WAF Bot Detection: Why Your WAF Is Not Enough to Stop Bots

Only 2.8% of websites were fully protected against bot attacks in 2025, down from 8.4% in 2024, according to DataDome’s 2025 Global Bot Security Report. Over 61% were completely unprotected. 

Many of those sites have a web application firewall (WAF) in place, and many teams assume that a WAF is enough to stop bots. It isn’t, because a WAF cannot answer the one question that matters: is this visitor a human or a bot? 

In this article, we explain what a WAF does well, where it fails against bots, and what to add to close the gap.

Key takeaways

• A WAF protects against application exploits like SQL injection and cross-site scripting. It was never designed to detect bots.
• WAFs rely on signatures, rules, and IP reputation. Modern bots often carry no attack signature and rotate IPs constantly, so they pass straight through.
• The costliest attacks, including credential stuffing, account takeover, scraping, and scalping, abuse business logic rather than software vulnerabilities. A WAF treats them as normal traffic.
• AI agents and LLM crawlers are a fast-growing share of automated traffic, and they behave even more like humans than traditional bots.
• The fix is layering, not replacement: Keep your WAF for exploit defense and add real-time bot detection on top.

What does a WAF actually protect against?

A WAF is built to stop application exploits, not bots. It sits between the internet and your web application, inspects HTTP requests, and applies predefined rules to filter out traffic with known attack signatures. This makes a WAF effective against the threats it was designed for:

• Vulnerability exploits such as SQL injection, cross-site scripting (XSS), and session hijacking, the classic OWASP Top 10.
• Known bad actors, including blocklisted IP addresses, suspicious user agents, and traffic from specific countries.
• Virtual patching, shielding a known software flaw until your team can fix the code.

Every one of those defenses depends on recognizing something already known. That dependency is exactly where bots slip through.

Can a WAF tell a human from a bot?

No, and that single gap is why WAF bot detection falls short. Most WAFs apply a negative security model: they define what bad traffic looks like and allow everything else. Each request gets a binary check against the ruleset. Is this IP blocklisted, yes or no? Does this payload match an attack signature, yes or no? Modern bots are built so they pass every binary question a WAF checks for:

• They carry no attack signature. A bot testing stolen credentials sends the same login request a real customer would. A scraper requests the same product pages a shopper browses. There is no exploit to match.
• They rotate identities faster than rules can update. Botnets, IPv6 address space, and residential proxy networks give bot operators access to tens of thousands or even millions of clean IP addresses. By the time an IP is blocklisted, the bot has moved on.
• They target business logic, not code flaws. Credential stuffing, scalping, and inventory hoarding all use your site exactly as designed. There is no vulnerability for the WAF to detect.

The result is that a WAF inspects every request and waves the most damaging automated traffic straight through.

Why do modern bots bypass WAFs?

Today’s bots are engineered specifically to evade rule-based defenses. Headless browsers like Playwright and Puppeteer run a full browser environment and present legitimate fingerprints. Anti-detect frameworks randomize those fingerprints on every session, and solver services clear the CAPTCHAs that rules-based systems fall back on.

AI has accelerated this shift. DataDome’s network recorded nearly 8 billion AI agent requests in the first two months of 2026. AI agents and LLM crawlers do not just stick to content pages either: 64% of the AI bot traffic we observed in the 2025 Global Bot Security Report hit form pages, 23% hit login endpoints, and 5% reached checkout.

AI agents also introduce a problem no static rule can solve: intent can shift mid-session. An agent that arrives to compare prices on a user’s behalf can pivot to aggressive scraping or automated checkout abuse within the same visit. A signature written for the first behavior says nothing about the second.

There is a structural problem underneath all of this. WAF rules are reactive: A new bot pattern gets a rule only after someone identifies the attack, so the first wave of damage is already done. And Gartner expects 33% of enterprise software applications to include agentic AI by 2028, so automated traffic is set to grow, not shrink.

