AWS WAF Bot Control and Fraud Prevention - Implementing Bot Mitigation and Account Takeover Protection
Detect scrapers and automation tools with Bot Control, and prevent credential stuffing with ATP. Includes user experience design for challenges and CAPTCHA.
Bot Control Overview
AWS WAF Bot Control is a managed rule group that detects and manages bot traffic to your web applications. The Common level detects general bots (HTTP libraries, scrapers, security scanners), while the Targeted level detects sophisticated bots (browser-impersonating bots, distributed bots). Detected requests are labeled (e.g., awswaf:managed:aws:bot-control:bot:category:scraping_framework), and you can configure custom actions based on these labels. Search engine crawlers (such as Googlebot) are automatically included in the allow list, so there is no impact on SEO.
Account Takeover Prevention and Fraud Control
Account Takeover Prevention (ATP) monitors login pages and detects credential stuffing - brute-force attacks using lists of leaked credentials. ATP cross-references requests against a database of stolen credentials and blocks or presents a CAPTCHA when a match is found. It also analyzes login success/failure patterns and automatically rate-limits IP addresses with abnormal failure rates. Account Creation Fraud Prevention (ACFP) monitors account creation pages and detects mass creation of fake accounts. It combines disposable email address detection, anomaly detection in creation patterns, and JavaScript challenges for browser verification to prevent fraudulent account creation.
Challenge and CAPTCHA Design
JavaScript challenges execute JavaScript in the client's browser to verify browser legitimacy. Automation tools (some Selenium and Puppeteer configurations) fail the challenge and their requests are blocked. CAPTCHA presents visual puzzles to users to confirm they are human. Since challenges and CAPTCHA affect user experience, carefully select which pages to apply them to. The recommended approach is to limit them to pages with high fraud risk - login pages, account creation pages, and checkout pages - and not apply them to general content pages. Configure challenge immunity time (the exemption period after a successful verification) to reduce the burden on legitimate users. For more detailed coverage of bot mitigation, related books on Amazon are also available.
WAF Bot Control Pricing
WAF base pricing is approximately $5.00 per month per Web ACL, approximately $1.00 per month per rule, and approximately $0.60 per million requests. Bot Control Common level adds approximately $1.00 per million requests, and the Targeted level adds approximately $10.00. ATP (Account Takeover Prevention) costs approximately $1.00 per 1,000 login attempts, and ACFP costs approximately $2.00 per 1,000 account creation attempts. Since the Bot Control Targeted level is expensive, apply it only to high-risk pages like login and checkout pages, and use the Common level for general content pages to manage costs.
Summary
AWS WAF Bot Control, ATP, and ACFP are managed rules that protect web applications from bots and fraud. Label-based flexible rule evaluation lets you fine-tune detection accuracy, while challenges and CAPTCHA balance user experience with security. Integrate with CloudFront or API Gateway to block threats at the edge, before they reach your application.