Bot
A bot is automated software running tasks at scale — from benign search indexing to malicious credential stuffing, scraping, DDoS and account takeover.
Stop Malicious Bots
Protect your platform with intelligent bot detection
What is a Bot?
A bot is a program that performs tasks over a network without a person driving each action. That is the whole definition, and it covers both the crawler that indexes your site for search and the script trying stolen passwords against your login form.
The word carries no moral weight, which is why "bot traffic" as a single metric is close to useless. Roughly half the traffic on the open web is automated, and a substantial share of it is traffic you want.
Automation you want
| Bot | What it does for you |
|---|---|
| Search crawlers | Index your pages so people can find them |
| AI assistants | Fetch your page to answer somebody's question, and cite you |
| Uptime monitors | Tell you the site is down before a customer does |
| Payment and webhook callers | Deliver the events your integrations depend on |
| Partner integrations | Your customers' own automation against your API |
| Accessibility and link checkers | Find problems before users do |
Blocking any of these is a self-inflicted injury, and the last two rows are where blanket bot blocking most often causes an incident nobody connects to the cause.
Automation to stop
| Bot | What it takes |
|---|---|
| Credential stuffers | Working logins from breached password lists |
| Scalpers | Limited stock, before customers can reach it |
| Scrapers | Pricing, catalogue and content at no cost |
| Spam bots | Distribution through your forms and comments |
| Card testers | Confirmation of which stolen cards are live |
| Click fraud bots | Your advertising budget |
Telling them apart
Three approaches, in descending order of reliability.
Verification by published IP ranges works for the major crawlers and is the only reliable way to confirm one. Google, OpenAI, Perplexity and others publish the addresses their crawlers use; a request claiming to be GPTBot from an address outside OpenAI's published ranges is not GPTBot. Impersonating a well-known crawler is one of the most common techniques there is, and user-agent strings settle nothing.
Coherence catches automation that is not trying to impersonate anyone — a client whose claimed browser contradicts its observable capabilities. See device fingerprinting.
Behaviour catches the rest, by asking whether a person was plausibly present. See behavioural analysis.
The emerging hard case
An AI agent acting for a real customer breaks the usual framing. It is automated by every classic test, and there is a person who asked for the task and will pay for the outcome. Treating it as a bot blocks a customer; treating it as a human removes your protection against anything wearing the same clothes.
The workable answer is to stop judging the client and start requiring evidence at the steps where money moves — which is the argument set out in our piece on agentic browsers, and increasingly the direction the standards work is taking with signed agents.