AWS WAF & Shield Support
AWS WAF rate-based rules and Bot Control.
Abusive traffic is often legitimate-looking requests at high volume: login attempts, scraping, checkout abuse. Rate-based rules and Bot Control target behavior instead of payloads. We choose what to rate on, set thresholds from your own traffic and roll out safely.
When You Need This
The situations where this work pays for itself.
Signs it is time
- Login or password-reset endpoints are being hammered
- Scrapers or crawlers inflate your origin and CloudFront costs
- Bots buy out inventory or abuse promotions
- Many users share an IP address, such as an office or carrier NAT
- You see spikes of traffic from a single client or ASN
What you get
- Rate-based and Bot Control rules in infrastructure as code
- Thresholds justified from your traffic data
- Dashboards and alarms for blocked and challenged requests
- A rollout record from Count to Block
How we do it
A clear, safe process you can follow along with.
1. Baseline normal behavior
We use logs and metrics to see requests per client per time window on each path, so thresholds are based on real usage, not guesses.
2. Pick the right aggregation key
Rate by source IP is the default. Behind CloudFront or a proxy we use the forwarded IP header, and we can aggregate on a header, cookie or URI to separate a login endpoint from normal browsing.
3. Write targeted rules
We scope rate rules to sensitive paths, for example login, with a lower limit, and add a general higher limit for the whole site. Scope-down statements keep them specific.
4. Start in Count, then enforce
We deploy in Count to see which clients would be limited, adjust thresholds, then move to Block, or to CAPTCHA or Challenge for browser traffic where a hard block would hurt users.
5. Add Bot Control where it pays
Bot Control is a paid managed rule group with a common level and a targeted level. We apply it with scope-down to the endpoints that matter and review labels to allow verified good bots.
6. Monitor and iterate
We watch blocked, challenged and allowed counts, check origin load and conversion, and review quarterly because attackers adapt.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Rate limiting by IP behind CloudFront without forwarded IP
Every request may appear to come from a few proxies and block everyone.
Thresholds too low
Shared IPs and busy pages can look like abuse. Baseline first.
Hard-blocking browsers
CAPTCHA or Challenge is kinder to real people than Block.
Enabling Bot Control on every request
It is billed per request inspected, so scope it to the endpoints that need it.
Frequently Asked Questions
How does an AWS WAF rate-based rule work?
It counts requests per aggregation key, such as source IP, over a time window and applies its action to keys that exceed the limit until they fall back below it.
What is AWS WAF Bot Control?
It is a managed rule group that detects and manages bot traffic, with common and targeted levels. The targeted level uses more advanced detection and costs more.
How do I protect a login page from credential stuffing?
Apply a low rate limit to the login path, consider Bot Control or account takeover prevention, and use CAPTCHA or Challenge for suspicious clients.
Want Help With AWS WAF rate-based rules and Bot Control?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required