AWS WAF Bot Control and Fraud Prevention - Implementing Bot Mitigation and Account Takeover Protection
Detect scrapers and automation tools with Bot Control, and prevent credential stuffing with ATP. Includes user experience design for challenges and CAPTCHA.
What Is AWS WAF Bot Control?
AWS WAF Bot Control is a managed rule group that detects and manages bot traffic to your web applications. The Common level detects general bots (HTTP libraries, scrapers, security scanners), while the Targeted level detects sophisticated bots (browser-impersonating bots, distributed bots). Detected requests are labeled (e.g., awswaf:managed:aws:bot-control:bot:category:scraping_framework), and you can configure custom actions based on these labels. Bots that identify themselves and that Bot Control can verify, such as Googlebot, receive the verified-bot label (bot:verified); the rule group's default rules block only the bots they cannot verify, so normal search engine crawling is unaffected.
Account Takeover Prevention and Fraud Control
Account Takeover Prevention (ATP) monitors login pages and detects credential stuffing - brute-force attacks using lists of leaked credentials. ATP cross-references requests against a database of stolen credentials and blocks or presents a CAPTCHA when a match is found. With response inspection enabled (available for CloudFront distributions), it also tracks login success and failure responses and blocks subsequent requests from IP addresses and client sessions that show a high rate of failed login attempts. Account Creation Fraud Prevention (ACFP) monitors account creation pages and detects mass creation of fake accounts. It combines disposable email address detection, anomaly detection in creation patterns, and JavaScript challenges for browser verification to prevent fraudulent account creation.
Challenge and CAPTCHA Design
JavaScript challenges execute JavaScript in the client's browser to verify browser legitimacy. Automation tools (some Selenium and Puppeteer configurations) fail the challenge and their requests are blocked. CAPTCHA presents visual puzzles to users to confirm they are human. Since challenges and CAPTCHA affect user experience, carefully select which pages to apply them to. The recommended approach is to limit them to pages with high fraud risk - login pages, account creation pages, and checkout pages - and not apply them to general content pages. Configure challenge immunity time (the exemption period after a successful verification) to reduce the burden on legitimate users.
WAF Bot Control Pricing
As of August 2026, WAF base pricing is 5.00 USD per month per web ACL, 1.00 USD per month per rule, and 0.60 USD per 1 million requests. Bot Control adds a monthly subscription of 10.00 USD per web ACL plus usage-based request analysis fees: the Common level costs 1.00 USD per 1 million requests (the initial 10 million requests each month are free), and the Targeted level costs 10.00 USD per 1 million requests (the initial 1 million requests each month are free). ATP (Account Takeover Prevention) and ACFP (Account Creation Fraud Prevention) each add a monthly subscription of 10.00 USD per web ACL plus tiered analysis fees based on the number of attempts. Check the official AWS WAF pricing page for the tier breakdown. Because the Bot Control Targeted level is expensive, manage costs with a design that applies it only to pages with a high risk of fraud, such as login and checkout pages, and applies the Common level to general content pages.
Label-Based Rule Design
Bot Control adds labels to the requests it detects. A distinctive feature is that you can use these labels as cues to design flexible responses in subsequent rules. For example, you can apply graduated control, such as blocking traffic judged to come from scrapers and showing a challenge for traffic whose judgment is ambiguous. Right after deployment, rather than blocking immediately, it is safe to begin by watching how things go in count mode, which only performs detection. Observe what kinds of traffic are classified and how, and confirm that you are not mistakenly blocking legitimate users before switching to full blocking.
Rate Limiting and IP Reputation
Bot countermeasures work well when you layer multiple methods rather than relying on Bot Control alone. Rate-limiting rules, which restrict sources whose number of requests within a given period exceeds a threshold, curb brute-force attempts and excessive access. With a reputation list that compiles IP addresses with a poor reputation, you can block known malicious sources at the entrance. You can also combine controls by country or region to narrow traffic from regions where access is not expected. By using these together with label-based rules, you can build a defense network that deters bots and unauthorized access from multiple angles.
Deployment Steps and Tuning
If you put WAF rules into blocking mode right away, they risk catching even legitimate users. Begin by running them in count mode for a certain period and observe which rules react and how often. Analyze the logs, confirm that no false positives are included, and then switch rules to blocking in order, starting with those that show no problems. If you find legitimate traffic that is mistakenly rejected, allow it with an exception rule. Because challenges and CAPTCHA are a burden on users, limit them to pages with a high risk of fraud, such as login and checkout. Gradual tuning leads to both security and usability.
Combining with Other Defense Layers
WAF is a layer of defense, and combining it with other services increases its effectiveness. By placing it behind CloudFront, you can block threats at edge locations and prevent them from reaching the origin. To prepare for large-scale DDoS attacks, use a dedicated protection service as well. On the application side as well, strengthen authentication and perform anomaly detection to prepare for threats that slip past WAF. Building multiple layers of blocking at the entrance, verification in the application, and detection through monitoring results in robust protection that does not depend on a single measure. Position WAF as a part of that whole, and design it within the overall picture.
Summary
AWS WAF Bot Control, ATP, and ACFP are managed rules that protect web applications from bots and fraud. You adjust detection accuracy with flexible label-based rule evaluation, and you balance user experience and security with challenges and CAPTCHA. By integrating with CloudFront or API Gateway, you can block threats in front of your application.
References (Official AWS Documentation)
The specifications covered in this article are documented in the following primary sources: AWS WAF Bot Control rule group, which lists the rules and labels of the managed rule group; AWS WAF Bot Control components, which explains protection levels, dashboards, and scope-down statements; and the AWS WAF pricing page, which publishes subscription fees, per-request fees, and free tiers. When this article and the official documentation ever disagree, trust the official documentation - it is the authoritative source.