Complex content management made easy

AWS recently introduced support for "CAPTCHA" and "Challenge" actions for their AWS Web Application Firewall (WAF).

The CAPTCHA action presents a puzzle to the end user and allows access to your website only if the presented puzzle is solved correctly. The puzzle is designed to be easily solved by humans but hard to solve for computers. The “Challenge” action silently checks if the request comes from a real person's internet browser or if the request is done by a bot or site crawler.

We’ve used this to help enhance the security of our clients’ sites, without limiting access to legitimate front-end users.  For example, before instituting the new AWS CAPTCHA, we had set a rule with inspection criteria that measured the rate of requests for a given end-user IP address. When the rate was too high, we applied a WAF “Blocking” rule for the given IP address.

We have now changed the rule action to "Challenge" which does not directly block the IP address, but tests the request as either a bot or a real end-user. Bots get blocked, and real end-users are still able to access the website. This allows us to make the rate-limiting rule (requests per minute) to be even more strict - allowing fewer requests per minute. We further customize this by making sure the action only triggers based on a combination of rate limits or regional criteria.