Bot Protection
Barracuda WAF-as-a-Service detects bots and web scrapers and protects against automated attacks carried out by malicious bots. Bots with malicious intent such as stealing data, installing viruses and malware to your website, hijacking your bandwidth, submitting junk data through online forms, etc. can have an adverse impact on the performance and reputation of a company’s website. While these bots should be blocked, it is important that known good bots such as search engine crawler bots and SEO bots are allowed to crawl your web application.
Accuracy and False Positive Reduction
Bot Protection includes multiple mechanisms to minimize false positives for legitimate traffic:
API Client Recognition - Authenticated API clients are recognized and exempted from browser-specific detection checks that could incorrectly penalize non-browser traffic.
CDN-Aware Scoring - Traffic routed through major CDN providers, such as Cloudflare, Fastly, and Akamai, is automatically recognized using IP intelligence feeds and does not require customer configuration. CDN hop IP addresses are classified separately to prevent them from increasing risk scores.
Crawler Verification - Known search engine and AI crawlers are verified using DNS and network validation. Transient verification failures are handled gracefully instead of misclassifying legitimate crawlers.
Graduated Thresholds - Risk scores use multiple severity tiers instead of a binary good-or-bad classification, allowing proportional responses to different confidence levels.
IPv6 Support - IP classification and reputation services support IPv6 and IPv4 addresses.
Performance and Resilience
The bot detection pipeline is designed for high throughput and graceful degradation:
In-Process Caching - Frequently accessed reference data is cached in process, reducing latency in the scoring path.
Circuit Breaker Protection - Sustained backend infrastructure issues are automatically detected. The scoring path short-circuits to safe defaults instead of accumulating timeouts.
Non-Blocking Scoring - The real-time scoring API processes requests without blocking threads on external service calls.
Fail-Open Design - During degraded conditions, bot scoring returns safe defaults so legitimate traffic is not blocked due to infrastructure issues. The system automatically recovers when backend services resume, and degradation events are logged for operational visibility.
IP Intelligence Feeds - IP reputation data is sourced from authoritative published feeds for major cloud providers and threat intelligence sources, with automated refresh schedules.
Detection Capabilities
When Enable Advanced Bot Protection is set to ON, all detection layers are enabled automatically and do not require additional configuration. Each layer runs independently and contributes to the overall composite risk score.
Header Analysis - Evaluates request headers against known attack patterns to identify automated tools.
TLS Fingerprinting - Compares TLS handshake characteristics against known automated client profiles.
Browser Integrity Verification - Validates client-side signals to detect headless browsers and automation frameworks, even when the User-Agent string appears legitimate.
Behavioral Pattern Detection - Analyzes device-level request patterns, such as request rate, path diversity, and referrer behavior, to distinguish automated traffic from human traffic.
URL-Aware Scoring - Applies context-aware risk evaluation to requests for sensitive URL categories, including authentication, account management, financial, and administrative endpoints.
User-Agent Analysis - Detects known bot signatures, anomalous or missing User-Agent strings, and crawler impersonation.
WAF Signal History - Uses prior Web Application Firewall rule matches for the same device or session.
These detection layers work together to generate a composite risk score.
To configure thresholds, see the Risk Scores page. To manage AI crawler policies, see the AI Crawlers page.
The Bot Protection component includes the following sections:
Dashboard
Use the Dashboard page to enable bot protection and view details about unique clients, unique IP addresses, and the geographic distribution of incoming traffic. The dashboard also provides AI crawler-specific analytics, including traffic trends, per-crawler breakdowns with company attribution, and allow/block ratios across your protected applications. For detailed information, see Application-Specific ABP Details.
Set Enable Advanced Bot Protection to ON to enforce the specified bot detection checks on the incoming traffic.
Bot Attacks
Set Referrer Spam to ON to protect your application against automated attacks carried out by bots.
Bot Detection
In the Bot Detection page, configure honeypots to detect a bad bot and prevent it from crawling your website.
Honeypots
Honeypot is a security mechanism that creates a virtual trap to lure bad bots crawling your website with malicious intent. When honeypots are enabled, the Barracuda WAF-as-a-Service adds deceptive elements to your application to track the behavior of bots. The tracked information is shared with the Barracuda Active Threat Intelligence (ATI) for analysis. Based on the analysis, the traffic from a bot is allowed or blocked.
Configuring Honeypots
Insert hidden links in response - When enabled, the Barracuda WAF-as-a-Service embeds a hidden link in the response. The embedded link does not get displayed on the browser, so a human browsing the web pages through a common browser never sees and clicks the hidden link. Therefore, any request that attempts to access the hidden link is identified as an automated bot or scraper.
Insert disallowed URLs in robots.txt – Typically, every website includes a “/robots.txt” file that provides access instructions such as the user agents that are allowed to access the website, and the web pages that are allowed/disallowed to be accessed by bots.
Example:
User-agent: *
Disallow: /researchtools/abc/
Here, User-agent: Asterisk (*) is a wildcard character and indicates that this website can be accessed by all bots, and Disallow: /researchtools/abc/ indicates that the bots are not allowed to access the /researchtools/abc/ page on the website.
When Insert disallowed URLs in robots.txt is enabled, Barracuda WAF-as-a-Service inserts an encrypted URL under Disallow in the robotos.txt file. Any request that attempts to access the URL specified under Disallow is identified as a bad bot.Insert delay in robots.txt – You can slow down the requests from a bot to a web application by setting the delay time (in seconds) between subsequent requests, so that server resources are not consumed and are accessible for legitimate traffic.
When Insert delay in robots.txt is enabled, the Barracuda WAF-as-a-Service inserts “crawl-delay” in the robots.txt file with the specified Delay Time. All good bots should honor the delay time specified in the robots.txt file while accessing the web application. If not, it is identified as a bad bot.
Client Challenges
Enable Client Challenges to validate clients connecting to your application with CAPTCHA challenges to find out if a client is a regular browser, a bot, or a crawler. If the client does not solve the challenge within the specified attempts, it is identified as a bad bot and added to the Block List.
Configuring Client Challenges
Enable – Set to ON to enforce client challenges to clients attempting to access your application.
Enforce CAPTCHA – Select the enforce CAPTCHA option (Suspicious Clients Only or All Clients).
Suspicious Clients Only - CAPTCHA is enforced for clients that exhibit suspicious behavior.
All Clients - CAPTCHA is enforced on all clients accessing the application.
Max CAPTCHA Attempts – Specify the number of attempts a client can make before failing to solve the CAPTCHA.
Max Unanswered CAPTCHA – Specify the number of CAPTCHA instances that can be issued to a client IP address. This prevents an attacker from executing a DoS attack on the application by rendering CAPTCHA images without submitting the CAPTCHA response.
Expiration Time – Specify the number of seconds a client IP can be idle before being challenged for CAPTCHA again.
Predefined Bots
Barracuda’s bot database contains over 10,000 known bots. All bots are categorized based on their behavior and moved to a predefined category. You can block specific bots from accessing your application under Blocked Bots and add specific bots to access your application under the Allowed Bots section.
Blocked Bots
Select the check boxes next to the predefined categories to block the bots of that category from accessing your application. Any request from these bots is blocked without being challenged.