WAF - Bot Challenge Path Exclusions Collection by crowdsecurity

AppSec Bot Challenge — Path exclusions

Part of the appsec-bot-challenge bundles. It lets machine-facing / non-navigational requests through without a challenge, since clients on these paths typically cannot solve one.

What it contains

Per-purpose path exclusion configs:

appsec-bot-challenge-exclude-crawler-files — /robots.txt, /.well-known/*, /security.txt, /sitemap.xml, …
appsec-bot-challenge-exclude-static — static assets and media (css, js, images, fonts, video, audio)
appsec-bot-challenge-exclude-api — programmatic endpoints (/api/, /graphql, /wp-json/, /oauth/, …)
appsec-bot-challenge-exclude-feeds — RSS/Atom feed paths
appsec-bot-challenge-exclude-webhooks — third-party webhook paths (/webhooks/)

Usage

Installed automatically by the appsec-bot-challenge bundle and its strict / permissive variants. Install it on its own to add just these exemptions, or enable individual configs if you don't want them all.

WAF - Bot Challenge Path Exclusions

Installation

Content

Configuration

Installed on

Know where it runs

Documentation

AppSec Bot Challenge — Path exclusions

What it contains

Usage