Which threats does a WAF miss?

The attacks that hurt revenue most are the ones a WAF waves through. None of the following threats rely on a software vulnerability, so none of them trigger a signature:

• Credential stuffing and account takeover (ATO): Bots test breached username and password pairs against your login endpoint. Each attempt is a valid login request.
• Content and price scraping: Competitors and LLM crawlers harvest your catalog, pricing, and content at scale using ordinary GET requests.
• Inventory hoarding and scalping prevention: Bots add limited stock to carts or buy it out in seconds, using the same checkout flow as your customers.
• Layer 7 DDoS: Distributed requests to expensive endpoints, such as search or login, exhaust your application while each individual request looks legitimate.
• API abuse: APIs serve raw data with no browser to challenge, and shadow APIs often sit outside WAF policies entirely. Purpose-built API protection closes a gap most WAFs treat as just another endpoint.

A useful test is to pick any of these attacks and ask which WAF rule would catch it without also blocking real customers. In most cases, no such rule exists.

WAF vs. bot management: The breakdown

A WAF asks yes or no against a rule. Bot management detects intent in real time, analyzing behavioral, device, and network signals on every request to decide whether the visitor is a human, a legitimate bot, an authorized AI agent, or a threat, regardless of whether the pattern has been seen before.

The market is converging on this layered model. Web application and API protection (WAAP) platforms bundle a WAF with bot management and API security. The label matters less than the capability: You need detection that evaluates intent and updates itself, because the threats evolve daily.

Here is how the two approaches compare:

What does real bot protection add?

Purpose-built detection analyzes intent, not just identity, in real time. Instead of asking whether a request matches a known bad pattern, it asks what this visitor is actually trying to do, based on how they behave across the session and how that behavior compares to billions of others.

In practice, this is what the DataDome bot layer adds on top of your WAF:

• Machine learning at global scale. DataDome’s detection engine analyzes 5 trillion signals per day across its customer network. When a new bot pattern appears on one site, protection updates everywhere, with no rule writing required.
• Real-time decisions with no user friction. Every request is evaluated in under 2 milliseconds, with 99.99% detection accuracy and a false positive rate below 0.01%.
• Coverage where bots actually attack. Detection applies across websites, mobile apps, and APIs, including the login, checkout, and form endpoints that AI traffic now targets most.
• Control over AI agents, not just blocking. Agent Trust verifies and allows legitimate AI agents, such as shopping assistants acting for real customers, while blocking malicious AI. A WAF cannot distinguish one agent from another in the first place.

How do you close the gap between a WAF and bot management?

Do not replace a WAF with purpose-built bot protection. Instead, layer purpose-built bot protection on top of your WAF. Each tool does the job it was built for:

1. Keep the WAF for vulnerability exploits, virtual patching, and compliance requirements.
2. Add real-time bot detection to stop credential stuffing, scraping, scalping, Layer 7 DDoS, and AI agent abuse.
3. Extend coverage to APIs and mobile apps, where WAF policies are weakest and bot operators concentrate their effort.
4. Measure the result. Track blocked automated requests, login fraud attempts, and the share of AI traffic on your most valuable endpoints.

Deployment does not require ripping anything out. Bot mitigation solutions like DataDome integrate with existing infrastructure, including major CDNs and cloud WAFs, and start classifying traffic within minutes.

Keep your WAF and add the bot layer with DataDome

A WAF is necessary but not sufficient. It earns its place by blocking exploits and patching vulnerabilities, but it cannot tell a human from a bot, and that is the question behind credential stuffing, scraping, scalping, and AI agent abuse. 

The practical first step is an audit. Most teams that run one find the gap is larger than they assumed. Test your site with DataDome’s free Vulnerability Scan today to see how your current defenses stack up.  

Interested in learning how DataDome can provide total visibility and control over your human, bot, and AI agent traffic? Book a demo to learn more.