Enter the Application ID assigned to your FortiGuard ABP Application.

The Application ID is used to bind this Advanced Bot Protection policy to the FortiGuard ABP Application.

To obtain the ID, go to Application page of FortiGuard ABP, click the Settings icon in the Action column, then click Copy Application ID.

Select which action FortiWeb will take when FortiGuard ABP suggests a request is from a bot:

• alert—Accept the connection and generate an alert email and/or log message.
• alert_deny—Block the request (or reset the connection) and generate an alert and/or log message.
• deny_no_log—Block the request (or reset the connection).
• block-period—Block subsequent requests from the client for a number of seconds.
• block-period-client—Block a malicious or suspicious client based on the FortiWeb generated client ID. This is useful when the source IP of a certain client keeps changing. This option takes effect only when you enable Client Management in the Server Policy.

block-period <content-scraping-block-period_int>

Enter the number of seconds that you want to block subsequent requests from an IP or client ID after FortiWeb detects content scraping activities. The valid range is 1–3,600 seconds.

Available only if action {alert | deny_no_log | alert_deny | block-period | block-period-client} is set to block-period and block-period-client.

{High | Medium | Low | Info}

When policy violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiWeb will use when FortiGuard ABP suggests a request is from a bot:

• Informative
• Low
• Medium
• High

trigger <trigger-policy_name>

Select the trigger, if any, that FortiWeb will use when it logs and/or sends an alert email when FortiGuard ABP suggests a request is from a bot. For details, see "Viewing log messages" on page 1.

exception {exception-policy-id}

Select the exception policy which specifies the elements to be exempted from the FortiGuard ABP scan.

bot-confirmation {enable | disble}

Enable to confirm if the client is indeed a bot. The system sends RBE (Real Browser Enforcement) JavaScript or CAPTCHA to the client to double check if it's a bot.

bot-recognition {captcha-enforcement | captcha-puzzle-enforcement | recaptcha-enforcement | recaptcha-v3-enforcement}

• captcha-enforcement — Requires the client to successfully fulfill a CAPTCHA request. CAPTCHA verification will not pop out for the bot confirmation again for the same user within 10 mins timeout.

• captcha-puzzle-enforcement—Presents an interactive image-based puzzle challenge to the user. This method is resistant to headless browsers and scripted bots, and is suitable for high-security scenarios where traditional challenges are easily bypassed. If the client cannot successfully fulfill the request within the bot-confirmation-max-attempt-times <int>, or doesn't fulfill the request within the validation-timeout <validation-timeout_int>, FortiWeb applies the action.
  When selected:
  • FortiWeb intercepts the request and serves a visual CAPTCHA that requires drag-and-drop interaction before allowing access to the backend.
  • The original backend response is cached by FortiWeb and only delivered after the user successfully completes the challenge.
  • No customization of the puzzle or replacement message is currently supported.

• recaptcha-enforcement— Requires the client to successfully fulfill a reCAPTCHA request.

• recaptcha-v3-enforcement: Requires the client to successfully fulfill a reCAPTCHA v3 request. If the client cannot successfully fulfill the request within the Validation Timeout, FortiWeb applies the Action and sends the reCAPTCHA block page. For details, see "Customizing error and authentication pages (replacement messages)" in FortiWeb Administration Guide.
  You can set the threshold of the reCAPTCHA v3 score through CLI

  config system recaptcha-api

  set recaptcha-v3-score-threshold <string> *The value range is 0 to 1

  end

recaptcha <recaptcha_server_name>

Enter the reCAPTCHA server you have created through user recaptcha-user

bot-confirmation-max-attempt-times <int>

If captcha-enforcement or captcha-puzzle-enforcement is selected for bot-recognition, enter the maximum number of attempts that a client may attempt to fulfill a CAPTCHA/Puzzle CAPTCHA request.