Bot management by ZIWIT

Half the web isn't human. The other half is your customers.

51% of all web traffic in 2024 was automated, says the Imperva 2025 Bad Bot Report.

CloudFilt tells them apart on every request, and keeps scrapers, credential stuffers and spam scripts off your site, your forms and your API.

No code to rewrite: a CMS plugin and two keys, a few lines in your app, or a DNS change. Real visitors never notice a thing.

Try for free See plans & pricing

Free up to 3,000 requests a month, no card. Support is answered by people, not a chatbot.

shop.example PRO Protected

Live filtering

Last 3 min

214visitors now 37bots stopped

Blocked

203.0.113.24 Tor exit node, anti-flood rule.

14:02

Challenge

198.51.100.7 Risk score 58, browser without JavaScript.

14:01

Good bot

Googlebot verified by reverse DNS, let through.

13:58

Allowed

192.0.2.90 Human visitor, captcha solved in 3 s.

13:57

What CloudFilt sorts on a protected website, minute by minute.

Looked up

Network 216.73.217.115, AS16509 AMAZON-02, United States.

Missing

JavaScript your browser did not run our script. Most scrapers don't either.

Pending

Automation waiting for your browser.

Pending

Browser waiting for your browser.

Waiting

Behaviour move, scroll or tap anywhere.

Watching

One last thing: move, scroll or tap, and we'll make up our mind.

Not a mock-up

Meanwhile, we've been checking you.

A few of the signals CloudFilt weighs on every visitor of a protected site, applied to you, right now. Worked out on the fly, nothing stored.

Think you can tell a bot? Play

From request to verdict

Every request is sorted before your server spends a CPU cycle on it. People go through. Scripts stop at the door.

Visitor

A browser, a script or a bot sends a request to your website or API.
Nearest point of presence

The CDN WAF, or your plugin, hands the request to the closest point of presence.
Signals

IP reputation, behaviour, rate, country and your own rules, weighed in real time.
Verdict
- Allowed to your site
- Challenge captcha first
- Blocked never reaches you

Every request is weighed against 12 signals and 15 reputation lists, under your rules for 250+ countries and territories, on a CDN WAF of 340+ points of presence. The first 3 000 requests each month are on us.

A field guide to the bots on your site

Six species you will meet sooner or later. Googlebot gets in, the scraper doesn't, and the AI crawler is your call.

All solutions

No. 01 Blocked

Price scraper

Pretium raptor

Habitat

Datacenters and rotating proxies.

Diet

Your prices, your product pages.

Tell-tale signs

Seven pages a second, never loads an image.

Field notes
No. 02 Blocked

Credential stuffer

Clavis furax

Habitat

Residential proxies, rented botnets.

Diet

Leaked passwords, your login form.

Tell-tale signs

One try per account, a flawless browser, no mouse.

Field notes
No. 03 Blocked

Form spammer

Spamus vulgaris

Habitat

Cheap servers, open proxies.

Diet

Contact forms, sign-ups, comments.

Tell-tale signs

Fills a form in 0.4 s, hidden fields included.

Field notes
No. 04 Blocked

Vulnerability scanner

Rimator perpetuus

Habitat

Everywhere, all the time.

Diet

/.env, /wp-login.php, forgotten plugins.

Tell-tale signs

Asks for files you never had.

Field notes
No. 05 Your call

AI crawler

Lector insatiabilis

Habitat

Cloud providers.

Diet

Everything you ever wrote.

Tell-tale signs

Reads the whole site, clicks nothing, sometimes says its name.

Field notes
No. 06 Welcome

Search engine crawler

Indexator benignus

Habitat

Google, Bing, and their reverse DNS.

Diet

Your sitemap.

Tell-tale signs

Says who it is, and can prove it.

Field notes

Two ways in. The fastest is a DNS change.

Put the whole domain behind the CloudFilt CDN WAF, or filter from inside your app. Same verdicts either way.

All integrations

CDN WAF · recommended

Protection and speed, without touching your code

Each visitor lands on the closest point of presence and gets a verdict there. Only real users reach your server.

shop.example→ your server

shop.example→ CDN WAF → your server

340+ points of presence, close to every visitor
Bad requests stopped before they reach your server
Static content cached at the edge: faster pages
Every site on the domain covered, whatever the CMS

Discover the CDN WAF Talk to us

Rather keep your hosting as it is?

Install the plugin for your CMS or add a few lines to your app, paste two keys, and you're filtering. Every threshold and every rule stays yours to change.