BotShield
Beta

BotShield

Disciplined Judgment. Proportionate Response.

Adaptive bot mitigation for the Apache HTTP Server.

BotShield scores requests, tracks short-term reputation, and decides whether to pass, challenge, slow down, or block before application code has to absorb the traffic.

Wild traffic

Web traffic meets BotShield before requests ever wake the application.

Weighted judgment

Several signals combine into one score that drives the response.

Response ladder

Each request gets the lightest response that fits the score — stronger actions only when signals warrant.

Drop-in CAPTCHA providers

  • Turnstile
  • hCaptcha
  • reCAPTCHA
  • FriendlyCaptcha
  • GeeTest
  • Built-in PoW

Cloudflare Turnstile, hCaptcha, reCAPTCHA, FriendlyCaptcha, GeeTest, or a built-in form proof-of-work — pick what fits your audience.

Bots recognized and held to policy

  • Googlebot
  • Bingbot
  • GPTBot
  • ClaudeBot
  • Bytespider
  • PerplexityBot
  • Forged bot
  • Scraper

We identify bots by user-agent, by behavioral signals, and — when you load them — against published IP ranges. The robots.txt policy you declare is enforced against verified, suspected, and forged bots alike.

Built-in reputation memory

  • First-sight check
  • IP reputation
  • User trust cookie
  • Survives restart
  • Host load tracking
  • Replay defense

No external service for scoring or reputation memory — every signal lives inside the Apache process. Evaluation runs in-process; legitimate traffic passes through with minimal delay.

Four capabilities feeding one decision

  • Scoring engine

    Triage browser-like traffic, first-sight clients, and obviously bad probes.

    One decision ladder with stable logs and metrics.

  • Passive threat memory

    Remember recent abuse without pushing every request into an external store.

    Cheap local reputation and short-lived trust.

  • Challenge orchestration

    Escalate only when request shape and recent history say it is worth the friction.

    Silent, form, or third-party CAPTCHA challenge paths.

  • Observability

    Explain why a request passed, slowed down, was challenged, or got blocked.

    Decision logs, metrics, status hooks, and docs-first behavior.

Apache delivers. BotShield decides.

  • The decision lands before your app runs.

    BotShield decides inside Apache before your application even gets the request. Before mod_php. Before mod_proxy. Before mod_wsgi. Before whatever handler your stack uses.

  • Your traffic never crosses a trust boundary.

    Configuration is Apache directives. Live state stays in your Apache’s shared memory. Saved state is a file on your disk. Every decision is made inside that process.

  • Behaves like Apache, because it is Apache.

    Same scoping rules — server, vhost, Directory, Location. Same mod_log_config output, mod_watchdog heartbeats, mod_status page. Your Apache instincts work here.

Install. Configure. Tune. The Guide walks you through it.

Read the BotShield Guide