Quick Start

Reading time: About 9 minutes
Prerequisites: You have subscribed to the security product and completed hostname onboarding.

This document helps you complete hostname onboarding and initial security configuration as quickly as possible.

Initial Bot Policies for a Newly Onboarded Hostname

Steps

1. Log in to the console and go to the page for your subscribed security product.
2. Go to Security Settings > Policies.
3. On the Policies page, click + Protected Hostname.
4. Select the CDN acceleration product used by the hostname you want to protect, and then select the hostname from the list.
5. Select an initial policy. Two options are available — choose the one that fits your needs:

• Recommended Default Policies: A set of default configurations built by the system that provide out-of-the-box protection. You can test and fine-tune them as needed.
• Duplicate Policies from an Existing Hostname: Select an already-onboarded hostname as the reference. The newly onboarded hostname will use the same protection policies as the reference hostname.

Initial Bot Policies

If you use Recommended Default Policies, you can adjust the initial Bot policies before onboarding the hostname:

• AI Bots: Set to Log by default. You can block AI large-model crawlers with a single click.
• Public Bots: Set to Skip by default. You can allow or block public crawlers active on the internet — such as search engines, feed fetchers, and site monitors — with a single click.
• Definite Bots: Set to Log by default. You can block traffic with clear automated-tool characteristics with a single click.
• Likely Bots: Set to Log by default. You can apply a JavaScript Challenge, an Interactive Challenge, or a one-click block to traffic with abnormal behavior patterns that deviate from normal user characteristics.

Note: If your business receives traffic from your organization’s internal automation tools or from third-party vendor automation programs, you can manage this traffic after onboarding by defining Custom Bots characteristics.

Adjusting Bot Policies for an Onboarded Hostname

Steps

1. Log in to the console and go to the page for your subscribed security product.
2. Go to Security Settings > Policies.
3. Find the hostname whose policies you want to configure, and click Edit to open the Policies editing page.
4. Select the Bot Management tab. If the Bot Management master switch is off, turn it on.
5. Adjust the Bot policy configurations according to your use case.
6. After making changes, click Deploy at the bottom of the page to complete deployment (allow 1–3 minutes for the changes to take effect).

Use Cases

Scenario 1: Protecting Website Intellectual Property from AI Large-Model Crawlers

• If monitoring shows a large volume of AI Bots traffic on your website, you can set the action for the AI Bots policy to Deny to block this traffic and prevent issues such as copyrighted content theft and sensitive data leaks. Learn more.
• If you only need to block specific AI crawler tools, you can manage them individually using Custom Bots. Learn more.

Scenario 2: Managing Crawlers That Benefit Your Business

• If your website relies on traffic promotion and you want to increase organic traffic and exposure, you can use the Public Bots policy to allow crawlers that benefit your business, such as search engines and marketing analysis tools. Learn more.
• You can also use the Custom Bots policy to individually allow specific Public Bots. Learn more.

Scenario 3: Mitigating Automated Program Pressure on Website Access

• In the Definite Bots policy, you can block with a single click automated tools commonly used to launch malicious activity, including development frameworks, HTTP libraries, vulnerability scanners, crawler tools, proxy tools, and fake spiders. Learn more.
• In the Likely Bots policy, you can block with a single click, or apply a secondary challenge to, suspicious and abnormal requests that are highly likely to originate from malicious automated tools. Learn more.
• If your website does not rely on traffic promotion, you can also block Public Bots with a single click to reduce bandwidth pressure on your website. Learn more.

Scenario 4: Countering Black-and-Grey Market Activity to Further Mitigate Automated Program Pressure

If the general protection measures in Scenario 3 are no longer effective, you can take the following enhanced measures to mitigate automated attacks:

• Enable Web Bot Detection
  1. Check whether your website has any business other than Web/H5 pages. If it does, add the relevant traffic characteristics to the Bypass Traffic from Specific Clients list, so that enabling the Web Bot Detection policy does not affect normal access for this traffic.
  2. Enable the JavaScript-based Web enhanced protection scheme. Set the action for Web Bot Detection to Deny. Learn more.
  3. After confirming the configuration is correct, click Deploy at the bottom of the page, and then click Deploy Directly on the change confirmation page to apply the configuration.

Note: Before deploying to production, we recommend using Deploy > Pre-deployment Test at the bottom of the page to run a pre-deployment test, so you can verify the compatibility of the Web Bot Detection JS SDK with your website in advance.

• Enable Workflow Detection: This targets behavior that doesn’t follow normal business access logic — for example, an automated tool bypassing the page and launching a sustained attack directly against an API endpoint. Configure the Workflow Detection policy to strengthen protection and block behavior that violates normal business access logic. Learn more.