Bot traffic
Understand how Easel identifies and handles automated clients.
Automated traffic includes legitimate crawlers, monitoring systems, integrations, scrapers, scanners, and abusive bots.
A user-agent string alone cannot reliably prove a bot’s identity.
Verified bots
A verified bot is an automated client whose identity has been validated using stronger evidence than a user-agent claim.
Easel may verify bots using:
- Published IP ranges
- Forward and reverse DNS
- Cryptographic request signatures (Web Bot Auth)
Examples include major search crawlers and selected service bots. The verified set can change as providers update their infrastructure.
Attack Mode bypass
When Attack Mode is on and Allow verified bots is enabled, verified bots may skip the browser challenge so search indexing and approved integrations can continue.
Verified-bot bypass applies to Attack Mode only. It does not:
- Skip custom Deny, Redirect, or Challenge rules
- Skip deployment protection
- Skip platform protections
You can still block a verified bot with an explicit custom rule. Arbitrary clients cannot claim verified status by forging a user agent.
Customer controls
Use custom firewall rules to:
- Block a specific path for unwanted crawlers
- Challenge unverified automation
- Bypass Attack Mode for monitoring IPs
- Deny known abusive sources
Prefer IP, ASN, path, and verified-bot behavior over fragile user-agent matching when stronger signals are available.
AI crawlers
Some AI crawlers appear in the verified-bot registry when their identity can be validated. Others are unverified.
Blocking by user agent alone is easy to evade. Combine path restrictions, authentication, and Attack Mode or custom challenges when you need stronger controls.
Application visibility
Bot classification is used during edge security evaluation and may appear in security observability. Do not rely on a client-supplied bot identity header as proof of verification.
For application-level bot detection in frameworks that support it, use BotID in your application code. BotID opaque verification paths are excluded from the Attack Mode interstitial so the SDK can complete its flow.