> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/bot-management/introduction.md).

# Introduction

Bots are software programs acting as clients for web applications and APIs. Some (such as search engine spiders) are usually considered to be benign. Others (such as scrapers, inventory denial bots, vulnerability scanners, etc.) are malicious. Even bots that are not overtly hostile can still be unwelcome, for example by polluting site analytics.

Link11’s Bot Management service is an optional add-on to [Web DDoS Protection](/product-guides/web-ddos.md). It provides:

* **Automated identification** of non-human traffic
* **Application of admin-defined actions** to that traffic
* **Customized handling** of specific bots
* **Flexible configuration**: can be enabled/disabled on a per-instance basis.

## How it works 

Bot Management passively analyzes user behavior/logs, and uses statistics, AI, and Machine Learning to identify if a client is a bot. 

It allows admins to fully control and manage a broad range of bots; bot traffic is categorized, and admins can configure different actions to take for each category. The potential actions include allowing, blocking, or presenting a CAPTCHA to verify that the client is human.

Bot Management does not automatically stop user requests when a new request is received. Instead, the system learns over time, taking action as soon as bot traffic is detected.

{% hint style="info" %}
**Note:**\
Well-known malicious bots will be blocked immediately, while unknown bots will be blocked a few seconds after detection. The latter is due to our AI and Machine Learning algorithms.
{% endhint %}

## How bot requests are processed

Bot Management has two paths for bots detection and handling: one for clients that are known to be bots, and another for those which are suspected, but not yet known, to be bots.

### Known Bots 

When a request is known to be originating from a bot, the following steps are taken, based on the [Bot Management Rules](/product-guides/bot-management/interface/rules.md).

* First, **evaluate the whitelists** (the [IP whitelist](/product-guides/bot-management/interface/rules.md#id-botmanagement-rules-ipwhitelistrule) and [User Agent whitelist](/product-guides/bot-management/interface/rules.md#id-botmanagement-rules-useragentwhitelistrule)). If a match is found in either list, exempt the request from showing up in any bot analytics.
* Second, **evaluate the** [**Category Rules**](/product-guides/bot-management/interface/rules.md#id-botmanagement-rules-categoryrule). If a match is found, change the bot’s category as specified.

  This is to make sure the Organization Rules are applied correctly.
* Lastly, **evaluate the** [**Organization Rules**](/product-guides/bot-management/interface/rules.md#id-botmanagement-rules-organizationrule). Match the bot to the correct Organization Rule and assign the specified classification (Good or Bad) and action (Default, Block, Ignore, Captcha).

### Unknown Bots

When a traffic source is not (yet) confirmed to be a bot, but is suspected to be (due to repeated requests, request timing, header analysis, etc.), the following steps are taken.

* First, **evaluate the whitelists** (IP and User Agent). If a match is found in either list, exempt the request from showing up in any bot analytics.
* Second, **check the** [**Default Policy for Bad Bots**](/product-guides/web-ddos/interface/instances/general-settings.md#default-policy-for-bad-bots). 
  * If it’s “Ignore”, processing ends.
  * Otherwise, apply the Default Policy that was specified (either Block or Captcha).