### Overview

Anti-Bot rules allow you to **Detect, Challenge, or Prevent** traffic that matches specific criteria in order to mitigate automated abuse such as:

- Credential stuffing
- Brute-force attacks
- Account enumeration
- Bot Driven DDoS

#### Action Modes

- **Detect** – Logs matching traffic only.  
_Recommended first step to validate impact before enforcement._

- **Challenge (captcha)** – Requires the client to pass a browser challenge before access is granted.  
Use to stop automation while allowing legitimate users.

- **Prevent** – Blocks matching requests.  
Use after validation or during active attacks.

**Best practice:** Start with **Detect**, then move to **Challenge**

### How to Configure Anti Bot Rules

#### Add Rules

1. Navigate to **Anti-Bot Tab → Challenge Rules SubPractice → Add Rule**

2. Select the desired **Action** (Detect, Challenge, or Prevent).

3. Enter the target **URI** (e.g., `/login`).

4. (Optional) Add **Additional Conditions** to narrow the scope.  
You may choose one of the following:
   - Source Identifier
   - Source IP
   - URI
   - Country Code
   - Country Name

5. Save the rule.

#### Add a Captcha Challenge

1. Navigate to the "Behaviors" Tab and create a new captcha object

2. Configure the Captcha object that will be used when a rule triggers a challenge:
   - **Name**: Enter a friendly name for the Captcha object, or keep the default.
   - **Captcha Type**: Select the challenge mechanism. _(Currently set by default to_ _**Proof of Work**_ _.)_
   - **TTL**: The time-to-live (in minutes) for the successful challenge. During this period, the user will not be required to complete a new challenge.
   - **Message Title (optional)**: The title shown on the challenge HTML page presented to the end user.
   - **Message Body (optional)**: The text displayed on the challenge HTML page presented to the end user.

Example of a page challenge page displayed to the user

1. Connect the Captcha object to the practice:

1. Enforce policy.