Web Security
Bot management tools that slow the script, not the customer (2026)
A 2026 shortlist of bot gates on sites you operate. Public docs, not a CAPTCHA-bypass cookbook.
Expertise: Web Security · Level: Intermediate · 12 min read
A WAF rule is not a bot program.
The WAF list filters exploits at the edge. Bot management asks whether the client is a person you wanted. Overlap declared. This page will not teach a bypass.
Six gates. One open challenge. One DNS-edge button. Two commercial bot desks. One CAPTCHA. One AWS add-on. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Anubis | Open proof-of-work in front of a site you host | MIT |
| Cloudflare Bot Management | Bot scores on a zone you already proxy | Cloudflare terms |
| DataDome | Commercial bot desk on an app you own | Commercial |
| HUMAN | Known commercial bot and fraud shelf | Commercial |
| hCaptcha | A challenge when you need a human in the loop | Commercial (free tier) |
| AWS WAF Bot Control | Bot labels on an AWS WAF you already pay for | AWS terms |
Anubis
Best for open proof-of-work in front of a site you host
Anubis sits in front of a site and asks clients to spend a little CPU. Born to blunt scraper stampedes on self-hosted apps.
Key features
- Reverse-proxy challenge
- MIT
- You host it
- No vendor score feed
Why we like it
This is the hidden gem when you will not send every request to a bot SaaS.
Limits
Real users on old phones feel it. Not a full fraud desk. You operate the box.
Cloudflare Bot Management
Best for bot scores on a zone you already proxy
If the DNS is already Cloudflare, bot scores and JS challenges live next to the WAF. Overlap with the WAF list is declared.
Key features
- Bot score
- Same zone as the WAF
- Rules they document
- Paid SKU
Why we like it
Honesty. Do not buy a third edge if this SKU is sitting unused.
Limits
Cloudflare-shaped. Price. A score is not a fraud investigation.
DataDome
Best for commercial bot desk on an app you own
DataDome sells bot and online-fraud protection. Tag on your origin. Console for the queue.
Key features
- Edge tag they ship
- Console
- API they document
- Commercial
Why we like it
When the hole is account opening and inventory hoarding, a specialist desk is the job.
Limits
Commercial. False friends on unusual browsers. We did not run a tenant.
HUMAN
Best for known commercial bot and fraud shelf
HUMAN, formerly White Ops, sells bot mitigation and media integrity. Enterprise motion.
Key features
- Bot mitigation they sell
- Enterprise desk
- Integrations they list
- Commercial
Why we like it
Known neighbor so DataDome is not a one-logo commercial row.
Limits
Commercial. Procurement. Public pages are not a lab.
hCaptcha
Best for a challenge when you need a human in the loop
hCaptcha is a challenge widget. Privacy-shaped alternative people actually install. Accessibility is a product decision.
Key features
- Widget
- Accessibility modes they document
- Free and paid
- You place it on a form
Why we like it
Sometimes the honest control is a challenge, not a silent score.
Limits
Friction. Not a full bot graph. Do not publish a solver.
AWS WAF Bot Control
Best for bot labels on an AWS WAF you already pay for
Bot Control adds managed bot labels to AWS WAF. Overlap with the WAF list is declared. Price is extra on the web ACL.
Key features
- Managed bot groups
- Same WAF ACL
- Labels you can rule on
- AWS docs
Why we like it
If the ACL is already AWS, start here before a fourth vendor.
Limits
AWS-shaped. Cost. Labels still need rules you write.
What the internet thinks about bot management
Bot threads treat scrapers as a capacity problem first. We keep that line. This page will not publish a CAPTCHA solver.
Prove Anubis still publishes
Confirm Anubis still publishes. Put it only in front of an origin you operate.
git ls-remote --heads https://github.com/TecharoHQ/anubis.gitFAQs
Does bot management replace the WAF?
No. WAF is exploit filter. Bot management is client honesty. Link both.
Will this stop every scraper?
No. Determined clients adapt. Measure checkout, not a vendor slide.
Is a CAPTCHA enough?
It is a challenge. Accessibility and conversion are the hidden cost.
Is this a scored bake-off?
No.
