CloFix Bot Management Engine Guide

Overview

The Bot Management Engine turns TLS fingerprint, automation user-agent shape, behavioral context, and related signals into one score from 0 to 100. Thresholds decide whether the request continues, receives a JavaScript challenge, or is denied.

Score signals

Signal	What it contributes
JA3 / TLS	Fingerprint scoring that resists a spoofed user agent when the TLS stack does not match a browser.
Automation UA	Headless browsers, scrapers, and common HTTP libraries used by bots.
Behavior	Session and request behavior, so the score is more than a static blacklist.
No-IP	Device-oriented context, so rotating the IP does not reset risk by itself.

Allow, challenge, or block

Below challengeDefault challenge threshold is 40. The request continues.

Challenge bandFrom the challenge threshold up to the block threshold, the client gets a JavaScript challenge.

BlockDefault block threshold is 75. The request is denied with 403.

Good-bot bypass

With good_bot_bypass on, verified SEO and search-engine bots skip scoring.

Configuration

Tune the thresholds per domain in bot_engine or in Configuration Manager.

domain conf

bot_engine {
    enabled on;
    challenge_threshold 40;
    block_threshold 75;
    good_bot_bypass on;
}

Dashboard

Thresholds and live status are on /waf-dashboard/bot. During a volumetric bot flood, pair this engine with Advanced Protection Under Attack Mode.