Bot Score Engine

Go to Console → WAF → [your domain] → Protection. HEIMWALL scores every request 0–100 across 17 categories; set a threshold and action for each score range.

What HEIMWALL does automatically

For every incoming request, HEIMWALL calculates a bot score automatically — no rules required. The engine estimates whether a request comes from a real browser or an automated tool using passive signals: TLS fingerprint consistency, missing or unusual HTTP headers, and behavioural infrastructure signals.

The score ranges from 0 to 100: near 0 means “likely human”, near 100 means “strong bot signal”. The score is calculated and written to logs for every request even if you take no action.

Monitor and Enforce modes

The bot score engine runs in two modes:

Mode	What it does
Monitor	Score is calculated and logged; traffic is not affected. Use this first to calibrate your threshold with real data.
Enforce	Requests scoring above the threshold receive the action you selected (JS Challenge, CAPTCHA, or Block).

Tip

On a new site, collect a few days of data in Monitor mode first. Once you can see which score range your legitimate traffic clusters in, switch to Enforce.

Calibration — Score Distribution

The Calibration section on the Protection page shows the last 24 hours of score distribution across four groups:

Group	Range	Interpretation
Likely human	0–49	Real users cluster here
Grey zone	50–69	Ambiguous; some automation tools land here
Suspicious	70–89	Bot behaviour clearly present
Strong bot signal	90–100	High-confidence bot

Percentiles (p50, p90, p99) are also shown. For example, if p90 = 25, then 90 % of your traffic scores below 25 — a threshold of 70 is very safe. If p90 = 65, there is a significant volume of ambiguous traffic and you should choose your threshold carefully.

The score range below the current threshold is colour-coded in the panel; as you move the slider you can see in real time which traffic would be affected.

Note

The default threshold is 70. A lower threshold is more aggressive and increases the risk of false positives; 70 is the recommended starting point.

17 bot categories

Every request is classified into one or more of 17 categories:

• search — Search engine crawler (Googlebot, Bingbot, Apple, Yandex)
• seo — SEO and link analysis tool
• ai_crawler — AI training and content crawler
• ai_assistant — AI assistant integration (ChatGPT, Perplexity)
• ai_search — AI-powered search engine bot
• advertising — Advertising and ad verification bot
• social — Social media crawler (Facebook, Twitter, LinkedIn)
• monitoring — Monitoring and uptime bot
• preview — Link preview generator (Slack, Telegram, iMessage)
• feed — RSS and Atom feed reader
• aggregator — Content aggregator and news bot
• archiver — Web archiver (Internet Archive, Common Crawl)
• security — Security scanner and researcher
• accessibility — Accessibility checker
• academic — Academic and research crawler
• webhook — Webhook and integration tester
• other — Other verified automated client

Score-based thresholds

Use the bot score field in any rule condition. A common three-tier setup:

• Score 0–20: pass (likely human)
• Score 21–60: challenge (verify with browser check)
• Score 61–100: block

For examples of how to use these fields in the rule engine: Bot Blocking →