Docs

Web Application Firewall

Configure protection policy

Configure Bot management policies

Bot management helps you monitor or restrict traffic from common automation tools, such as search engines, speed testing tools, content aggregators, scanning tools, etc., supporting the use of managed Bot management rules or custom Bot management rules. You can also configure frequency limits and statistical protection rules to prevent malicious access behaviors that meet statistical characteristics. In addition, the WAF can intelligently generate behavior maps based on already discovered and confirmed API requests, helping you analyze and manage risk APIs.

Note

Bot intelligent management (including Bot frequency limits, Bot statistical protection rules, and Bot behavior maps) is currently only available for enterprise edition and above, and requires payment of corresponding feature activation fees, QPS package additional fees, and elastic QPS additional fees once enabled. For detailed billing instructions, please refer to Additional functions.

Requirements

You have connected the website that needs to be protected to the WAF instance. For related operations, please refer to Comparison of website association methods.

Enable dynamic tokens

Dynamic tokens serve as a measure to enhance security, ensuring that only verified users can access protected applications or information. After enabling dynamic tokens, the client needs to provide a temporary code generated by the dynamic token when requesting access to complete authentication. If a request does not carry a dynamic token, it will be handled as "observe" or "intercept" according to the set action.

warning

Dynamic tokens only support web applications built on HTML and JavaScript, and are not suitable for native apps, mini-program platforms, and inter-server API communication. Please ensure your web application is within the scope of use.

Select the instance region in the top menu bar.

In the left navigation, select Protection Policy > Bot Management.

Click Dynamic Token and enable the dynamic token feature.

Configure the dynamic token parameters.

Parameter	Description	Example
Validity period	It refers to the validity period of the dynamic token. After the time limit, the token information becomes invalid, and validation will not be possible.	60
Detection path	Fill in the website path to be tested, which can be a specific page path or all paths under the entire website. Match specific path: A specific page path, for example, if you need to test access to test.com/test.html, you can simply fill in the path information after the domain name /test.html. Match all paths under the directory: UseCan match all paths, andMust be at the end of the path. To match all paths under the entire website, simply fill in /. To match all paths under a specific directory, usein the corresponding directory path. For example, /test/* indicates matching all paths under the /test/ directory. warning /test//abc.html and /test/ both indicate matching all paths under the /test/ directory.	/test.html
Execute action	Observe: Allow the traffic to pass through, but report the request behavior to the attack log. Intercept: Intercept the request traffic and report the request behavior to the attack log. If a custom interception response page is configured, WAF will return the configured interception response page information to the client side. JS challenge: Validate the client-side JavaScript execution capability through the JS-SDK. If the validation is passed, it will be released within the specified time. Man-machine verification: Man-machine verification is carried out through the verification code. If the verification is passed, it will be released to prevent false sealing.	Observe

Select managed bot classification rules

Managed bot classification means executing actions and rule switches according to the system's default Bot types to control traffic from different Bots.

In the top menu bar, select the region of your instance.

In the left navigation, select Protection Policy > Bot Management.

Enable the classification rules for hosting bots for the domains that require protection.

Select the domain that needs to add a policy.

(Optional) Confirm that the protection mode of the current domain is "Protection enabled". Otherwise, click Change protection mode to modify it.

Turn on the policy switch.

Set the bot hosting configuration in the hosted bot list.

Set the execution actions.

Observe: Allow the traffic to pass through, but record the behavior in the attack log.

Intercept: Intercept the request traffic and report the request behavior to the attack log. If a custom interception response page is configured, WAF will return the configured interception response page information to the client side.

JS Challenge: Verify the client-side JavaScript execution capability through the JS-SDK. If the verification is passed, it will be released within the specified time.

Man-machine verification: Man-machine verification is carried out through the verification code. If the verification is passed, it will be released to prevent false sealing.

Proof of Work: The client is required to calculate and submit results through the JS-SDK. If the verification is passed, it will be released within the specified time.

warning

Man-machine verification, JS challenge, and proof-of-work action configuration only support web applications built on HTML and JavaScript. They are not applicable to native apps, mini-program platforms, and server-to-server API communication. Please ensure that your web application is within the scope of use.

Release: Directly release the request traffic that meets the conditions.

Enable or disable a single rule switch.

Enable: The corresponding actions will be taken for this type of Bot traffic.

Disable: This type of Bot traffic will be released.

Configure custom Bot classification rules

To manage custom Bots based on protocol characteristics in the request, such as request method and request path.

Select the region of your instance in the top menu bar.

