In this recurring blog series, we discuss one of the countermeasures in UltraWAF, our Web Application Firewall and Bot Management solution. If you’re not using UltraWAF and protection for your online presence, get in touch with us us by clicking the “Speak to Sales” button on the top right corner of our website. 

Our featured countermeasure this month is Bot Signatures. Bot signatures are under the Bot Management tab in a sub-tab titled “Signatures.” UltraWAF has signatures for over 24,000 unique bots, a feature which gives you the ability to detect and block a wide range of unwanted web automation tools. 

Understanding Bot Signatures. 

Signatures are a combination of bot characteristics such as HTTP header or source IP address that can be matched against. For instance, Google’s web crawler and indexer, Googlebot, is known by the value of its User-Agent HTTP header “Googlebot/2.1” and a specific set of source network blocks that Google has listed. 

Each signature is identified by a numerical identifier, a categorization of “Good Bot” or “Bad Bot,” and a default action. The default action can be modified. For instance, FacebookBot, TwitterBot, and LinkedInBot are categorized as “Bad Bot” by default to add protection for B2B or internal websites. However, for a B2C or other public-facing website, it is very advantageous to allow these bots to load website content. 

To modify a signature, you can search for the signature by ID or keyword and click on the “edit” icon on the listing. This allows you to disable the signature entirely or change the action from the default. For our example of FaceBookBot, the default behavior can be changed from “Drop & Log” to “Log”. 

To learn more about our UltraWAF solution, please visit our product page.