TL;DR Bot Protection
Bot protection is the practice of identifying and blocking automated scripts and programs that access your website without permission. Not all bots are malicious but the ones that are can scrape your content, brute force your login page, consume your server resources, and distort your analytics. CloudSonic includes bot protection on every plan, filtering malicious traffic at the network level before it ever reaches your server. It works alongside our WAF to give your site multiple layers of automated threat defence, and it is smart enough to allow legitimate crawlers like Googlebot through without interruption.
How Bot Protection Works
Bot protection systems identify automated traffic by analysing patterns that distinguish bots from human visitors. These patterns include request frequency, the order in which page resources are loaded, mouse movement or its absence, browser fingerprinting, and whether the visitor's IP address or user agent appears on known threat lists. When a request matches bot behaviour it is either blocked outright, served a CAPTCHA challenge, or rate limited depending on the confidence of the detection and the severity of the threat. Legitimate bots like search engine crawlers are identified through verified user agent strings and allowed through automatically. The most sophisticated bot protection systems like the one included in Cloudflare Enterprise use machine learning trained on traffic patterns across millions of websites to continuously improve detection accuracy.
╭────────────────────────────────────────────────────╮
│ Local API Alerts │
├────────────────────────────────────────────┬───────┤
│ Reason │ Count │
├────────────────────────────────────────────┼───────┤
│ crowdsecurity/http-bad-user-agent │ 45 │
│ crowdsecurity/http-cve-2021-41773 │ 30 │
│ crowdsecurity/http-probing │ 29 │
│ crowdsecurity/CVE-2017-9841 │ 19 │
│ crowdsecurity/http-cve-2021-42013 │ 19 │
│ crowdsecurity/http-admin-interface-probing │ 10 │
│ crowdsecurity/http-open-proxy │ 10 │
│ crowdsecurity/nginx-req-limit-exceeded │ 6 │
│ crowdsecurity/http-sensitive-files │ 6 │
│ crowdsecurity/ssh-time-based-bf │ 5 │
│ crowdsecurity/ssh-bf │ 5 │
│ crowdsecurity/http-technology-probing │ 7 │
│ crowdsecurity/http-wordpress-scan │ 3 │
│ crowdsecurity/CVE-2022-41082 │ 2 │
│ crowdsecurity/ssh-time-based-bf_user-enum │ 2 │
│ crowdsecurity/http-crawl-non_statics │ 2 │
│ crowdsecurity/CVE-2019-18935 │ 1 │
│ crowdsecurity/ssh-slow-bf │ 4 │
╰────────────────────────────────────────────┴───────╯
╭────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Scenario Metrics │
├────────────────────────────────────────────┬───────────────┬───────────┬──────────────┬────────┬─────────┤
│ Scenario │ Current Count │ Overflows │ Instantiated │ Poured │ Expired │
├────────────────────────────────────────────┼───────────────┼───────────┼──────────────┼────────┼─────────┤
│ crowdsecurity/CVE-2017-9841 │ - │ 236 │ 236 │ - │ - │
│ crowdsecurity/http-bf-wordpress_bf │ - │ 331 │ 549 │ 2.27k │ 218 │
│ crowdsecurity/http-bad-user-agent │ - │ 213 │ 476 │ 692 │ 263 │
│ crowdsecurity/http-sensitive-files │ 1 │ 222 │ 477 │ 1.69k │ 254 │
│ crowdsecurity/http-probing │ 3 │ 202 │ 2.34k │ 6.39k │ 2.13k │
│ crowdsecurity/nginx-req-limit-exceeded │ - │ 347 │ 380 │ 2.18k │ 33 │
│ crowdsecurity/ssh-time-based-bf │ 15 │ 331 │ 1.82k │ 7.64k │ 1.48k │
│ crowdsecurity/ssh-bf │ - │ 7 │ 3.27k │ 7.64k │ 3.27k │
│ crowdsecurity/ssh-slow-bf │ 4 │ 111 │ 2.27k │ 7.64k │ 2.15k │
│ crowdsecurity/http-wordpress-scan │ - │ 71 │ 154 │ 379 │ 83 │
│ crowdsecurity/http-admin-interface-probing │ - │ 112 │ 211 │ 473 │ 99 │
│ crowdsecurity/http-cve-2021-41773 │ - │ 90 │ 90 │ - │ - │
│ crowdsecurity/http-cve-2021-42013 │ - │ 55 │ 55 │ - │ - │
│ crowdsecurity/http-open-proxy │ - │ 48 │ 48 │ - │ - │
╰────────────────────────────────────────────┴───────────────┴───────────┴──────────────┴────────┴─────────╯
