WAF · Amazon Web Services
AWS WAF Bot Control
Difficulty 2/5
Rule-based, with an optional JS challenge and CAPTCHA tier. The default managed rule set is far more permissive than any dedicated bot vendor.
- TLS fingerprinting
- JS challenge required
- Behavioural scoring
- IP reputation weight: medium
How it decides
-
Managed rule groups matching known bot user-agents, IP reputation lists and rate-based rules.
-
An optional challenge tier that mints an `aws-waf-token` cookie after running a small JS payload.
-
Rate limits evaluated per address over a rolling five-minute window — usually the first thing you hit.
-
No TLS fingerprinting in the base product, which is the biggest single difference from the vendors above.
What you see when it stops you
- HTTP 403 with a short “Request blocked” body
- `x-amzn-waf-action: challenge` or an `aws-waf-token` cookie
- A challenge script served from `*.token.awswaf.com`
- HTTP 405 on requests that were fine a moment earlier
Signatures the detector matches
Publicly observable artefacts AWS WAF Bot Control sends to every visitor. Paste a response into the analyser and these are what it looks for.
| Where | Signal | Weight |
|---|---|---|
| Header | x-amzn-waf-action header | 75 |
| Cookie | aws-waf-token cookie | 75 |
| Page markup | awswaf.com challenge script | 70 |
| Header | x-amzn-requestid header | 20 |
| Status | 403 request blocked | 10 |
What actually gets through
-
Static ISP addresses are usually enough. Spend on address count rather than address quality.
-
Send a coherent browser header set — the managed rules mostly match on obvious client tells.
-
Rotate on rate, not on block. The rate-based rule is what you are actually fighting.
-
If a JS challenge appears, a lightweight headless browser clears it; no proof-of-work is involved.
Not sure this is what
is blocking you?
Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.