Anti-Bot Challenge Rules | Check Point WAF

Overview

Anti-Bot rules allow you to Detect, Challenge, or Prevent traffic that matches specific criteria in order to mitigate automated abuse such as:

• Credential stuffing
• Brute-force attacks
• Account enumeration
• Bot Driven DDoS

Action Modes

• Detect – Logs matching traffic only.
  Recommended first step to validate impact before enforcement.

• Challenge (captcha) – Requires the client to pass a browser challenge before access is granted.
  Use to stop automation while allowing legitimate users.

• Prevent – Blocks matching requests.
  Use after validation or during active attacks.

Best practice: Start with Detect, then move to Challenge

How to Configure Anti Bot Rules

Add Rules

1. Navigate to Anti-Bot Tab → Challenge Rules SubPractice → Add Rule

2. Select the desired Action (Detect, Challenge, or Prevent).

3. Enter the target URI (e.g., /login).

4. (Optional) Add Additional Conditions to narrow the scope.
   You may choose one of the following:

   • Source Identifier
   • Source IP
   • URI
   • Country Code
   • Country Name

5. Save the rule.

Add a Captcha Challenge

1. Navigate to the "Behaviors" Tab and create a new captcha object

2. Configure the Captcha object that will be used when a rule triggers a challenge:

   • Name: Enter a friendly name for the Captcha object, or keep the default.
   • Captcha Type: Select the challenge mechanism. (Currently set by default to Proof of Work .)
   • TTL: The time-to-live (in minutes) for the successful challenge. During this period, the user will not be required to complete a new challenge.
   • Message Title (optional): The title shown on the challenge HTML page presented to the end user.
   • Message Body (optional): The text displayed on the challenge HTML page presented to the end user.

Example of a page challenge page displayed to the user

1. Connect the Captcha object to the practice:

2. Enforce policy.