Home / Knowledge hub / Bot traffic
Knowledge hub
Bot traffic
Automated visitors that scrape, stuff credentials or buy stock before real customers.
What it means
Bot traffic is any visit to your site or API made by software rather than a person. Some is welcome: search engine crawlers, uptime monitors and partner integrations. Some is hostile: scripts that guess passwords, copy your catalogue, hold stock or probe your forms.
The difficulty is that a bot makes ordinary requests. Each one can be valid. It is the pattern, the speed and the intent that give it away, which is why simple blocklists catch only the least careful.
Why it matters
Hostile bots turn into direct costs: fraud losses, stolen accounts, stock bought out from under real buyers, higher hosting bills and analytics you cannot trust. Customers see slow pages, sold-out items and spam, and may not come back.
They also hide worse activity. A wave of automated sign-ups or login attempts can sit in the noise while a more careful attacker works. OWASP groups these under automated threats to web applications and gives them names such as credential stuffing, scraping and carding.
How it shows up
You meet bots on login pages, sign-up, checkout, search, price and product pages, and open APIs. Weak points include APIs that have no limits while the website does, mobile endpoints that skip the checks, and rules based only on the visitor's address, which attackers rotate freely.
Defence is layered: rate limits by account and behaviour, challenges when behaviour looks wrong, and a WAF or bot tool at the edge. Test from outside: script the endpoints you care about and see which controls stop the script and which do not.
Questions people ask
Bot traffic, answered
Is all bot traffic bad?
No. Search crawlers, monitors and integrations are useful bots. The aim is to let them through and stop the ones that abuse login, checkout and data endpoints.
How can I tell bots from people?
By behaviour: speed, request order, missing page loads, uniform timing, and many accounts from one device or network. No single signal is certain, so tools combine several.
Will a CAPTCHA solve it?
It helps against basic scripts. Paid solving services and human farms get past it, so treat it as one layer rather than the answer.
Do bots matter if I have little data to steal?
Yes. Bots abuse offers, inventory, sign-up credit and payment pages as well as data. A small business with a free trial or limited stock is a fine target.
How do we test our bot defences?
Write a simple script against each sensitive endpoint, including the API, and increase speed and volume. Note what blocks it, what only slows it, and what lets it carry on.
Sources
Where this comes from
Related
Terms that sit next to this one
Scraping
Automatically copying large amounts of data from your site or API.
Credential stuffing
Trying passwords leaked elsewhere, because people reuse them.
Fake account creation
Mass sign-ups by bots to abuse offers, spam users or farm rewards.
Inventory hoarding
Holding stock in carts or bookings so real buyers cannot get it.
API abuse
Using an API as designed but at a scale or in a way that harms you.
Which endpoints would a script reach?
We test whether automation controls hold on the endpoints that matter, including the API behind the page, and show the requests that got through. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.