Select Protection Policy > Bot Management from the left navigation.

Enable the custom classification rules feature for the domain to be protected.

Select the domain that needs to add the policy.

(Optional) Confirm that the protection mode of the current domain is "Protection enabled". Otherwise, you need to click Change protection mode to modify it.

Turn on the policy switch.

Click Add Rule to configure the custom Bot management rule parameters.

Parameter	Description	Example
Rule name	Protection rule name. tip Start with a letter or digit. Allowed characters include letters, digits, periods (.), underscores (_), and hyphens (-). The length must be between 1 and 128 characters.	Bot_1
Rule description	Fill in relevant remarks, such as what function this Bot is used to implement.	Intercept POST requests from public IP clients
Action	Observe: Allow the traffic to pass through, but record the behavior in the attack log. Block: Block the traffic and report the behavior in the attack log. If a custom interception response page is configured, WAF will return the configured interception response page information to the client side. JS challenge: Verify the client's JavaScript execution capability through JS-SDK. If the verification passes, it will be released within the specified time. Man-machine verification: Man-machine verification is carried out through the verification code. If the verification is passed, it will be released to prevent false sealing. Proof of work: The client is required to compute and submit results through JS-SDK. If the verification passes, it will be released within the specified time. warning Man-machine verification, JS challenge, and proof of work actions are configured to support only website applications built on HTML and JavaScript, and are not applicable to native apps, mini-program platforms, and inter-server API communication. Please ensure that your website application is within the scope of use. Release: Directly release request traffic that meets the conditions.	Block
Enable	Turn on or off the current rule.	Keep it enabled
Custom Bot Features	Set other matching fields, logical operators, and matching content features. For instructions related to matching fields and logical operators, please refer to Advanced Condition Configuration Instructions.	Request method Equal to POST Client IP Judged as public IP Request body length Greater than 1000

Click OK to complete the rule configuration.

After the configuration is complete, you can view the rule information in the custom Bot classification rule list, and perform actions such as enabling/disabling, editing, and deleting rules.

Configure Bot frequency limit rule

It is used to restrict the access frequency of traffic under specific conditions. During the statistical period, when the access count and total access count of each statistical object reach the set threshold, traffic throttling, interception, or other actions will be executed for requests that meet the request characteristics.

In the top menu bar, select the region of your instance.

In the left navigation, select Protection Policy > Bot Management.

Enable the frequency limit rule function for the domain that needs protection.

Select the domain where the policy needs to be added.

(Optional) Confirm that the protection mode of the current domain is "Protection enabled". Otherwise, click Change protection mode to modify it.

Turn on the policy switch.

Click Add rules to configure the frequency limit rule parameters.

