Bot Deception

To prevent bot deception, you can configure the insertion of a link into HTML-type response pages. For regular clients, the link remains invisible, while for malicious bots, such as web crawlers, the bots may attempt to request the resource that the invisible link points to, revealing their behavior.

Configure bot deception

1. Navigate to WAF> Application > Bot Mitigation > Bot Deception.
   You must have already enabled this module in Add Modules. See Add and Remove Modules.
2. For Deception URL, specify the deception URL to be inserted in the HTML response page, which can be either an absolute path or a relative path.

   • This Deception URL should not point to a real, existing page on your server. It should be a nonexistent or fake path that no normal user would ever click or see.

3. Click +Create Rule to enter the literal URL, such as /index.php, or a regular expression, such as ^/*.php that the HTTP request must contain in order to match the rule. Multiple URLs are supported.
4. Click OK.
5. Select the action that FortiAppSec Cloud takes when it detects a violation of the rule from the top right corner.
   

   Alert	Accept the request and generate a log message.
   Alert & Deny	Block the request (or reset the connection) and generate a log message.
   Deny(no log)	Block the request (or reset the connection).
   Period Block	Block the current request. Moreover, all the subsequent requests from the same client in the next 10 minutes will also be blocked.

6. Click SAVE.

Configure Exception Policy

Exclude specific parameters or URLs from bot mitigation scans. This is useful when certain elements are known to trigger false positives during normal operations.

For more details, please refer to Exception Policy.