WAF - Bot Challenge Good Bots

AppSec Bot Challenge — Good bots

Part of the appsec-bot-challenge bundles. It exempts network-verified good bots from the challenge — a bot is exempted only when it can be verified by dns or ip range, so a spoofed user-agent alone is never enough.

What it contains

Per-family exclusion configs (each declares its datafiles and exempts the matching bots):

• appsec-bot-challenge-exclude-search-engines — googlebot, googleother, bingbot, applebot, amazonbot, yandex, baidu, yahoo, sogou, qwant, babbar, duckduckbot, ahrefs, semrush, lumar, seznam, naver, internet-archive
• appsec-bot-challenge-exclude-ai-crawlers — gptbot, openai-searchbot, openai-chatgpt-user, openai-adsbot, perplexitybot, perplexity-user, anthropic, mistralai-index, mistralai-user, duckassistbot, youbot, commoncrawl
• appsec-bot-challenge-exclude-google-ads — mediapartners-google (AdSense / Ad Manager), google-adsbot (AdsBot-Google, AdsBot-Google-Mobile)
• appsec-bot-challenge-exclude-wikimedia-citation — wikimedia-citoid (Citoid/WMF), wikimedia-zotero-translation-server (ZoteroTranslationServer/WMF)
• appsec-bot-challenge-exclude-social — meta, discord, telegram, twitterbot, pinterest, linkedin, flipboard
• appsec-bot-challenge-exclude-monitoring — uptimerobot, cookiebot, datadog, pagerduty

Usage

Installed automatically by the appsec-bot-challenge bundle and its strict / permissive variants. Install it on its own to add just these exemptions, or enable individual family configs if you don't want them all.