In short. Review Akamai bot detections in monitor mode and reports before changing actions to mitigation.
Definition: Akamai Bot Manager monitor mode is a pre-enforcement workflow for observing bot detections and traffic in reports while requests remain under monitoring actions. Akamai's documented process moves selected actions to mitigation only after the detections have been reviewed.
Key facts
- Akamai recommends implementing Bot Manager in monitor mode to see what kind of traffic a site is dealing with, according to its bot response strategy documentation.
- Akamai describes bot detection as determining which requests come from bots and then categorizing and labeling those bots by their characteristics in its detection-methods documentation.
- Akamai's monitoring guidance recommends Alert before Deny, checking Web Security Analytics for false positives, consulting security reports, and using notifications for important events.
What should an agency do before changing an action?
Akamai's bot response strategy starts with information gathering. The documentation says to implement Bot Manager in monitor mode, observe the traffic, and use the observations to choose different actions for specific bots. It specifically recommends starting with actions set to monitor and alert for a few weeks so the team can examine the portion of requests that come from bots, the bot types involved, and whether Bot Manager detects them properly.
The available reports support several checks. Akamai names an overview of bot versus human traffic, pages targeted by bots, drill-down investigation of a specific bot, and the effect of protections. A protected resource in monitor mode can show bots and humans submitting failed login requests in the same view. These observations give an agency evidence to review before it changes the action.
Which detections need separate review?
Akamai documents several detection methods. Akamai-validated bots are known bots that Akamai validates. Custom-categorized bots are defined by the customer, which allows internal tools or vendor bots to be categorized. Transparent detection evaluates request characteristics such as incorrect header signatures, bot-building frameworks, out-of-order headers, and browser version mismatches. Active detection uses an interaction to confirm that a request comes from a web browser typically used by a person. Behavioral detection, available in Bot Manager Premier, covers interaction patterns at transactional endpoints such as login or checkout pages.
The review should therefore keep the detection method and the resulting category visible. A verified bot category, a custom category, and a behavioral score represent different evidence in Akamai's documentation. The page on response strategy also says that Akamai-verified categories can use monitor or allow, while other categories can receive actions selected for the traffic.
How should reports be checked for false positives?
Akamai's broader monitoring guidance says to set actions to Alert first instead of Deny. After the full Security Configuration is active, it directs operators to check traffic in Web Security Analytics for false positives, which it defines there as regular requests flagged as problems. It also recommends consulting security reports and setting up notifications for important events.
For reporting to work, the same guidance specifies HTTP header data logging under this configuration path:
App & API Protector Hybrid Security Configuration > Advanced settings > Logging > HTTP header data logging
The page says the setting should be On and that logging can include Standard headers, Custom headers, and Cookies. It also says that initial adjustments can be made within a few hours, while proper adjustments require more data collected over weeks to identify patterns. This source describes App & API Protector Hybrid, so an agency should apply this logging path only where that product and configuration are in use.
When can the action change from monitoring to mitigation?
Akamai's bot workflow places the change after the review. Once the team is confident that detections work as intended, the documentation says to change monitor actions to actions that mitigate requests, including deny, tarpit, or challenge.
monitor -> deny, tarpit, or challenge
The arrow summarizes the sequence described by Akamai, not a required product setting. Its example compares a protected resource in monitor mode with the same resource after a deny action: the monitor view contains bot and human failed login requests, while the deny example shows only human tries getting through. That example is a report comparison for one protected resource, not a promised result for every site.
Related terms
FAQ
Should monitor actions remain in place indefinitely?
No fixed duration is given for every site. Akamai says to start with monitor and alert for a few weeks, then change monitor actions to mitigation actions when the detections are working as intended.
What should an agency inspect before using Deny?
You can review bot versus human traffic, targeted pages, a specific bot, and the observed effect of protections in Bot Manager reports. Akamai's monitoring guidance also directs you to check Web Security Analytics and security reports for false positives.
Can different bot categories receive different actions?
Yes. Akamai documents separate handling for Akamai-validated bots and custom-categorized bots, and it recommends selecting actions based on the category and the traffic being protected.
Sources
- Akamai, "Handle adversarial bots", 30 September 2026
- Akamai, "Detection methods", 1 March 2026
- Akamai, "Monitor activity", 5 August 2026
Check how a page reads to answer engines. Open the GEO score analyzer