Traffic Management

The Traffic Management feature gives administrators self-service control over the automated traffic — bots, crawlers, scrapers, and scripted clients — that reaches your environment. Rather than maintaining lists of individual user agents, you define rules based on traffic categories (such as AI crawlers or SEO tools) and signals (such as requests originating from known data centers). For each type of traffic, you can choose whether to allow it, block it, or require it to prove that it's human.

More advanced detections, such as silent background Challenge actions and machine-learning-based targeted rules, require the Advanced Traffic Management add-on. See What the Advanced Traffic Management add-on adds for more details.

For precise control per user-agent, see User-Agent Blocking. To manage access by IP address or range, see IP Access Control.

What Traffic Management does

Altis automatically inspects and classifies your traffic using a range of signals, including user-agents, IP addresses, and request patterns.

Traffic Management lets you:

• See how much of your traffic is automated, broken down by category and signal. With the add-on, you can also see individual bot names and the organizations behind them.
• Decide how each type of automated traffic is handled: allow it, block it, or make it prove it's human.

Traffic Management appears in two places in the Dashboard:

• The Traffic page shows analytics: how your traffic breaks down between verified bots, unverified bots, and non-bot (human) requests, and what has been allowed or blocked.
• Environment → Settings → Traffic Management is where you configure the mode and choose an action for each rule.

Key terminology

• Bot — any automated client, as opposed to a human using a browser. Bots are not inherently bad: search engine crawlers and monitoring services are bots you probably want to allow.
• Verified vs. unverified — a verified bot is one that identifies itself and whose identity Altis can independently confirm (for example, Googlebot crawling from Google's own IP ranges, or a bot using the Web Bot Auth protocol. An unverified bot claims an identity that cannot be confirmed, or none at all. Most rules only act on unverified traffic — verified bots are labelled but left alone.
• Signal — an indicator based on detection algorithms, such as coming from a known bot data center or using a non-browser user agent. Signals apply to traffic that doesn't fall into a clean category.
• Category — the kind of bot, such as a search engine, an SEO tool, or an AI crawler. Categories are primarily determined from self-identifying signals like the user agent.
• Token — a small piece of session data generated by the WAF. Many of the targeted protections rely on it to tell real browsers apart from bots. Tokens are issued automatically when the CAPTCHA or Challenge actions run.

Mode

The Mode setting controls how Traffic Management behaves overall. We recommend starting in Count Only mode, reviewing the Traffic page for a week or two to understand your traffic, and only then switching to Active.

Actions

When Traffic Management is Active, each rule can be set to one of the following actions. Setting a rule to anything other than Allow means matching requests are acted on.

Blocked requests and requests which do not pass the CAPTCHA or Challenge tests are not counted towards your page views. (The interstitial page for CAPTCHAs and Challenges are also not counted as views.)

The CAPTCHA puzzle is accessible — it offers both visual and audio variants and is available in multiple languages. CAPTCHAs are only displayed to the user on their first visit, and a token is stored in their cookies to ensure they don't see it again.

CAPTCHA vs. Challenge. A CAPTCHA interrupts the visitor with a puzzle, so use it where outright blocking may occasionally misidentify a real user. Challenges operate invisibly to real users, but may allow some automated traffic and require the Advanced Traffic Management add-on.

Rule groups

The settings page splits the rules into three groups.

Bot Categories

Bots are automatically classified into categories based their purpose, as determined by self-reported user-agent and other signals. For example, Advertising, Monitoring, Search Engine. See the Settings > Traffic Management page for the full list of categories and their descriptions.

Signals

Signals are indicators that a request is automated, these are used for traffic that doesn't fall into a clean category.

Targeted Protections

The most sophisticated detections, aimed at bots that deliberately hide and don't identify themselves. These use browser checks, fingerprinting, request-rate analysis, and machine learning (ML). Targeted Protections require the Advanced Traffic Management add-on.

They fall into a few families:

• Volumetric — abnormally high request volumes from a single IP or session in a short window (including sessions with no valid token).
• Token-based — requests missing a valid session token, which most real browsers carry.
• Targeted signals — token-level evidence of automation: automated browsers, browser automation extensions (such as Selenium), and inconsistent browser fingerprints.
• Coordinated activity (ML) — machine-learning detection of distributed, coordinated bot campaigns spread across many IP addresses, reported at Low, Medium, and High confidence.
• Token reuse (ML) — a single token being reused across many distinct IP addresses, countries, or networks (ASNs), reported at Low, Medium, and High confidence.

With the ML-based rules, a confidence rating is assigned to the signal based on the model's output. A common pattern is to Challenge or CAPTCHA lower-confidence levels and Block only the high-confidence ones.

Reading the Traffic page

The Traffic page in the Dashboard shows how your automated traffic breaks down. Note that these counts cover all HTTP requests, not just page views.

• Bot detection — the split between verified bots, unverified bots, and non-bot (human) traffic, and how much was allowed vs. blocked.
• Bot categories and Automation signals — how much traffic matched each category and signal, with the action taken.
• Identified bots and Bot organizations — the specific named bots and the companies operating them. These tables require the Advanced Traffic Management add-on.

Use Count Only mode together with this page to understand your traffic before enforcing any blocking.

What the Advanced Traffic Management add-on adds

Every Altis customer gets bot categories and signals with the Allow, Block, and CAPTCHA actions. The Advanced Traffic Management add-on adds:

• Targeted Protections — the machine-learning and fingerprint-based rules above.
• The Challenge action — silent background browser checks, so you can stop bots without showing anyone a puzzle.
• Richer analytics — the Identified bots and Bot organizations tables on the Traffic page, naming the specific bots hitting your site and the companies behind them.

To enable the add-on, or for help deciding whether it's right for your site, contact your account manager or Altis support.

Best practices

• Start in Count Only. Enable Traffic Management in Count Only mode and watch the Traffic page before enforcing anything, so you can see what would be affected.
• Protect verified bots you rely on. Leave categories like Search Engine on Allow so you don't harm SEO. Remember verified bots are generally left alone regardless.
• Prefer CAPTCHA over Block when uncertain. The CAPTCHA action stops bots while still allowing real-users to access the site; reserve Block for traffic you're confident is unwanted.
• Review regularly. Bot behaviour changes; revisit the Traffic page periodically and adjust your actions.

If legitimate users report being blocked or repeatedly challenged, relax the responsible rule or switch it to Count Only, and contact Altis support if you're unsure which rule is responsible.

Related Documentation

• Web Application Firewall
• User-Agent Blocking
• IP Access Control