Search

What can I do to improve my site's protections against bots?

Below are the current options available to you to protect your site from bot or automated traffic.  Note that making your end user pages more secure against automated traffic serves more than one purpose.  Some solutions may decrease your billable sessions, but just as importantly, if your Customer Portal pages are set up in an inefficient or query-heavy manner, excessive bot traffic can compromise performance and availability.

Note that if your site is available to the public (meaning there is no login required), you should have calibrated your sessions entitlements taking into account that at least some automated traffic will be generating sessions against your site.  No solution can filter out all automated traffic and the only guaranteed way to ensure that your knowledge base statistics and sessions are not inflated by bots crawling across your site is to put content behind a login.

Important - B2C Service sites are hosted in a multi-tenant environment.  If inefficient queries or poorly implemented end user page customizations are causing availability issues, network restrictions may be temporarily put in place to ensure that you do not impact other customers.

Options For Bot Remediation

(1) The single best way to prevent bots from impacting your site is to put your site behind a login.

(2) Akamai - Akamai is a separate product, a security suite that can be put in front of your B2C Service site to significantly increase the odds that automated or malicious traffic is detected and rejected before it enters the Oracle network.  This service is free of charge, and there is a document attached to this answer detailing the process for testing an enabling Akamai.  If you would like to look into it, please submit a Service Request and we will start with enabling it on a test site.

(3) Bring your Own Captcha (BYOC) is a service that is available as a product feature starting in the 25c version of the application.  This refers users to a CAPTCHA challenge on page load once a session.    You are able to configure your own CAPTCHA service or use a basic one that comes with the feature.  Note that this is distinct from the Customer Portal abuse detection feature, which protects your webforms from attackers - this can be configured on page load to help mitigate automations and bots.  There is documentation attached to this answer on how to implement the feature.  As of the 26a version of the application, sessions that terminate at the CAPTCHA challenge will not be counted as Tier 1 billable sessions.  You must be on Customer Portal 3.11 or later for the Tier 1 sessions benefit.

(4) Javascript Bot Detection.  On 26a versions or later, you can enable a javascript feature that will filter out bots based upon common bot behavior.  Sessions that are filtered out with this feature will not trigger Tier 1 sessions.  There is information in the above link on how to implement the feature - it requires updating the CP_BOT_DETECTION_ENABLED configuration setting.  You must be on Customer Portal 3.11 or later to use this feature

Why do I want to do bot remediation?

-  The primary reason for bot remediation is that bots trigger connections and queries against your database.  Large surges in traffic can affect the availability and performance of your site and other sites in your shared hosted environment.   Even if you do not have concerns about Tier 1 sessions, bot remediation is an important security control for your  

-  Bot remediation often significantly improves Tier 1 session numbers by filtering out unwanted traffic.  Again, no filter or functionality, other than requiring a login, can filter out all unwanted traffic.