Manage Likely Bots
Last update：2026-08-21 17:47:12
Reading time: About 5 minutes
Prerequisites: The hostname has been onboarded, and the Bot Management master switch is enabled.
Navigation Path: Security Settings > Policies > [Target Hostname] > Bot Management > Likely Bots
What Is Likely Bots
Likely Bots refers to covert automated programs that mimic human visitors while attempting to commit business fraud (such as order fraud, coupon hoarding, or flash-sale scalping) or data theft (such as scraping pricing, content, or user information).
Detection Logic
When the Likely Bots policy is enabled (Log, Deny, JavaScript Challenge, Interactive Challenge), the system uses a heuristic detection + machine learning engine to evaluate requests across multiple dimensions, calculates a composite score based on the weight of each dimension, and outputs a Bot Score and Bot Tags.
- Bot Score: Every request that undergoes Bot detection is assigned a unique score — the higher the score, the more likely the traffic is a bot. For details, see the Bot Score section under Related References.
- Bot Tags: Provides additional information about why a given Bot Score was assigned, to support further analysis and traceability. For details, see the Bot Tags section under Related References.
Requests with a score in the 80–99 range are flagged as Likely Bots, indicating a high probability of automated (bot) access.
Note: For this category of already-confirmed suspicious traffic (validated extensively against network-wide traffic), the system supports enabling automated protection policies — for example, automatically triggering verification (such as an interactive challenge) or denying the request outright — to effectively defend against automated threats and reduce your operational burden.
Traffic scoring below this range is more likely to come from genuine human users. To avoid impacting normal business operations and user experience, the system does not automatically apply strict measures such as blocking to this traffic, but continues to monitor it.
Detection Dimensions
- IP Intelligence: Cloud provider IPs, proxy IPs, threat-intelligence risk IPs, and more.
- User-Agent: Outdated browser or OS versions, mismatches between the request header and the client type declared in the User-Agent, forged User-Agent strings, and more.
- TLS Fingerprint: Tool fingerprints, HTTP library fingerprints, browser fingerprint detection, and more.
- Request Header Characteristics: Completeness of browser request headers, abnormal keywords, and more.
- Group Behavior Characteristics: Detection of abnormal clustered behavior associated with black-and-grey market activity, including patterns across IPs, User-Agents, fingerprints, and access paths.
Configuration Steps
- Log in to the console and go to the subscribed security product page.
- Go to Protection Settings > Policies.
- Select the hostname you want to configure, click Edit, and go to the Policies editing page.
- Select the Bot Management tab. If the Bot Management master switch is off, turn it on.
- Locate the Likely Bots policy and set the action directly, choosing from Not Used, Log, Deny, JavaScript Challenge, or Interactive Challenge.
- After changing the configuration, click Deploy at the bottom to deploy the configuration (takes 1–3 minutes to take effect).
Action Descriptions
| Action | Description |
|---|---|
| Not Used | The request is not evaluated by this policy, but still passes through other detection modules. |
| Log | The system only logs this type of request; the request is still forwarded normally. |
| Deny | The system blocks the request and returns a 403 response. |
| JavaScript Challenge | The system returns a JavaScript challenge page that automatically checks whether the client is running in a real browser environment rather than an automated tool. The user waits a few seconds for the challenge to complete, and upon success is automatically redirected to the originally requested resource. |
| Interactive Challenge | The system returns an interactive CAPTCHA page. The client must select a checkbox to complete verification; once verification succeeds, the policy restriction is lifted. |
Protection Recommendations
- Initial configuration: We recommend setting the action to Log first. After running for a few days, review the attack logs to assess the proportion of Likely Bots traffic and its business impact before deciding whether to switch to Deny or a challenge action.
- Balancing user experience: We recommend JavaScript Challenge. The challenge completes automatically with no user interaction required — the user only waits a few seconds before being allowed through.
- High security requirements: We recommend Interactive Challenge. Visitors must actively complete a checkbox action on the page for strong verification, and are only allowed through once verification succeeds.
- Maximum protection: To completely block malicious crawlers and scripts with no exceptions, you can set the action directly to Deny, preventing black-and-grey market operators from bypassing challenges of any kind (this may produce a small number of false positives — use only if that trade-off is acceptable).