F5 Distributed Cloud Bot Defense
Bot management
Also known as: Shape Security, Shape, F5 Bot Defense
Deliberately has no signature. F5 advises customers to make blocked responses look like ordinary application errors, so the status code is chosen to be uninformative.
F5's Bot Defense, built on the Shape Security technology F5 acquired, is the hardest product here to identify, and that is by design. F5's own guidance is for customers to configure the blocked response to mimic other blocked responses from their web application, so that an attacker cannot tell their request was intercepted by Bot Defense rather than rejected by the application.
The consequence is that there is no canonical F5 status code and no branded block page to look for. Operators choose the status code and can add arbitrary headers to blocked responses. A block might be a 403, a 404, a 500, or a 200 with an application-shaped error inside it.
For human traffic that passes, F5 documents that Bot Defense adds a custom HTTP request header before forwarding to the origin, so the application can act on the verdict. That header is added to the upstream request, not to the client's response, so it is invisible from outside.
Identification therefore relies on behaviour rather than signature: a specific high-value endpoint such as a login or checkout that fails consistently for automated clients while everything around it works normally.
How to identify it
- No reliable response signature, which is itself the signature when combined with the behaviour below.
- A heavy obfuscated JavaScript payload on login, signup, checkout, or gift-card endpoints, often posting a large encoded telemetry blob.
- Failures concentrated on one or two high-value endpoints while the rest of the site behaves normally.
- An error whose status code does not match its body, or an application error page that the application itself would never produce for that input.
Status codes
403 Configured block
Blocked. Operator configurable.
A block using a conventional status code. F5 lets the operator select the status code returned for blocked requests.
What triggers it
- Telemetry that did not arrive, or arrived malformed, from the client-side collection script.
- A device or environment signature associated with automation.
- Credential-stuffing or carding patterns on the protected endpoint.
How to confirm it
- Custom headers, if the operator configured any, since F5 lets them add header names and values to blocked responses.
What to do about it
- Look at which endpoint fails rather than at what it returns. Bot Defense is usually deployed on a handful of transactions rather than site-wide, and that distribution is the tell.
200 Application-shaped block
Deceptive. Operator configurable.
A block dressed as an ordinary application response, which is the configuration F5 explicitly recommends.
What triggers it
- An operator following F5's guidance to make blocked responses indistinguishable from normal application failures.
How to confirm it
- A generic error such as an invalid credentials message that appears regardless of the input supplied, including for input known to be correct.
- A response that is consistent for automated clients and different for a browser making the same request.
What to do about it
- Test with a known-good input. If a login endpoint reports invalid credentials for credentials you know are valid, you are being blocked rather than rejected, and no amount of correcting the request will help.
- Never let this pattern silently pollute a data pipeline. Assert on positive success markers rather than on the absence of an error.
If you run a site behind it
- Ambiguous responses hide your false positives from you as effectively as they hide detection from attackers. Instrument the block decision internally even when the outward response says nothing.
- The forwarded header on human traffic is the useful hook: let the application decide what to do with a verdict rather than making the edge the only enforcement point.
If your traffic is being caught by it
- There is no header to grep for. Diagnose by endpoint distribution and by response consistency instead.
- If one endpoint behaves impossibly while the rest of the site is fine, suspect a deliberately silent bot defence before suspecting your own code.