Bot Defense configuration

Scope: configuration-only. These inactive alternatives explain how Bot Defense Standard would block a classified request or redirect a visitor on a protected endpoint. Live classification and mitigation are unavailable in this example.

Choose between endpoint-specific mitigation actions after Bot Defense classification; a fixed path response or WAF rejection has a different decision model.

Both examples protect POST /bot-check over a secure connection for web clients. They allow good bots, use the United States regional endpoint, and insert asynchronous JavaScript after the page’s <head> element. Each endpoint chooses either mitigation.block or mitigation.redirect.

Block response

Visitor message: Request not accepted.

The block alternative uses mitigation.block with status: Forbidden and an encoded body. The body has a 4,096-character limit including its prefix. The Bot response has no confirmed Content-Type setting. See response-body encoding to create your own message.

Bot block source

{
  "spec": {
    "bot_defense": {
      "regional_endpoint": "US",
      "policy": {
        "javascript_mode": "ASYNC_JS_NO_CACHING",
        "js_insert_all_pages": {
          "javascript_location": "AFTER_HEAD"
        },
        "protected_app_endpoints": [
          {
            "metadata": {
              "name": "bot-block"
            },
            "any_domain": {},
            "http_methods": [
              "METHOD_POST"
            ],
            "protocol": "HTTPS",
            "web": {},
            "allow_good_bots": {},
            "undefined_flow_label": {},
            "path": {
              "path": "/bot-check"
            },
            "mitigation": {
              "block": {
                "status": "Forbidden",
                "body": "string:///PHA+UmVxdWVzdCBub3QgYWNjZXB0ZWQuPC9wPg=="
              }
            }
          }
        ]
      }
    }
  }
}

Decoded preview (escaped):

<p>Request not accepted.</p>

Expected configuration: The POST endpoint has one block action and the intended message. This checks settings only; runtime classification, response status, and media type remain unverified.

Help redirect

The redirect alternative uses mitigation.redirect.uri to point to a help page. The example does not specify the redirect response status.

Bot redirect source

{
  "spec": {
    "bot_defense": {
      "regional_endpoint": "US",
      "policy": {
        "javascript_mode": "ASYNC_JS_NO_CACHING",
        "js_insert_all_pages": {
          "javascript_location": "AFTER_HEAD"
        },
        "protected_app_endpoints": [
          {
            "metadata": {
              "name": "bot-redirect"
            },
            "any_domain": {},
            "http_methods": [
              "METHOD_POST"
            ],
            "protocol": "HTTPS",
            "web": {},
            "allow_good_bots": {},
            "undefined_flow_label": {},
            "path": {
              "path": "/bot-check"
            },
            "mitigation": {
              "redirect": {
                "uri": "https://custom-responses.f5-sales-demo.com/bot-help"
              }
            }
          }
        ]
      }
    }
  }
}

Expected configuration: The POST endpoint has one redirect action and points to the intended help page. Runtime redirect behavior remains unverified.

See WAF blocking for qualified firewall rejection examples.