Rate limits alone do not stop bots: layering controls that actually work

Distribution defeats a single threshold

A limit of, say, one hundred requests per address per minute sounds firm until traffic arrives from ten thousand addresses at two requests each. Residential proxy networks rent exactly that spread, cheaply, so the per address view shows nothing unusual while the site absorbs the full automated load.

The giveaway is in the aggregate: thousands of fresh sessions behaving identically, requesting the same sequence, and never converting. Defences have to read the pattern across sources, not just count within one source, which is the shift most teams make after their first failed limit.

Layer signals, each of them weak alone

Request timing, header consistency, device fingerprints, network reputation, and interaction patterns are all spoofable one at a time. Combined, they become expensive to fake at scale, because the operator must keep every layer consistent across thousands of sessions, and mistakes in any one layer expose the rest.

Score sessions rather than judging single requests. A real shopper accumulates normal signals over minutes: varied timing, ordinary navigation, a cart that fills in a human order. Automation reveals itself in the joins between actions, which is why session level scoring catches what request counting misses.

Put friction where the value is

Challenging every visitor punishes the honest majority and still lets well built bots through. Apply step up checks at the moments automation values most: account creation, login attempts after failures, limited stock checkout, and bulk data endpoints. Low value browsing should stay frictionless.

Tune challenges by risk score so most humans never see one. When a challenge does appear for a genuine user, it should be quick and accessible. Friction is a budget: spend it on the small share of sessions the signals cannot clear, and measure whether real users complete it.

Measure evasion, not just blocks

Blocked counts flatter every defence, because you cannot see the traffic that passed. Track outcomes bots care about: fake accounts created, limited items bought per household, scraping coverage of your catalogue, and login success after credential attacks. Those numbers show whether layering is working.

Re test after every change with a simple question: what would this cost an operator running ten thousand sessions? If the honest answer is very little, the control is decoration. Good layering raises the operator cost per result until the target stops being worth it.

Budget follows the same logic as controls: spend where the protected value is. A small store does not need an enterprise platform to layer sensibly. Session scoring from existing analytics, sensible challenge placement, and honest outcome measurement are mostly configuration and attention, not licences. What it cannot afford is the opposite pattern: an expensive single tool bought to avoid thinking, set to its defaults, and declared a strategy. Layering is a way of thinking about cost imposed on the attacker, and that thinking is available at every budget level.

Keep reading: Waiting room and queue fairness for online sales: controls that keep real buyers in line, Gift card fraud bots: how balance checking attacks work and how to slow them, and Sale day bot spikes: preparing a store for launch traffic that is half human, half automated cover the nearby cases in this series.

Frequently asked questions