I have a huge bot traffic on my site (more than 3000 visits per day) and bots look very similar with real users - have real user agent, cookies and other (it is for cheating behavioral factors for Yandex search engine). So they pass browser check and don’t see captcha like they are real visitors.
So firewall is useless
How can I make this rule to show captcha everytime for everyone?
Narrow it down to only checking the Path. Get rid of the Referer check, but keep the Known Bots exception. And make sure it’s the first rule in your list.
I mean not Yandex or Google bots. I mean real good users of my site - each of them will have to solve captcha - its bad, very bad. I want to show captcha just for direct traffic on my site. How can I do this?
That’s the JS Challenge. But you want them to get a CAPTCHA instead?
If so, take a look at the Firewall Events Activity Log. That JS Challenge should show a Ray ID at the bottom that you can search for in Firewall Events to see which setting is causing that.
I ment - for everyone with my settings - referrer equals “”
It means that rule must work just with direct traffic
But the problem is in captcha - it doesn’t show captcha to direct traffic
I will repeat again:
I want to show captcha, not js challenge and just for direct traffic.
Good question. I don’t recall a definitive answer, and the answers I have seen contradict each other.
One opinion, based upon Enterprise logging is that it’s a challenge that was not completed/solved.
Another option is that it’s a challenge that wasn’t triggered by a firewall rule, but yours clearly was.