Parameter	Description	Example
Basic Features
Rule name	Protection rule name. tip Start with a letter or digit. Allow letters, numbers, Chinese characters, a period ".", an underscore "_", and a hyphen "-". The length must be between 1 and 128 characters.	Bot Protection_1
Rule conditions
Feature description	Request path: Fill in the website path that needs protection, which can be a specific page path or all paths under the entire website. Match specific path: A specific page path. For example, if you need to intercept access to test.com/test.html, you can directly fill in the path information after the domain name /test.html. Match all paths under the directory: UseIt can match all paths, andMust be at the end of the path. To match all paths under the entire site, just fill in /. To match all paths under a specific directory, use it in the corresponding directory path.Done. For example, /test/* indicates matching all paths under the /test/ directory. warning /test//abc.html and /test/ both indicate matching all paths under the /test/ directory. Add condition: Set other matching fields, logical symbols, and matching content. For details on matching fields and logical symbols, please refer to Advanced Condition Configuration Instructions. The request path and Add Condition have a AND relationship, meaning that the rule can only be triggered when both the request path and the added conditions are met. Multiple Request Path Matching: If you want the rule to take effect for multiple request paths, first configure the main request path to match all paths under the directory, then add matching fields as conditions for the request path. For example, to configure /test/123.html and /test/abc.jpg, you can refer to the operations below: Set the request path to /test/*. Add 2 conditions: Condition 1: Request path equals /test/123.html Condition 2: Request path equals /test/abc.jpg The relationship between the two conditions is set to or.	/test.html
Statistical object	Select the statistics object that needs to be matched by the rule and fill in the configuration information. Support custom header, custom cookie, custom parameters and source IP four types. tip To use fields in cookies as statistical objects, you need to select custom cookies and configure field information. It is not supported to use the entire cookie as a statistical object. Custom header: Fill in the header, the first letter of each word needs to be capitalized, such as User-Agent, Cookie, X-Forwarded-For. Custom cookies: support filling in English, numbers, - and _. Custom parameters: Support filling in English, numbers, - and _. Source IP: A single access IP is used as a statistical object.	Custom Header: User-Agent
Statistical Content	Access frequency: the number of times each object initiates a request within the statistical duration, and the number of times requests are made to each request path. When the number of times the statistical object initiates a request and the total number of requests made to the request path exceed the set threshold, the system processes the request of the statistical object according to a preset execution action.	Within 60 seconds, if each object visits over 100 times, and the request path visits over 1000 times
Execute action	Observe: Allow the traffic to pass through, but report request behavior to the attack log. Speed Limit: Limit the access rate to this request. tip For example, set a limit where within a statistical period of 60 seconds, the maximum number of accesses from each source IP is 1000 times, and the total access count is 10000 times for the speed limit action to be implemented. Thus, within 60 seconds, if a certain source IP reaches 1000 accesses and the total access count for that path reaches 10000, all subsequent requests will be intercepted. To avoid impacting your business, please set the speed limit conditions carefully. Block: Block the traffic and report the behavior in the attack log. If a custom interception response page is configured, WAF will return the configured interception response page information to the client side. JS challenge: Verify the client's JavaScript execution capability through the JS-SDK. If the verification passes, the request will be released within the specified time. Man-machine verification: Man-machine verification is carried out through the verification code. If the verification is passed, it will be released to prevent false sealing. Proof of work: Calculate and submit results via the JS-SDK as required by the client. If the validation passes, access will be granted within the specified time. warning Human verification, JS challenge, and proof of work action configuration only support web applications built on HTML and JavaScript. They are not applicable to native apps, mini-program platforms, and server-to-server API communication. Please ensure that your web application is within the scope of use. Discard: Discard request traffic and report request behavior to the attack log.	After human verification is successful, do not hit this action again within 60 seconds.
Time limit	The effective duration of the execution action.	180
Effective configuration
Priority	The priority of rule matching, P0 has the highest priority and P9 has the lowest priority. The priority of rules under the same request characteristics cannot be duplicated.	P0
Enable	Turn the current rule on or off, default is enabled.	Keep it enabled

Click OK to complete the rule configuration.

After the configuration is complete, you can view rule information in the frequency limit rule list, and perform operations such as rule enable/disable, editing, and deleting.

Configuration of statistical protection rules

Bot statistical protection rules are used to count the repeated occurrences or the proportion of IPs of statistical objects that meet request characteristics within a specific period. When the statistical content reaches the set threshold, actions such as observation, interception, human verification, or other actions will be executed on requests that meet the request characteristics.

In the top menu bar, select the region of your instance.

In the left navigation, select Protection Policy > Bot Management.

Enable the statistical protection rule function for the domain that needs protection.

Select the domain to which you need to add the policy.

(Optional) Confirm that the protection mode of the current domain is "Protection enabled". Otherwise, click Change protection mode to modify it.

Turn on the policy enable switch.

Click Add to configure the statistical protection rule parameters.

