How do AWS WAF Bot Control rules treat verified bots?

Definition: AWS WAF Bot Control adds a bot:verified label when it can verify a self-identifying bot. Most category and signal rules then skip that bot, while the documented CategoryAI rule still applies its action to verified matches.

Key facts

• AWS's Bot Control managed rule reference defines awswaf:managed:aws:bot-control:bot:verified for a bot that identifies itself and that Bot Control can verify.
• For the documented category rules, the action is applied only to unverified bots; verified bots receive bot name, category, and verified labels while the rule takes no action.
• CategoryAI is the stated exception in the rule table: it applies its action to all matches regardless of verification status.
• Signal rules such as SignalAutomatedBrowser, SignalKnownBotDataCenter, and SignalNonBrowserUserAgent inspect requests that are not from verified bots.
• The AWS WAF labeling documentation says a label remains available to later rules until web ACL evaluation ends.

Which label represents a verified bot?

The Bot Control namespace is awswaf:managed:aws:bot-control:. Within it, the bot:verified label means that a bot identifies itself and AWS WAF has been able to verify it. The same documentation lists bot name and category labels, which can be combined with the verified label when a rule needs a narrower match.

awswaf:managed:aws:bot-control:bot:verified
awswaf:managed:aws:bot-control:bot:category:search_engine
awswaf:managed:aws:bot-control:bot:name:googlebot

AWS also documents bot:web_bot_auth:verified for a request whose Web Bot Authentication signature was successfully validated against a public key directory. That label is a verification result for the WBA signature. It is distinct from the broader bot:verified label used in the Bot Control taxonomy.

Which managed rules still apply?

The ordinary category entries in the managed rule reference state that verified bots do not match the rule and receive no rule action. The reference gives this treatment for categories including advertising, archiving, content fetching, monitoring, scraping frameworks, and search engines. The rule group still adds the bot name, category, and bot:verified labels.

CategoryAI has a different documented scope. AWS says that it applies its action to all matches, regardless of whether the bot is verified or unverified. A verified label therefore does not exempt a request from this rule.

The signal rules named in the reference apply to unverified requests. Their descriptions say that verified bots do not match and do not receive the corresponding signal or rule labels. The targeted TGT_TokenAbsent rule likewise inspects requests that are not from verified bots and uses the Count action.

What do similar verified labels mean?

AWS separates ordinary verified bots from two related categories. bot:user_triggered:verified identifies a bot similar to a verified bot that might be directly invoked by end users. bot:developer_platform:verified identifies a similar bot used by a developer platform for scripting, with Google Apps Script as the documentation's example. AWS states that both categories are treated by Bot Control rules like unverified bots.

The managed rule group can add labels without ending evaluation. AWS's Bot Control overview says that generated labels include bot category and name, and that custom AWS WAF rules can match them. The general labeling documentation describes the same sequence: a label added by a matching rule remains available until web ACL evaluation ends, so a later label match rule can handle a request after Bot Control.

How can a website handle a verified bot?

The managed rule reference says the group allows the commonly allowed verified bots. A custom rule can nevertheless use the labels to block all verified bots or a selected subset. A label match rule placed after Bot Control can use the category, name, or verification label as its input.

Related terms

• How do AWS WAF Bot Control inspection levels differ?
• When can a later AWS WAF rule match a label added by another rule?
• How can AWS WAF labels be used to observe bot matches without blocking?
• Are AWS WAF user-triggered verified bots treated like verified search crawlers?

FAQ

Does a verified search engine bot match the search engine category rule?

No. AWS documents that the category action applies only to unverified bots. A verified bot receives the category and verification labels while that category rule takes no action.

Can a custom AWS WAF rule block a verified bot?

Yes. You can create a later label match rule using the Bot Control labels and choose the handling for the matching request. AWS documents the managed group as allowing commonly verified bots while permitting custom rules to block them or a subset.

Are user-triggered verified bots treated as ordinary verified bots?

No. AWS gives bot:user_triggered:verified its own label and states that this category is treated by Bot Control rules like an unverified bot.

Sources

1. AWS, "AWS WAF Bot Control rule group", undated
2. AWS, "Web request labeling in AWS WAF", undated
3. AWS, "AWS WAF Bot Control", undated

---

Check how a page reads to answer engines. Open the GEO score analyzer