Routing glossary
What Bot Filtering Can Determine About a Visit
Bot filtering evaluates whether request behavior resembles automation and applies a defined action without assuming every unusual client is malicious.
Bots cover many legitimate and unwanted clients
Search crawlers, link preview services, uptime monitors, security scanners, browser automation, and abusive scripts can all generate non-human requests. A useful policy distinguishes the operational concern instead of placing every automated client into one undifferentiated group.
Classification uses imperfect evidence
User-agent tokens, execution capabilities, request headers, network ownership, interaction history, and known-address data can contribute to a decision. Each signal has gaps or spoofing risk, which is why corroboration and visible decision reasons are important.
The action should match the purpose
A detected client might be logged, rate limited, denied, or routed to a conservative page depending on the system and policy. Classification and response should remain separate so operators can change handling without redefining what the evidence means.
False positives are an expected risk
Privacy browsers, accessibility tools, corporate gateways, and uncommon devices can resemble automation in isolated fields. Allowlisting known integrations and reviewing near-threshold cases reduces collateral impact while keeping high-confidence controls intact.
Test with labeled fixtures and live review
Exercise known browser sessions, approved automated clients, obvious scripted requests, and ambiguous cases before release. After launch, sample events by reason and outcome to catch drift when user agents, networks, or campaign sources change.