own website, you decide.
We have put the answers for Circuit on one page: auction website performance and bot protection. The short version is the screenshot at the top of this post.
The Point
Bot traffic is not going back down. Cloudflare’s numbers say automated requests already roughly match human ones, and the AI share is the fastest-growing part. Every auction house will have a day like November 7. The only question is whether the site is built so that nobody notices, or whether the on-call fix is a challenge page that quietly takes the house out of Google and out of every AI answer until someone remembers to turn it off.
About Circuit Auction
Circuit Auction is an all-in-one auction management platform for professional auction houses specializing in collectibles. It runs on your own website under your own brand, with AI cataloging, live and timed bidding, a built-in CRM, automated invoicing and consignor settlement in one system, on infrastructure built to stay fast when the traffic is not what you expected.
Want to see the realtime report and the PageSpeed test on a site running your own catalog? Book a demo and we will run it live.
Sources (checked November 7, 2026): Cloudflare docs: Under Attack mode (updated April 20, 2026), Cloudflare docs: Challenge pages, Cloudflare docs: Verified bots, Cloudflare blog: Radar 2025 Year in Review, Google Search Central: Understand JavaScript SEO basics, Google web.dev: Core Web Vitals thresholds, daily.dev: How Cloudflare Bot Fight Mode quietly killed our Google rankings. Traffic and performance figures are from the Google Analytics realtime report and PageSpeed Insights for stampcircuit.com on November 7, 2026, shown in the screenshots above.
