Bot protection covers controls that separate unwanted automation from ordinary visitors and make large scale scripted abuse more expensive to keep running.
It is the defensive layer, distinct from the traffic being classified and distinct from the pool of devices that may produce that traffic.
How it works
Good protection starts by deciding which automation you want, such as accessibility tools, uptime checks, and known indexers, and which actions you refuse or slow.
Login, account creation, checkout, and password reset usually deserve more care than a public article page.
Signals can include rate, behavior, reputation, and a proof that the client spent computation, and no single signal should be the whole policy.
Operators should watch false challenges, because a control that blocks real customers is a business failure even when the scripts also struggle.
Concrete examples
- A retailer adds stronger checks on checkout during a sale while leaving the catalog easy to read for people and for a known indexer.
- A bank steps up login protection when many sessions fail the first secret and share a similar automated rhythm.
- An accessibility tool that a customer needs is allowlisted so the same controls that slow a script do not lock out that person.
Protective measures
- Decide which automated clients are welcome, document them, and apply stricter controls only to the actions that create loss.
- Measure how often real customers fail a challenge, and tune the control when that number is higher than you can accept.
- Combine rate, behavior, and computation cost instead of trusting one list of addresses to carry the whole defense.
- Review protection after each major campaign so attackers who adapted do not face last month's unchanged rule forever.
How CDPCaptcha helps
Browser proof of work raises the cost of unwanted automation by forcing each scripted client to spend computation before it can continue a session.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.