Acme Shop

No bot protection — the origin is fully exposed

Bot Defense & IVT — how it decides

Native to wslproxy, at the edge, no external service. Every request on a protected server is scored from three kinds of evidence, then classed and acted on.

Fingerprint — what the request claims, and whether the rest of it agrees.
Identity — verified search crawlers (reverse + forward DNS) and data-centre IP ranges.
Behaviour — what this IP and this visitor have been doing, across every worker.

The score is the sum of the signal weights, capped at 100: below 40 human, from 40 suspect, from 80 bot. Verified crawlers are a class of their own and are allowed.

Actions

monitor — score and forward the verdict, never act.
challenge — suspects get a self-hosted browser check (proof of work + automation check, no third-party script); bots are blocked. A solved check is trusted for the session, bound to the client's network and User-Agent, single-use, and cannot be replayed by another client.
block — suspects and bots are blocked.
Per path: always challenge (checkout), score only (ad beacons, analytics), skip (webhooks).

Invalid traffic (IVT)

Each verdict carries an MRC-style tier, forwarded to the origin as X-WSL-Bot-IVT: none (valid), GIVT — general invalid traffic, found by lists and routine filtration (declared bots, tools, data-centre traffic, verified crawlers), and SIVT — sophisticated invalid traffic that needs analysis (spoofed browsers, headless automation, impersonated crawlers, abnormal behaviour). The ad scenario in the lab shows an origin using it to stop billing for invalid impressions.

Signals

Kind	Signal	IVT	Weight	Meaning
Fingerprint	`BD_UA_MISSING`	GIVT	40	No User-Agent header.
Fingerprint	`BD_UA_AUTOMATION`	GIVT	35	HTTP library or CLI tool User-Agent (curl, python-requests, Go, Java, …).
Fingerprint	`BD_UA_SCANNER`	GIVT	90	Vulnerability scanner User-Agent (sqlmap, nikto, nuclei, …).
Fingerprint	`BD_UA_DECLARED_BOT`	GIVT	30	Self-declared bot, crawler or spider that is not a verified search engine.
Fingerprint	`BD_UA_HEADLESS`	SIVT	70	Headless or automated browser (HeadlessChrome, PhantomJS, Selenium, …).
Fingerprint	`BD_BROWSER_NO_ACCEPT`	SIVT	15	Claims to be a browser but sends no Accept header.
Fingerprint	`BD_BROWSER_NO_LANGUAGE`	SIVT	20	Claims to be a browser but sends no Accept-Language.
Fingerprint	`BD_BROWSER_NO_ENCODING`	SIVT	15	Claims to be a browser but sends no Accept-Encoding.
Fingerprint	`BD_BROWSER_NO_HINTS`	SIVT	15	Claims to be Chromium but sends no Sec-CH-UA client hints over HTTPS.
Fingerprint	`BD_BROWSER_NO_FETCH_META`	SIVT	15	Claims to be a modern browser but sends no Sec-Fetch-* metadata over HTTPS.
Fingerprint	`BD_OLD_PROTOCOL`	SIVT	15	Claims to be a browser but speaks HTTP/1.0.
Identity	`BD_FAKE_CRAWLER`	SIVT	90	Claims to be Googlebot/Bingbot/… but reverse + forward DNS says otherwise.
Identity	`BD_DATACENTER`	GIVT	25	Client IP is in a hosting / cloud provider range.
Behaviour	`BD_BURST`	SIVT	30	Request burst from one IP above the per-10s limit.
Behaviour	`BD_SCRAPING`	SIVT	35	Too many distinct pages per minute for one visitor.
Behaviour	`BD_ERROR_STORM`	SIVT	30	Many 401/403/404/405 responses for one IP — scanning, enumeration, carding.
Behaviour	`BD_LOGIN_VELOCITY`	SIVT	50	Too many login attempts from one IP — credential stuffing.
Behaviour	`BD_NO_COOKIE`	SIVT	25	Never returns the session cookie it is given.
Behaviour	`BD_NO_ASSETS`	SIVT	20	Loads many pages but never the CSS/JS/images a browser fetches.

Failure behaviour

Fails open: any internal error lets the request through and is logged and counted. Search-engine verification that cannot reach DNS is "unknown", never "fake".