Bot Behavior Management
Bot Behavior Management is a security module for identifying, classifying, and controlling automated program access behaviors. It effectively blocks malicious bots such as scrapers, API abusers, credential stuffing, and abuse bots, while allowing friendly bots (e.g., search engines) and legitimate automation tools, balancing security and business openness.
Application Scenarios
- Content Protection & Anti-Scraping
News portals, e-commerce platforms, and online education sites often face malicious crawling of their web pages or data, which may be illegally reproduced or analyzed. - API Abuse Prevention
Open platforms, mobile apps, and public APIs are prone to automated abuse when not properly restricted, leading to resource exhaustion or service degradation. - Malicious Account Behavior Mitigation
Features like registration, login, voting, commenting, and coupon claiming are common targets for bots engaging in bulk actions such as coupon hoarding or vote manipulation. - Friendly Bots for SEO Optimization
While websites aim to allow legitimate bots (e.g., search engine crawlers) for better exposure, they also want to avoid misidentifying or blocking them as malicious.
Existing Bot type description
| Bot Risk Types | Bot Type | Description |
|---|---|---|
| Legitimate Bots | Search Engine Bots | Bots used to index web content for improving search engine crawling and ranking. |
| Partner Bots | Automated access programs from partner systems for business integration or data synchronization. | |
| Monitoring Bots | Auto-detection tools used to monitor website availability, performance, or health status. | |
| Aggregator Bots | Crawlers that collect content from multiple websites and display it on third-party platforms. | |
| Social Network Bots | Automated programs used to crawl or publish content on social media platforms. | |
| Ad Network Bots | Bots used for ad tracking, performance evaluation, or bidding systems. | |
| Backlink Checker Bots | Tools that detect whether a site is being linked or referenced by other websites. | |
| IDC Data Bots | Bots originating from IDC and telecom data centers, often used for data collection or analysis. | |
| Proxy Pool IP Bots | Bots using proxy IP pools to bypass access restrictions or perform large-scale scraping. | |
| Public Egress Bots | Requests from NAT-shared or public egress IPs provided by ISPs, with unclear identity. | |
| Malicious Bots | Malicious UA Bots | Bots using forged or abnormal User-Agent headers, often exhibiting suspicious behavior. |
| Spoofed Search Engine Bots | Malicious programs impersonating legitimate search engines to evade protection rules. | |
| IP Reputation Blacklist Bots | Bots originating from IPs flagged as malicious or low-reputation by threat intelligence sources. | |
| Botnet Bots | Automated traffic from compromised devices controlled by hackers, often used for attacks or scraping. | |
| Onion Routing (Tor) | Access via the Tor network to hide real IP addresses, commonly used for anonymous or evasive actions. |
Operation Guide
Log in to the Security CDN Console.
In the left navigation pane, go to Security and click Web Security to enter the Global Security Policy page.
On the Global Security Policy page, scroll down to locate the Bot Protection – Bot Behavior Management module.
In the configuration dropdown at the top right corner, select ON, and adjust protection strategies based on the corresponding Bot Types.
After configuration, click Save to apply the Bot Behavior Management strategy for the Global Security Policy.
Need help? Contact our support team at support@edgenext.com.
Back to documentation home