Bot management
Enable bot management to protect your services from automated threats such as data scraping, business fraud, credential stuffing, spam registration, malicious flash sales, and SMS API abuse. Configure targeted protection policies to prevent data leaks, mitigate marketing campaign risks, and reduce server load and bandwidth costs.
Agentic Bot will be officially launched on September 23, 2026. After this date, the legacy bot management feature will enter a maintenance period. Users of the legacy version can continue to use it without any impact on existing features. We recommend upgrading to Agentic Bot soon for more comprehensive protection. For more information, see [Notice] WAF bot management module upgrade.
You can identify your current version by navigating to in the left-side navigation pane and checking the page style:
New Agentic Bot | The sub-tabs under Bot Management are AI Insights, AI Crawler Management, Bot Management Template, Advanced Custom Rules, and Account Security. |
Legacy bot management | The sub-tabs under Bot Management are Traffic Analytics, AI Crawler Management, Bot Management Template, Advanced Custom Rules, and Account Security. |
Features
The bot management feature provides the following core capabilities to identify bot traffic and defend against crawler risks:
AI Insights/Traffic Analytics: Without enabling bot management, you can view risk data for interfaces, including information such as traffic trends and risky clients. This helps you quickly identify and locate potentially risky interfaces. After you activate the full version, you can view more detailed data. This helps security O&M personnel identify abnormal traffic and configure more fine-grained protection policies.
AI Crawler Control: Automated programs such as AI crawlers, intelligent agents, and search engines often scrape web content at high frequencies for model training, knowledge base construction, and AI application operations. AI crawler control accurately identifies and manages this type of traffic to protect your intellectual property and core business data while preventing excessive consumption of server bandwidth.
Web Protection/App Protection: For web or app scenarios, you can use default bot management protection policies to quickly enable basic protection. For optimal protection, continuously analyze rule hits and adjust protection actions.
Advanced Custom Rules: Create custom access control rules, rate limiting rules, and rule categories to block requests that match specific conditions. Advanced Custom Rules support a wider range of match conditions, such as client IDs, JA3/JA4 fingerprints, and signals collected by the Web/App SDK, along with condition-based deduplicated statistics.
Account Security: This feature uses intelligent algorithms to calculate risk scores in real time, accurately identifying and blocking malicious activities such as credential stuffing, brute-force attacks, and automated mass registrations. It can extract multi-dimensional identity credentials from the query, body, header, and cookie of HTTP requests to build a unified user profile. It automatically protects the core scenarios of account registration and login without manual configuration of complex rules.
Prerequisites
-
You have completed Web service provisioning on the Onboarding page.
You have activated a WAF 3.0 instance. The instance must be a pay-as-you-go edition, or a subscription Premium, Enterprise, or Ultimate edition. The Basic edition does not support bot management.
Activate bot management
-
Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.
-
In the navigation pane on the left, choose .
Start a trial
WAF instances of the Premium, Enterprise, and Ultimate editions support a 7-day Free Trial of the bot management feature. After the trial ends, the system clears your policy configurations. To retain your data from the trial period, activate the full version before the trial ends.
Go to the Bot Management Template or Advanced Custom Rules page and click Request a Free 7-Day POC.
In the 7-day Free Trial dialog box, click OK.
Each Alibaba Cloud account is eligible for only one bot management trial for Premium, Enterprise, or Ultimate edition instances.
The trial period is 7 days. After the trial ends, the system automatically deletes your bot policy configurations. To retain your data and continue using bot management, activate the full version before the trial ends.
Activate the full version
Subscription
On the Bot Management Template or Advanced Custom Rules page, click Purchase Now.
On the Purchase Now panel, enable Agentic Bot Management - Web or Agentic Bot Management - App as needed, and then complete the payment.
Pay-as-you-go
No separate activation is required. Creating a template on the Bot Management Template or Advanced Custom Rules page activates the feature.
After bot management is activated, additional fees apply. For pricing details, see Pay-as-you-go billing.
Get started
Traffic Analytics: Review traffic analytics data to identify at-risk assets and abnormal traffic sources in your environment.
AI crawler control: View an overview and detailed data for AI requests, and take action on the traffic with one click.
Web Protection/App Protection: Configure and enable protection rules based on your workload type: enable Web Protection for web and H5 pages; enable App Protection for native iOS or Android apps.
Advanced Custom Rules: For fine-grained protection, configure rules based on dimensions such as client IDs and JA3/JA4 fingerprints to precisely identify and handle bot traffic.
Deactivate bot management
Subscription
If you no longer need the bot management module, you can downgrade your instance to set the bot management feature to Off. For more information, see Upgrade or downgrade an instance.
Pay-as-you-go
If you no longer need the bot management module, delete all bot management Web/App protection templates and all advanced custom rule templates. Once they are deleted, billing for the bot management feature stops.
Protection mechanism
The following sequence diagrams illustrate how the JavaScript Validation and Token-based Authentication protection modes work and how WAF processes requests.
JavaScript Validation
The client sends a request that matches a rule configured with the JavaScript Validation action.
WAF returns an HTML page that contains the JavaScript challenge generation algorithm.
The browser loads the JavaScript challenge page, generates encrypted parameters, adds them to the cookie, and then resends the request.
WAF receives the request and verifies the parameters:
If the parameters are valid, WAF considers the request legitimate, forwards it to the origin server, and returns the origin's response to the client.
If the client does not include the cookie inserted by the JavaScript challenge or the cookie value is invalid, WAF considers the request to be from a script and returns the JavaScript challenge page again.
Token-based Authentication
The client sends a request that matches a rule configured with the Token-based Authentication action.
WAF returns an HTML page that contains a dynamic token to the client.
The browser loads the HTML page with the dynamic token, generates encrypted parameters, adds them to the request URL, and then resends the request.
WAF receives the request and verifies the parameters:
If the parameters are valid, WAF considers the request legitimate, forwards it to the origin server, and returns the origin's response to the client.
If the parameters are missing or invalid, WAF considers the request to be from a script and returns the dynamic token page again.