If Startpage has made you wait on a “Verifying your request…” screen, or asked you to sign in before showing results, it has now explained why. In a blog post on Wednesday titled “Serving Humans, Not Bots”, the private search engine says bots now make up most of its traffic.
“In 2024, about 35% of Startpage requests came from bots. This year it’s 70%. Many are AI-driven botnets that attack from thousands of IP addresses at once, scraping the free, high-quality Google and Bing results we offer.”
Seventy per cent. For a search engine whose whole pitch is privacy, that’s a big number, and the response tells you a lot about where the economics of resold search are going.
What Startpage is doing about it
The post, signed by Startpage advocate Cliff Kim, lists what users may see:
- A quick challenge. Before some searches, the browser “does a short bit of work to show it’s a real visitor”. It’s cheap for one person but costly for a bot running millions of searches. Startpage says this blocked more than 1.8 million suspicious requests in one recent week.
- A sign-in prompt in some cases. If your searches look like recent bot activity, you may be asked to sign in. Startpage says accounts are free and searches are never linked to them.
- More checks on VPNs. Shared VPN addresses are heavily used by bots. Startpage says it is tuning its rules so real VPN users get flagged less.
It also admits a mistake. From 21:32 CEST on 12 October to 17:25 CEST on 13 October (20:32 to 16:25 UK time), a new rule blocked some real users, mostly on mobile browsers. Startpage says it has rolled the rule back and is adding broader testing. Credit to them for putting exact times on it, which most companies wouldn’t.
Users noticed weeks ago
This didn’t start this week. A Privacy Guides forum thread from 2 September complained of “Verifying your request…” on “almost every search”, with high CPU use. Members quickly worked out it was a proof-of-work check, and one said Startpage was using Anubis. Opinions were mixed. Some found it far better than the image CAPTCHAs that had plagued them from March to June. Others reported waits of minutes, and one pointed out that Startpage no longer works with JavaScript turned off. Startpage’s support page on CAPTCHAs already said it is “routinely scraped by bots” and can’t lower its security threshold “beyond a certain point”.
The real story: someone pays for every scraped result
The key line in the post is this: “We pay for every result, including the ones bots take, and that cost is growing fast.” Startpage doesn’t run its own index. It buys Google and Bing results and serves them privately. As we wrote when we looked at how many “alternative” engines still rent Bing or Google, that model works only if your costs track human demand. Once AI scrapers treat you as a cheap back door to Google results, every bot query is a bill.
That’s why this matters beyond Startpage. Scrapers that want Google-quality results without paying Google will naturally go after the resellers who already pay for them. Any engine in the resold-results camp faces the same choice: absorb the cost, add friction, or push people into accounts. Startpage is doing the last two.
My take: proof-of-work is the most privacy-friendly anti-bot tool going, and I’d rather see it than Google reCAPTCHA on a privacy engine. The sign-in prompt is a bigger change. “Accounts are free, and your searches are never linked to them” may be true, but a private search engine that sometimes needs a login is a different product. If the bot share keeps growing, expect that prompt to show up more often.
For SEOs, there’s a smaller point too. If you run rank tracking or SERP checks through Startpage as a “clean” Google proxy, expect more failures. Startpage has said plainly it doesn’t want that traffic.
More on the smaller engines in our Global Search Engines archive.