How KillBot Handles Bots: CAPTCHA, CPU Load and Blocking

By default, KillBot does not block traffic (it may only show CAPTCHA): all visitors are analyzed and allowed to access the website without restrictions. However, you can manually configure how the system should respond to traffic that is detected as bot traffic.

Flexible bot response settings

For each browser "snapshot" (a unique software identifier used to determine whether a visitor is a bot or a real user), you can set an individual action:

Show slider CAPTCHA - a good option when you want to check who is behind a snapshot: bots or real users. In this case, you should review visitor sessions in Webvisor manually and make sure that bots cannot solve the CAPTCHA.
Example of slider CAPTCHA:
Block - completely deny website access for a specific snapshot. This is a good option when you are 100% sure that the snapshotbelongs to bots.
CPU load - create an endless loading loop to consume bot CPU resources. This can be useful when you want the bot software administrator to remove your website from their scraping or automation list.
Analytics and Metrics - the goal of many bots is to appear in analytics systems (for visit history, traffic simulation, and bypassing anti-fraud systems). If the bot does not appear in analytics, it may stop visiting your website. IMPORTANT: when blocking a visit or creating a loop, analytics tracking works first and blocking happens afterwards. Therefore, if you do not want blocked visits to appear in analytics, you also need to enable the "Hide analytics" option.
Full access - take no action and allow access.

You can combine these methods for one website. For example, if you have five snapshots and two of them are detected as bots, you can show CAPTCHA for one snapshot, create a loop for another one, while allowing real users to access the website normally.

Working with search engine bots

For DNS Verification page, search engine bots are automatically allowed and do not see the KillBot page. They access the website without any restrictions - they do not interact with KillBot at all.

For JS integration, search engine bots may appear as separate snapshots. By default, CAPTCHA will not be shown to them (even if the "Show CAPTCHA to everyone" option is enabled). However, if you manually configure CAPTCHA or blocking for a search engine bot snapshot, this action will be applied.

with DNS Screen integration, search engine bots are not detected by KillBot because they bypass the screen completely. With JS integration, search engine bots that execute JavaScript may appear as snapshots - be careful not to block them.

Custom bot handling using JavaScript

In some cases, you may need to execute your own JavaScript code depending on whether the visitor is a real user or a bot.

If you use JS integration, you can add your own JavaScript code directly into a special KillBot script function:

Below is an example of a function that sends a Metrica goal for real users and creates an endless redirect for bots:

async function kbBeforeFinish(isBot) {
    if (isBot==false){ 
        // add your code if it is a real user
    } 
    if (isBot==true){ 
        // add your code if it is a bot
    } 
}

If you use DNS integration, you can also add your own JavaScript code to the KillBot screen, BUT only if you use your own KillBot server. On your own server, you can add custom JS code in the verification page PHP file:

/opt/killbot/html/verification.php

Individual bot blocking by snapshot

KillBot allows you to process different snapshots differently. IMPORTANT: make sure you do not block real users (and search engine bots if you use JS integration).

Click the "Snapshots" section on your websites page https://my.kill-bot.net/script/list. This is the main KillBot section for traffic analysis:

The snapshot type and its owner are shown in the left column.

If the label is green, it means the snapshot belongs to a system group of real browsers.

If the label is red, it means the snapshot most likely contains bots or may be used by bots.

Available actions for each snapshot are shown in the right column under "Actions":

Browser snapshots, bots and actions in KillBot interface

If you want to block or CPU load for a snapshot, always make sure:

The snapshot does not belong to a search engine bot. Carefully read the label under the snapshot . For example, Google bot is marked as shown in the screenshot below:
Make sure there are no real users behind this snapshot.

Check how many times CAPTCHA was solved — this is the "CAPT." column. If CAPT=42 (2) it means theat captcha was hhown 42 times and was solved only 2 times.

By default, CAPTCHA is shown only to bots. Therefore, if the column shows zero captcha solves ( for example CAPT.=105(0)), make sure that the script settings actually show CAPTCHA for this snapshot. To check how the website reacts to a visit with a specific snapshot, click the "Test" link:

Below is an example of a bot snapshot, but for 42 captcha shows, captcha was solved 2 times. This means that real users may exist behind this snapshot, so I would not block it:

Attention! Real, motivated users can also solve the captcha using anti-detect browsers. In this case, such visits will also be assigned to bot snapshots. Please keep this in mind when making decisions about blocking.
Make sure the number of visits for the snapshot is large enough: preferably more than 10 visits.

If a snapshot has only 3 visits, this is usually not enough information to decide whether it belongs to users or bots.

IMPORTANT: snapshot visits are NOT visits from one specific person. They are visits from the same software.

For example: I use Chrome, and another person in China also uses Chrome. We use the same browser software, so our visits may have the same snapshot.

Therefore, I do not recommend blocking snapshots with a very small number of visits (1 visit on scrinshot):
Below is an example of snapshots that can be blocked or CPU load:

There are many visits, no CAPTCHA solutions, the snapshot is not in known real browser groups, or it belongs to a bot group:
Below is an example of what you should NOT do:

All "green" system snapshots were added to bots and blocked.

Do not do this, otherwise real users (including yourself) will not be able to access the website:

Individual "green" snapshots may sometimes contain bots, but they should not be blocked as a whole group.