AWS WAF Bot Control and Fraud Prevention - Implementing Bot Mitigation and Account Takeover Protection
Detect scrapers and automation tools with Bot Control, and prevent credential stuffing with ATP. Includes user experience design for challenges and CAPTCHA.
What Is AWS WAF Bot Control?
AWS WAF Bot Control is a managed rule group that detects and manages bot traffic to your web applications. The Common level detects general bots (HTTP libraries, scrapers, security scanners), while the Targeted level detects sophisticated bots (browser-impersonating bots, distributed bots). Detected requests are labeled (e.g., awswaf:managed:aws:bot-control:bot:category:scraping_framework), and you can configure custom actions based on these labels. Bots that identify themselves and that Bot Control can verify, such as Googlebot, receive the verified-bot label (bot:verified); the rule group's default rules block only the bots they cannot verify, so normal search engine crawling is unaffected.
Account Takeover Prevention and Fraud Control
Account Takeover Prevention (ATP) monitors login pages and detects credential stuffing - brute-force attacks using lists of leaked credentials. ATP cross-references requests against a database of stolen credentials and blocks or presents a CAPTCHA when a match is found. With response inspection enabled (available for CloudFront distributions), it also tracks login success and failure responses and blocks subsequent requests from IP addresses and client sessions that show a high rate of failed login attempts. Account Creation Fraud Prevention (ACFP) monitors account creation pages and detects mass creation of fake accounts. It combines disposable email address detection, anomaly detection in creation patterns, and JavaScript challenges for browser verification to prevent fraudulent account creation.
Challenge and CAPTCHA Design
JavaScript challenges execute JavaScript in the client's browser to verify browser legitimacy. Automation tools (some Selenium and Puppeteer configurations) fail the challenge and their requests are blocked. CAPTCHA presents visual puzzles to users to confirm they are human. Since challenges and CAPTCHA affect user experience, carefully select which pages to apply them to. The recommended approach is to limit them to pages with high fraud risk - login pages, account creation pages, and checkout pages - and not apply them to general content pages. Configure challenge immunity time (the exemption period after a successful verification) to reduce the burden on legitimate users.
WAF Bot Control Pricing
As of August 2026, WAF base pricing is $5.00 per month per web ACL, $1.00 per month per rule, and $0.60 per million requests. Bot Control is priced as a monthly subscription of $10.00 per web ACL plus a per-request analysis fee: the Common level costs $1.00 per million requests (the first 10 million requests per month are free), and the Targeted level costs $10.00 per million requests (the first 1 million requests per month are free). ATP (Account Takeover Prevention) and ACFP (Account Creation Fraud Prevention) each add a monthly subscription of $10.00 per web ACL plus tiered per-attempt analysis fees - see the official AWS WAF pricing page for the tiers in effect. Since the Bot Control Targeted level is expensive, apply it only to high-risk pages like login and checkout pages, and use the Common level for general content pages to manage costs.
Summary
AWS WAF Bot Control, ATP, and ACFP are managed rules that protect web applications from bots and fraud. Label-based flexible rule evaluation lets you fine-tune detection accuracy, while challenges and CAPTCHA balance user experience with security. Integrate with CloudFront or API Gateway to block threats at the edge, before they reach your application.
References (Official AWS Documentation)
The specifications covered in this article are documented in the following primary sources: AWS WAF Bot Control rule group, which lists the rules and labels of the managed rule group; AWS WAF Bot Control components, which explains protection levels, dashboards, and scope-down statements; and the AWS WAF pricing page, which publishes subscription fees, per-request fees, and free tiers. When this article and the official documentation ever disagree, trust the official documentation - it is the authoritative source.