AI agent bot management
AI agent bot management detects, classifies, and applies policy to AI agents that hit your logins, checkouts, forms, and APIs as clients, not the agents your engineers run.
Read guideWeb Security
Bot protection guides
Detection and application-layer defenses for automated abuse and malicious bots.
What these guides cover
Bot protection distinguishes approved automation from clients that use legitimate application features for fraud, scraping, spam, account takeover, inventory hoarding, or resource exhaustion. A bot is not defined only by its IP address or browser headers: sophisticated automation distributes activity across networks and accounts while preserving cookies and valid request schemas. Detection therefore correlates identity, network, device, behavioral, and business-outcome signals. Enforcement should protect the abused operation itself, use stable application identifiers where possible, and begin uncertain policies in dry-run mode so teams can measure legitimate-user impact before blocking traffic. Response design must account for attackers changing tactics after each enforcement step.
Risks
- Credential stuffing and account enumeration
- Scraping, fake accounts, spam, and promotion abuse
- Inventory hoarding, carding, and workflow fraud
- Distributed low-and-slow resource exhaustion
Control priorities
- Correlated identity, network, device, and behavior signals
- Operation-specific limits and workflow safeguards
- Bot classification without replacing authorization
- Dry-run tuning, false-positive review, and adaptation monitoring
Recommended reading order
Use the API abuse guide to classify the abused business operation, identify correlated signals, choose layered controls, and build an active-incident response. Follow its links to the API security and rate limiting guides for implementation detail.
Guides in this collection
What Is API Abuse? How Bots Exploit APIs
API abuse explained: how bots automate valid operations for fraud, scraping, account takeover, and cost exhaustion, and how application controls stop them.
Read guideHow to identify AI agents and bots
Identify AI agents and bots by treating User-Agent as a claim, then verifying with reverse DNS, published IPs, or HTTP message signatures.
Read guideBot detection techniques for developers
Bot detection techniques for developers: layer User-Agent checks, verification, IP reputation, fingerprints, rate limits, and optional challenges.
Read guideIs CAPTCHA still effective, and what should you use instead?
CAPTCHA is no longer an effective primary control. Compare alternatives: adaptive rate limiting, identity-aware quotas, and behavioral bot detection.
Read guideWhat is bot spoofing and how do you detect it?
What bot spoofing is and how to detect it: verify allowlisted crawlers with reverse DNS and published IPs, then deny impersonators with isSpoofedBot.
Read guideHow do you detect bots at the application layer?
Detect bots at the application layer, where route, user, and business context reveal scraping, credential stuffing, and AI-scripted abuse.
Read guideHow to protect a React Hook Form from spam
Protect a React Hook Form from spam with shared Zod validation, rate limits, bot detection, and email checks using protectSignup on the submit route.
Read guide