Parameter	Description	Example
Basic information
Rule name	Protection rule name. tip Start with a letter or digit. Allowed characters include letters, digits, periods (.), underscores (_), and hyphens (-). The length must be between 1 and 128 characters.	Bot Protection_1
Rule Conditions
Feature Description	Request path: Fill in the path of the website that needs protection, which can be a specific page path or all paths under the entire website. Match specific path: A specific page path. For example, if you need to intercept access to test.com/test.html, just fill in the path information /test.html after the domain name. Match all paths under a directory: UseYou can match all paths, andit must be at the end of the path. To match all paths under the entire website, fill in /. To match all paths under a specific directory, use it in the corresponding directory path.That's all. For example, /test/* means matching all paths under the /test/ directory. warning /test//abc.html and /test/ both indicate matching all paths under the /test/ directory. Add Condition: Set other matching fields, logical operators, and matching content. For details related to matching fields and logical operators, please refer to Advanced Condition Configuration Instructions. The relationship between the request path and Add Condition is AND, meaning that the rule can only be triggered when both the request path and add condition are satisfied. Multiple Request Path Matching: If you need the rule to apply to multiple request paths, configure the main request path to include all paths under the directory, and then add matching fields as conditions for the request path. For example, if you need to configure /test/123.html and /test/abc.jpg, refer to the following operations: Set Request Path to /test/*. Add 2 conditions: Condition 1: Request Path equals /test/123.html Condition 2: Request Path equals /test/abc.jpg Set the relationship between both conditions to OR.	/test.html
Statistical object	Select the statistics object that needs to be matched by the rule and fill in the configuration information. Support custom header, custom cookie, custom parameters and source IP four types. tip To use fields in cookies as statistical objects, you need to select custom cookies and configure field information. It is not supported to use the entire cookie as a statistical object. Custom header: Fill in the header, the first letter of each word needs to be capitalized, such as User-Agent, Cookie, X-Forwarded-For. Custom cookies: support filling in English, numbers, - and _. Custom parameters: Support filling in English, numbers, - and _. Source IP: A single access IP is used as a statistical object.	Custom Header: User-Agent
Statistical content	Repeat count: the number of IPs with the same statistical object among the requests initiated during the statistical duration, for example, the number of source IPs with the same User-Agent. Repeat proportion: the percentage of the number of IPs with the same statistical object among the requests initiated during the statistical duration relative to the total number of source IPs, with the count exceeding a specified threshold.	Duplicate ratio: In 60 seconds, if the ratio of the same IP within each object exceeds 50%, and the number is greater than 20
Execute action	Observe: Release request traffic, but report request behavior to the attack log. Intercept: Intercept request traffic and report request behavior to the attack log. If a custom interception response page is configured, WAF will return the configured interception response page information to the client side. Man-machine verification: Man-machine verification is carried out through the verification code. If the verification is passed, it will be released to prevent false sealing. JS challenge: Through JS-SDK, verify the JavaScript execution capability of the client. If the verification is passed, it will be released within the specified time. Proof of work: Through JS-SDK, require the client to compute and submit the results. If the verification is passed, it will be released within the specified time. warning Man-machine verification, JS challenges, and proof of work actions are only supported for website applications built on HTML and JavaScript, and do not apply to native apps, mini-program platforms, and server-to-server API communications. Please ensure that your website application is within the scope of use. Discard: Discard the request traffic and report the request behavior to the attack log.	After man-machine verification is successful, the action will no longer hit within 60 seconds.
Time limit	The effective duration of the execution action.	180
Effective configuration
Priority	The priority of rule matching, P0 has the highest priority and P9 has the lowest priority. The rule priority under the same request feature cannot be duplicated.	P0
Enable	Turn on or off the current rule, default is on.	Keep it enabled

Click OK to complete the rule configuration.

After configuration is complete, you can view the rule information in the statistical protection rule list and perform actions such as rule disable/enable, edit, and delete.

Enable behavior mapping

The Bot behavior map refers to the WAF's intelligent tracking and analysis of discovered and confirmed API access behaviors and corresponding traffic based on domain name dimensions, providing a visual queue graph. You can set the default handling action for the queue, which means executing observation, interception, JS challenge, or CAPTCHA verification actions for API request behaviors in the queue.

Steps are as follows:

Select the instance region in the top menu bar.

In the left navigation, select Protection Policy > Bot Management.

Enable the behavior map policy for the domain to be protected.

Select the domain to which the policy needs to be added.

(Optional) Confirm that the protection mode of the current domain is "Protection enabled". Otherwise, click Change protection mode to modify it.

Turn on the policy switch.

Set actions for the behavior map policy.

Observe: Allow the traffic to pass through, but record the behavior in the attack log.

Intercept: Intercept the request traffic and report the request behavior to the attack log. If a custom interception response page is configured, WAF will return the configured interception response page information to the client side.

Man-machine verification: Man-machine verification is carried out through the verification code. If the verification is passed, it will be released to prevent false sealing.

JS challenge: Verify the client's JavaScript execution capability through the JS-SDK. If the verification is passed, it will be released.

Behavior map user guide

1: Clicking on the name of the action queue in the list on the left side of the behavior map allows you to view the ID of that action queue, the number of hits, the number of abnormal behaviors, API request path information, and more. Supports setting disposal actions and time limits based on the behavior queue. For example, when the user activity sequence meets the queue shown in the diagram, set a CAPTCHA action that is effective for 60 seconds, with a limit duration of 120 seconds. This means that access is allowed within 60 seconds after passing verification, and detection continues after 60 seconds; if not passed, access will only be allowed after 120 seconds.

2: When you click the name of the action queue in the left list of the behavior map, the queue diagram corresponding to it will be displayed on the right side, including the accessed domain names and corresponding API nodes.

3: Clicking on the nodes in the queue diagram allows you to view the API request path and the queue associated with that node.

Last updated: 2025.06.30 16:22:21