News & Service Updates
Bot Surge Stopped: New One-Second Browser Check
How we handled this week's disguised bot flood, and what the brief browser check means for you and your customers.
Over the past two days, we started receiving a huge surge in bot traffic. This surge was different from others because the traffic was difficult to identify. It disguised itself as ordinary customer traffic, using real browser signatures spread across many residential networks also used by real shoppers, so there was no single source we could simply block.
We had to get a little creative with our defenses. We added a new traffic-filtering policy that gives unfamiliar visitors a very quick browser check before allowing them through. Think of it like a temporary access pass.
Once a visitor completes the check, their browser receives a pass that lasts up to 24 hours. They can then browse normally without seeing the check again.
Under the current setting, a small percentage of unfamiliar visitors are admitted immediately, while most are asked to complete the one-second check first. No real visitors are blocked outright. For a real customer, the worst-case experience is usually a brief pause on the first page they visit, followed by normal browsing after that.
Most visitors will not encounter the check at all. Pages that are already stored in our network cache are delivered immediately and do not need to go through this process.
The same system is much more disruptive to a large bot network. Because the traffic is spread across many different internet connections, every address the bot network uses must complete its own check, on every shop, every day. A one-second delay is insignificant for a real shopper, but it becomes a major obstacle when repeated across thousands of automated requests. As a result, most of that traffic is stopped before it ever reaches our servers.
We can make the filter more or less strict within seconds, without making any larger system changes. Right now, it is set fairly aggressively because of the scale of the attack.
A few pages that are especially attractive to bots, including account creation, inquiry forms, wish lists, cart actions, and certain search pages, always require the browser check when a visitor does not already have a pass. Legitimate search engines are exempt from the process.
We had to get a little creative with our defenses. We added a new traffic-filtering policy that gives unfamiliar visitors a very quick browser check before allowing them through. Think of it like a temporary access pass.
Once a visitor completes the check, their browser receives a pass that lasts up to 24 hours. They can then browse normally without seeing the check again.
Under the current setting, a small percentage of unfamiliar visitors are admitted immediately, while most are asked to complete the one-second check first. No real visitors are blocked outright. For a real customer, the worst-case experience is usually a brief pause on the first page they visit, followed by normal browsing after that.
Most visitors will not encounter the check at all. Pages that are already stored in our network cache are delivered immediately and do not need to go through this process.
The same system is much more disruptive to a large bot network. Because the traffic is spread across many different internet connections, every address the bot network uses must complete its own check, on every shop, every day. A one-second delay is insignificant for a real shopper, but it becomes a major obstacle when repeated across thousands of automated requests. As a result, most of that traffic is stopped before it ever reaches our servers.
We can make the filter more or less strict within seconds, without making any larger system changes. Right now, it is set fairly aggressively because of the scale of the attack.
A few pages that are especially attractive to bots, including account creation, inquiry forms, wish lists, cart actions, and certain search pages, always require the browser check when a visitor does not already have a pass. Legitimate search engines are exempt from the process.