Share This Post

Learning about bot detection and protection, also known as bot mitigation, often comes in the heat of the moment. Automated bots have attacked your website and mobile applications, creating abnormal traffic patterns that are eating away at your resources. In these crisis moments, who has time to thoughtfully review the constantly changing bot mitigation options and sophisticated threats?

To help get you up to speed—and quick—we’ve put together your one-stop-shop for all things bots. In this series of posts, we’ll cover the definitions you need to know to talk bots and sound smart doing it.

We’ll start slow and cover the basics in case you are brand new to bot mitigation, plus cover some common protections that you might already have in place.


A bot may sounds like a miniature robot, but in reality it is a software application or script that is programmed and automated to follow an instruction set, making repetitive tasks much faster. A good example is a script or program that can type and input credentials like user name and password many thousands of times per second for a specific website  login.

Block Bad Bots

Many vendors use the term “block bad bots,” but what do they really mean? It’s the process of detecting and preventing unwanted bad bots from visiting a website or application. Blocking bots is done to prevent fraud, credential stuffing and account takeover, and other forms of automated attacks, but blocking bad bots is not always a good thing to do since it gives input to attackers that you identified, and they will often retool their attack. It is best to mitigate bots as we will describe below.

Bot Mitigation

On the internet there are “good” bots and “bad” bots. The good we need for things like search engine optimization (SEO)—they are the ones that search the internet and return results. But the bad use up resources by visiting websites with bad intent to commit fraud. Bot mitigation works to identify and stop the unwanted and malicious traffic by sorting out the good from bad and then taking action to stop the bad bots without giving them to much information. Mitigation means you take action to divert the bot from your site or manage them so they cannot penetrate your defenses.

Bot Traffic Detection

Cybersecurity tools used to find bots within website traffic.

Online Data Theft or Breach Data

The act of stealing a victim’s information located on technology such as databases, web servers, computers, and devices with the intent of compromising accounts or obtaining confidential or personally identifiable information (PII).

Bot Mitigation Technology Definitions

Certificate-Based Authentication

Using a digital certificate to identify a user, device, or machine before granting access to a network, application, resource, etc.

Digital Certificate

Also known as a public key certificate, a digital certificate is used to cryptographically connect the ownership of a public key with the entity that owns it.

Bot Fingerprinting

Create identifiable signatures for bots using information from supporting software, device, network and other internet related infrastructure components.

SQL Injection Attack

An attack vector that uses malicious SQL code for backend database manipulation to access information like sensitive company data or private user data, that was not intended to be displayed.

Cross-Site Scripting (XSS)

XSS flaws occur whenever an application includes untrusted data in a new webpage without proper validation or escaping, or updates an existing webpage with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface websites, or redirect the user to malicious sites.

Web Application Firewall (WAF)

A web application firewall (WAF) applies a set of rules to an HTTP conversation and to protect against common attacks such as cross-site scripting (XSS) and SQL Injection. As defined by the Open Web Application Security Project (OWASP), a non-profit focused on improving software security, WAFs are designed to protect websites from attacks that network firewalls and intrusion detection systems can’t. Unfortunately WAF is not very effective at stopping bots and about 50% of today’s bot traffic will easily bypass WAF solutions. To stop advanced bot tools and automation a true bot mitigation solution is needed to have effective protection from automated tools.

Ready for more? Next up we’ll cover the most common types of attacks that fraudsters use to exploit your business. Be sure to follow us on LinkedIn so that you don’t miss any of our upcoming content.

Subscribe To Our Newsletter

Get updates and learn from the best

More To Explore