Which IP address does AWS WAF use to verify a bot behind a proxy?

Definition: AWS WAF Bot Control's verified-bot reference says the check uses the IP address from the web request origin. When a proxy or load balancer is that origin, AWS documents a custom rule that reads a forwarded IP address and explicitly allows the verified bot before the Bot Control rule group.

Key facts

• AWS says Bot Control uses the web request origin IP to help determine whether a bot is verified. The Bot Control managed rule reference also says its forwarded IP configuration cannot replace that source.
• AWS's forwarded-IP documentation says a proxy or load balancer makes the last proxy address the web request origin, while the originating client address is usually carried in an HTTP header.
• For a verified bot that routes through a proxy or load balancer, AWS documents a rule before Bot Control that uses the forwarded IP address and explicitly allows requests from the verified bot.
• AWS documents automatic client-IP handling for Bot Control requests arriving through Amazon CloudFront, Akamai, Cloudflare, or Fastly when the request comes from the CDN's published ranges.

Which address does Bot Control inspect?

AWS's forwarded-IP documentation describes the source as the IP address from the web request origin. With one or more proxies or load balancers, that origin contains the address of the last proxy. The originating client address is usually forwarded in an HTTP header, typically X-Forwarded-For (XFF), although another header can carry it.

The Bot Control managed rule reference says that the managed rule group uses the origin IP to help determine whether a bot is verified. It also says that Bot Control cannot be configured to use the AWS WAF forwarded IP configuration to inspect a different IP address source. For a bot behind an ordinary proxy or load balancer, the verification source is therefore the address AWS WAF receives as the request origin.

How does the documented proxy allowance work?

AWS gives a specific path for verified bots that route through a proxy or load balancer. The Bot Control managed rule reference says that a custom rule runs before the Bot Control rule group, reads the forwarded IP address, and explicitly allows requests from the verified bots. AWS's forwarded-IP page gives a custom IP set match rule as an example of detecting and allowing verified bots with forwarded addresses.

The forwarded-IP configuration in AWS's JSON example is:

"ForwardedIPConfig": {
  "HeaderName": "x-forwarded-for",
  "FallbackBehavior": "MATCH"
}

The header name is case insensitive. For the allowance rule, the IP set match statement can compare the first, last, or any address in the forwarded header. The managed rule reference's placement requirement makes the order of the custom rule part of the documented approach.

What happens when the forwarded header is incomplete?

AWS's forwarded-IP documentation says a missing forwarded header causes the statement that uses it to receive a no-match result, and missing headers do not trigger fallback behavior. An invalid or malformed IP address uses the fallback behavior configured for the forwarded-IP setting, which can assign either match or no match.

For an IP set match statement, any inspects up to 10 addresses. If the header contains more than 10 addresses, AWS WAF inspects the last 10. Multiple addresses must be separated by commas, and a different separator makes the addresses malformed. A rule statement using a forwarded IP header uses that header as its IP source rather than the address reported by the web request origin.

AWS also cautions that proxies can modify forwarded headers and that attackers might alter their contents. The header and fallback choices therefore belong in the rule review, along with the proxy path that supplies the header.

Does AWS document a CDN exception?

As of 17 October 2026, AWS's forwarded-IP page documents an exception for requests arriving through a third-party CDN. Bot Control automatically recognizes traffic originating from the published IP ranges of Amazon CloudFront, Akamai, Cloudflare, and Fastly, then uses the originating client IP from the CDN's standard client IP header. Forwarded-IP configuration is not needed on the Bot Control and Anti-DDoS managed rule groups for those CDNs. Other IP-based statements, including a custom IP set match, still require a forwarded-IP configuration when they need the upstream client IP.

Related terms

• How do AWS WAF Bot Control inspection levels differ?
• How do AWS WAF Bot Control rules treat verified bots?
• Crawler IP verification
• User-agent spoofing

FAQ

Which IP does Bot Control use behind an ordinary proxy?

It uses the IP address from the web request origin. When a proxy or load balancer is in the path, AWS describes that origin as the address of the last proxy.

Can you configure Bot Control to verify against X-Forwarded-For?

AWS says the Bot Control managed rule group cannot use the AWS WAF forwarded-IP configuration as its verification source. A preceding custom rule can use the forwarded address and explicitly allow the verified bot, as described in the forwarded-IP documentation.

How should you handle several addresses in the forwarded header?

For an IP set match statement, choose the first, last, or any address. The any option inspects up to 10 addresses and inspects the last 10 when the header contains more than 10.

Sources

1. AWS, "AWS WAF Bot Control rule group", accessed 17 October 2026
2. AWS, "Using forwarded IP addresses in AWS WAF", accessed 17 October 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer