Blocking Bad Bots

HEIMWALL assigns every request a bot score from 0 to 100: 0 means human, 100 means definite bot. The safe way to block bad bots is to watch the score distribution in monitor mode first, then move to enforcement gradually.

Know the scores and categories

• 0–49: likely human
• 50–69: ambiguous
• 70–89: suspicious
• 90–100: strong bot signal

The default threshold is 70. Verified bots (waf.client.bot == on) fall into 17 categories: search, seo, ai_crawler, ai_assistant, ai_search, advertising, social, monitoring, preview, feed, aggregator, archiver, security, accessibility, academic, webhook, other. Verified bots have a known identity (like Googlebot); the real threat is unverified bots hiding who they are.

Don't block search engines

Blocking verified bots in the search category drops your site out of search results. Always add an exemption rule above your bot blocking rules.

Step by step: monitor, then enforce

1. Under Console → WAF → [domain], open the Bot Score setting and set the mode to monitor. In this mode no request is blocked; scores are only recorded.

2. Watch the score distribution on the Analytics page for a few days. Heavy traffic in the 90–100 range means you are under bot pressure. Note which range your legitimate traffic clusters in.

3. Create the exemption rule first — Console → WAF → [domain] → Rules → New Rule:

   # Allow search and monitoring bots
   IF   waf.client.bot_category in search, monitoring
   THEN allow

4. Then add the block rule and drag it below the exemption:

   # Block requests with a strong bot signal
   IF   waf.bot_score ge 80
   THEN block

   Using captcha instead of block is safer at first: real users who get misscored can pass the challenge.

5. After a week, review the access logs and hit counters. If there are no false positives, you can lower the threshold (e.g. ge 70) or switch captcha to block. You can also set the Bot Score mode to enforce for centralized enforcement with js/captcha/block actions.

Additional recipes

# Challenge the ambiguous range with CAPTCHA
IF   waf.bot_score ge 50
AND  waf.bot_score lt 80
THEN captcha

# Block traffic from Tor exit nodes
IF   waf.client.tor == on
THEN block

# Challenge suspicious traffic behind VPNs
IF   waf.client.vpn == on
AND  waf.bot_score ge 60
THEN captcha

Only block VPN/Tor if your business model requires it; some legitimate users rely on VPNs for privacy.

Monitor first, enforce later

The bot score is a behavioral estimate, not a definitive identity. Starting straight with block can cost you real users. The order is always: monitor → captcha → block.

Verification

• On the Analytics page, check that blocked requests are increasing while legitimate traffic (e.g. conversions) is not dropping.
• Send a request with a simple bot signature like curl -A "BadBot/1.0" and confirm you receive a challenge or block.
• Verify in Google Search Console that crawl statistics remain normal.
• Review the hit counters on the Rules page weekly.

Related Pages

Bot ScoreScoring engine and the 17 bot categories

Bot BlockingSyntax reference and strategy