Enter the Application ID assigned to your FortiGuard ABP Application.

The Application ID is used to bind this Advanced Bot Protection policy to the FortiGuard ABP Application.

To obtain the ID, go to Application page of FortiGuard ABP, click the Settings icon in the Action column, then click Copy Application ID.

Select which action FortiWeb will take when FortiGuard ABP suggests a request is from a bot:

• alert—Accept the connection and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert and/or log message.
• deny_no_log—Block the request (or reset the connection).
• block-period—Block subsequent requests from the client for a number of seconds.
• block-period-client—Block a malicious or suspicious client based on the FortiWeb generated client ID. This is useful when the source IP of a certain client keeps changing. This option takes effect only when you enable Client Management in the Server Policy.

block-period <content-scraping-block-period_int>

Enter the number of seconds that you want to block subsequent requests from an IP or client ID after FortiWeb detects content scraping activities. The valid range is 1–3,600 seconds.

Available only if action {alert | deny_no_log | alert_deny | block-period | block-period-client} is set to block-period and block-period-client.

{High | Medium | Low | Info}

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when FortiGuard ABP suggests a request is from a bot:

• Informative
• Low
• Medium
• High

trigger <trigger-policy_name>

Select the trigger, if any, that FortiWeb will use when it logs and/or sends an alert email when FortiGuard ABP suggests a request is from a bot. For details, see Viewing log messages.

exception {exception-policy-id}

Select the exception policy which specifies the elements to be exempted from the FortiGuard ABP scan.

bot-confirmation {enable | disble}

Enable to confirm if the client is indeed a bot. The system sends RBE (Real Browser Enforcement) JavaScript or CAPTCHA to the client to double check if it's a bot.

bot-recognition {captcha-enforcement | recaptcha-enforcement}

• captcha-enforcement — Requires the client to successfully fulfill a CAPTCHA request. CAPTCHA verification will not pop out for the bot confirmation again for the same user within 10 mins timeout.

• recaptcha-enforcement— Requires the client to successfully fulfill a reCAPTCHA request.

recaptcha <recaptcha_server_name>

Enter the reCAPTCHA server you have created through user recaptcha-user

bot-confirmation-max-attempt-times <int>

If captcha-enforcement is selected for bot-recognition, enter the maximum number of attempts that a client may attempt to fulfill a CAPTCHA request.