Under Attack?
Start Free Trial
PRODUCTS / BOT MANAGEMENT

Bot management

Classify automated traffic, attach labels, and choose the right downstream action — allow, block, challenge, captcha, or log-only — without breaking the legitimate bots you depend on.
Start free trial
Request a demo
Traffic sorting

Detection first. Policy second.

Managed bot control labels automation by category so downstream WAF policies can decide how much friction each request deserves.
Allow
verified bots
Challenge
unknown automation
Captcha
high-risk flows

Managed bot control rules

A ready-to-enable managed bot control rule pack classifies automated traffic and attaches labels instead of blocking everything blindly. Each match can trigger allow, block, challenge, or captcha — you decide the policy downstream.
Managed rules are versioned and updated centrally. Override individual rule actions — allow verified search engines, challenge unknown automation, captcha suspicious scrapers — without losing upstream maintenance.

Rule pack behaviour

The pack identifies a wide variety of clients across search engines, AI agents, vulnerability scanners, CLI tools, headless browsers, scraping frameworks, monitoring bots, suspicious networks and credential-stuffing abuse.

Labels

Attach category and tool signals.

Actions

Allow, block, challenge or captcha.

The clients CrownWall can classify

The managed bot control rule pack recognises common automation categories and lets you tune the action per class.

Search engines

Googlebot, Bingbot, DuckDuckBot, and other crawlers that self-identify in User-Agent or via reverse DNS

LLM & AI agents

OpenAI crawlers, Claude/Anthropic bots, Perplexity, and other model-training or retrieval agents

Vulnerability scanners

Automated probes for known CVEs, exposed admin panels, default credentials, and misconfigurations

Coding & CLI tools

curl, wget, Python requests, Scrapy, Go/Java HTTP clients, Axios, Node fetch, and similar library clients

Automation & headless browsers

HeadlessChrome, Selenium, Playwright, Puppeteer, PhantomJS, and WebDriver stacks

Scraping frameworks

Content harvesters, price monitors, inventory bots, and data-extraction pipelines

Monitoring & uptime bots

Pingdom, UptimeRobot, and other verified service monitors (typically allowed by policy)

Hosting & suspicious networks

Traffic from datacenter ranges, proxy networks, and IP space commonly associated with abuse

Credential stuffing & abuse

High-volume login automation and scripted authentication against sensitive endpoints

Challenge and captcha actions

When bot control (or any WAF rule) matches suspicious traffic, you can respond with challenge or captcha instead of an immediate block. Both actions verify humans and real browsers while letting you tune friction by risk level.

Browser challenge

The challenge action serves a lightweight, silent browser interstitial. The client runs a short JavaScript attestation that checks browser consistency, automation signals, and optional proof-of-work. On success, CrownWall mints a time-limited session token and the original request resumes automatically — legitimate users typically notice nothing beyond a brief pause.

  • Best for: unknown automation, headless browsers, and first-time visitors from suspicious networks
  • Returning visitors with a valid token pass through without repeating the check (configurable immunity window)

Proof-of-work captcha

The captcha action presents CrownWall’s self-hosted proof-of-work captcha , with no third-party CAPTCHA SaaS or external tracking. The client solves a computational puzzle in the browser; verified users receive a session token with a separate, typically longer immunity period.

  • Best for: high-risk flows (login, checkout, account recovery), aggressive scrapers, and repeat offenders after a challenge fails
  • Privacy-oriented: puzzles run on your domain; no reCAPTCHA keys or external widget dependencies
  • Accessible UX: proof-of-work balances security with conversion — no image puzzles unless you add them later

Separate verification tokens

Challenge and captcha use separate token types — completing one does not automatically satisfy the other. Configure immunity times per domain so verified humans stay friction-free for the session length you choose.

Policy on top of detection

Detection is only half the story. Labels from bot control integrate with the wider WAF policy chain so you can choose different responses for different traffic classes.
Downstream rules can branch on labels such as bot:category:search_engine, bot:tool:curl, or targeted:signal:automated-browser without duplicating detection logic.

Allow

Verified search engines and monitoring bots by name or category.

Challenge

Unknown automation while leaving human browsers untouched.

Captcha

Borderline or high-risk categories like LLM scrapers and credential stuffing.

Block

Clearly malicious traffic outright.

Log only

Observe labels before enforcing while tuning the policy.

Unified verification flows

Bot challenges use the same token-gated interstitials as WAF challenge and captcha actions — one consistent experience whether the trigger was bot classification, a custom security rule, or a rate limit. Session tokens travel in a secure cookie; successful verification redirects the user back to their original URL with no manual retry.
Bot control
classification trigger
WAF rule
custom rule trigger
Rate limit
abuse trigger

Take back control of your traffic.

Start free trial
Request a demo