In short. Fastly ContentGuard requires Block mode to enforce category and identity actions.
Definition: Fastly ContentGuard uses Bot Management with pre-cache inspection to manage bot requests. Log mode records bot results for observation, while Fastly enforces category and identity actions only when Protection mode is set to Block.
Key facts
- Fastly requires Bot Management and pre-cache inspection on each service where ContentGuard is used, according to its traffic management documentation.
- After pre-cache deployment, Fastly starts monitoring and logging bot traffic, and the default Protection mode is Log, as described in About ContentGuard.
- The Protection mode controls monitoring and enforcement. Category and identity controls specify the action for each category or identity.
- A category action covers all bots in that category. An identity action covers requests from one bot identity, and changing an identity action changes the category menu to
Custom. Blockis active enforcement,Logis monitor only, andOffleaves monitoring, logging, and blocking inactive.
Why does Log mode leave the configured actions unenforced?
Fastly separates the setting that observes bot traffic from the setting that applies the configured decisions. Its ContentGuard traffic management documentation says that Protection mode controls whether Fastly monitors traffic and enforces protection decisions. It defines Log as monitor only: Fastly monitors bot traffic and logs the results so you can observe activity before enabling enforcement.
The category and identity menus still let you choose actions while the service is in Log mode. Those choices define the policy that Fastly will use for the relevant category or identity. The same documentation states that the Protection mode must be Block for those actions to be enforced. A Log-mode result therefore shows detection and logging without applying the selected action to the request.
What does Fastly require before ContentGuard can enforce actions?
Fastly documents two prerequisites: purchase Bot Management and deploy it with pre-cache inspection on every Fastly service where ContentGuard is used. The About ContentGuard page says that, after this deployment, Fastly immediately starts monitoring traffic and logging results. Its default Protection mode is Log, so initial operation is an observation stage.
The same page describes the preparation sequence as reviewing the bot controls, monitoring bot traffic, changing the Protection mode, and optionally adding headless bot detection. The sequence places the mode change after review and monitoring. It also says that Bot Management groups bots into categories, tracks individual bots as identities within those categories, and lets you set actions at either level.
How do you enable enforcement?
Fastly's documented change is made in the service's Bot Management settings. Select the service, open the Protection mode menu, and choose Block, which Fastly labels Active enforcement. The About ContentGuard documentation says that Bot Management then starts enforcing the category and identity actions selected on the Protection page.
Security > Bot Management > Settings
Protection mode: Block (Active enforcement)
After the mode change, review the Protection page. Fastly documents a category Action menu for the action applied to all bots in a category. The Configure bots control exposes an Action menu for each bot identity, and an identity-specific value changes the category menu to Custom.
Where can you inspect the policy before changing the mode?
Fastly places category and identity controls at Security > Bot Management > Protection. The managing bot traffic guide instructs you to select the service, find the bot category row, and either choose the category action or open Configure bots for an identity-level action.
For monitoring, Fastly's About ContentGuard page sends you to Security > Bot Management > Dashboards and the Overview dashboard. It also directs you back to Protection to view the request count for each bot category and identity before adjusting the controls.
Related terms
- Can Fastly VCL recover a request already blocked by ContentGuard?
- Does Fastly inspect bots before or after the cache?
FAQ
Does Log mode reject or block a bot?
Fastly defines Log as Monitor only. It monitors bot traffic and logs results; category and identity actions require Block mode for enforcement.
What does Block mode change?
Block is Fastly's Active enforcement mode. After you select it, Fastly says Bot Management starts enforcing the category and identity actions selected on the Protection page.
Where do you change Protection mode?
In the Fastly control panel, go to Security > Bot Management > Settings, select the service, and choose Block (Active enforcement) from the Protection mode menu.
Sources
Check how a page reads to answer engines. Open the GEO score analyzer