Web Security

Bot protection guides

Detection and application-layer defenses for automated abuse and malicious bots.

What these guides cover

Bot protection distinguishes approved automation from clients that use legitimate application features for fraud, scraping, spam, account takeover, inventory hoarding, or resource exhaustion. A bot is not defined only by its IP address or browser headers: sophisticated automation distributes activity across networks and accounts while preserving cookies and valid request schemas. Detection therefore correlates identity, network, device, behavioral, and business-outcome signals. Enforcement should protect the abused operation itself, use stable application identifiers where possible, and begin uncertain policies in dry-run mode so teams can measure legitimate-user impact before blocking traffic. Response design must account for attackers changing tactics after each enforcement step.

Risks

Credential stuffing and account enumeration
Scraping, fake accounts, spam, and promotion abuse
Inventory hoarding, carding, and workflow fraud
Distributed low-and-slow resource exhaustion

Control priorities

Correlated identity, network, device, and behavior signals
Operation-specific limits and workflow safeguards
Bot classification without replacing authorization
Dry-run tuning, false-positive review, and adaptation monitoring

Recommended reading order

Use the API abuse guide to classify the abused business operation, identify correlated signals, choose layered controls, and build an active-incident response. Follow its links to the API security and rate limiting guides for implementation detail.

Guides in this collection

AI agent bot management

Detect, classify, and apply policy to AI agents that hit logins, checkouts, scrapers, and APIs.

What Is API Abuse? How Bots Exploit APIs

API abuse is the automated or malicious use of valid API functionality in ways that create fraud, cost, disruption, or data loss.

How to identify AI agents and bots

Treat User-Agent as a claim, then verify with reverse DNS, public IP ranges, and application context.

Bot detection techniques for developers

Bot detection is classifying automated HTTP clients and enforcing a policy: allow a verified crawler, constrain a script, or deny abuse.

Is CAPTCHA still effective, and what should you use instead?

CAPTCHA is no longer an effective primary control.

What is bot spoofing and how do you detect it?

Bot spoofing is a client claiming to be a known, usually trusted, automated agent while actually being someone else.

How do you detect bots at the application layer?

Detect bots where route, user, and business context reveal scraping, credential stuffing, and abuse.

How to protect a React Hook Form from spam

Protect a React Hook Form by combining client and server validation, rate limiting, bot detection, and email verification.