Last updated: April 29, 2026
Why this module. APIs are bot magnets. Credential stuffing against /login, scraping of /products, account creation abuse, comment spam. Volumetric DDoS is solved at the edge; L7 abuse is a per-API battle.
Bot patterns by endpoint
- /login — credential stuffing, brute force
- /signup — fake account creation for fraud / spam
- /api/search — scraping / SEO attacks
- /api/products — competitor scraping, price crawling
- /api/checkout — gift-card cracking, CVV cracking
- /forgot-password — account-existence enumeration
The defence layers
- Edge rate limiting — Cloudflare, AWS WAF. Per IP, per ASN. Easy.
- Authenticated rate limiting — per user account. Harder but more accurate.
- Behavioural fingerprinting — TLS handshake (JA3/JA4), HTTP/2 fingerprint, browser-traits. Catches headless browsers.
- CAPTCHA / challenges — hCaptcha, Turnstile, reCAPTCHA Enterprise. Cost the bot, not the human.
- Anomaly — UEBA-style on API events. Account suddenly searches 10K SKUs in an hour.
Per-endpoint patterns
- /login — strict rate limit per username (3-5 attempts/15 min); CAPTCHA after threshold; account lockout on extreme.
- /signup — CAPTCHA + rate limit per IP + new-account-anomaly detection (signups from same IP in close time).
- /api/products — auth required + per-user rate limit + bot-detection on user-agent + TLS fingerprint.
- /forgot-password — return same response whether email exists or not (prevent enumeration); rate limit per email.
The bot business model
Sophisticated bots use residential proxy networks (real ISPs, real IPs). Each IP makes 1-2 requests/min. Aggregate hits your endpoint hard. Per-IP rate limiting fails entirely.
Defences that scale: ASN-level limits + behavioural fingerprinting + authenticated requests only.
Defender’s checklist
- Per-endpoint rate-limit policies tuned to expected traffic.
- Per-account limits in addition to per-IP.
- Bot management (CDN-tier or dedicated).
- Anomaly detection on authenticated traffic.
- CAPTCHA for unauthenticated sensitive endpoints.
Module Quiz · 6 questions
Pass with 80%+ to mark this module complete. Unlimited retries. Each question shows an explanation.
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.