Vendor, ranked 1 (tied) of 15
AWS WAF Bot Control
In short
AWS WAF Bot Control is Amazon's bot filter inside its web application firewall: it grades yes on agent verification, per-purpose policy, charging, through an x402 response, and reporting, for 8 of 10 points, with commerce agents not published. Pricing combines a flat monthly charge for each web ACL with a fee per million requests once a free allowance is used.
Managed rule group in AWS WAF that labels and blocks bots, verifies AI agents with Web Bot Auth, and since June 2026 can charge AI bots per request with HTTP 402 on CloudFront.
Alternatives to AWS WAF Bot Control ยท aws.amazon.com
- Type
- Bot management
- Operator
- Amazon
- Homepage
- aws.amazon.com
- Last read
- 2026-11-05
The rubric, with evidence
| Question | Grade | What the vendor documents |
|---|---|---|
| Tells a verified agent from a spoof | Yes | Web Bot Auth (rule set Version_4.0+), verified self-identifying bots |
| Per-purpose policy (train, search, answer, act) | Yes | rules on bot category and name labels; prices can differ by bot identity and verification status |
| Charging for access | Yes | HTTP 402 x402 monetization on CloudFront, Coinbase x402 settlement in stablecoins |
| Lets signed commerce agents through | Not published | Visa TAP or Mastercard Agent Pay support (checked 2026-11-04) |
| Cost | published: USD 10/month per web ACL plus USD 1 or USD 10 per million requests after free allowance | |
| Reporting | Yes | Bot Control console dashboard, AI activity dashboard, CloudWatch metrics and logs |
| Where it runs | edge or regional: CloudFront edge and regional resources such as load balancers and API Gateway |
Cost
Bot Control USD 10/month per web ACL. Common level: first 10M requests/month free, then USD 1.00 per million. Targeted level: first 1M requests/month free, then USD 10.00 per million. Standard AWS WAF web ACL and rule charges also apply; AI traffic monetization has no extra charge. Source, read 2026-11-04.
What AWS WAF Bot Control does not do
- Monetize only works with CloudFront-associated web ACLs, not regional resources (Bot Control docs).
- Stripe payouts and Machine Payments Protocol are not live yet; settlement is via Coinbase x402 in stablecoins (what's new, 2026-06-15).
- Web Bot Auth is off unless the rule group version is pinned to Version_4.0 or later (Bot Control docs).
- AWS WAF Bot Control cannot verify bots that reach it through a proxy or load balancer unless the customer adds a rule ahead of the rule group.
- AgentCore Browser signing does not guarantee access; AWS says each site's bot policy decides.
Documented facts
- Primary source Common Bot Control costs USD 10 per month per web ACL with the first 10 million requests a month free, then USD 1 per million requests. Source, read 2026-11-04.
- Primary source Targeted Bot Control costs USD 10 per month per web ACL with the first 1 million requests a month free, then USD 10 per million requests. Source, read 2026-11-04.
- Primary source AI traffic monetization carries no additional charge beyond standard AWS WAF fees. Source, read 2026-11-04.
- Primary source Bot Control supports Web Bot Auth for bots and AI agents on CloudFront and Regional resources in commercial Regions; it needs AWSManagedRulesBotControlRuleSet Version_4.0 or later, explicitly selected. Source, read 2026-11-04.
- Primary source AWS announced Web Bot Auth support in AWS WAF in November 2025. Source, read 2026-11-04, dated 2025-11-21.
- Primary source AI traffic monetization (15 Jun 2026) returns a machine-readable HTTP 402 under the x402 protocol with prices, accepted payment methods and license terms. Source, read 2026-11-04, dated 2026-06-15.
- Primary source Settlement runs through Coinbase's x402 Facilitator with stablecoin payouts; Stripe direct payouts and Machine Payments Protocol support are listed as coming soon. Source, read 2026-11-04, dated 2026-06-15.
- Primary source The Monetize action works only on web ACLs attached to CloudFront distributions and takes a PriceMultiplier from 1 to 100. Source, read 2026-11-04.
- Primary source AWS warns that monetization classification is probabilistic and recommends Test mode before live charging. Source, read 2026-11-04.
- Primary source Labels from Bot Control carry bot category and bot name and flow into CloudWatch metrics and web ACL logs. Source, read 2026-11-04.
- Primary source Targeted protection adds browser interrogation, fingerprinting, behavior heuristics and optional machine learning for bots that do not self-identify. Source, read 2026-11-04.
- Primary source AWS launched an AI activity dashboard for AWS WAF in February 2026 for visibility into AI bot and agent traffic. Source, read 2026-11-04, dated 2026-02-24.
Compared with
- Cloudflare vs AWS WAF Bot Control: AWS WAF charges AI bots with an x402 HTTP 402 and settles in stablecoins through Coinbase (since 2026-06-15, CloudFront only); Cloudflare charges through pay per crawl with itself as Merchant of Record.
- AWS WAF Bot Control vs Akamai: AWS WAF publishes Bot Control prices (USD 10 a month per web ACL, USD 1 per million common requests after 10 million) and charges bots natively over x402; Akamai is sales-led and charges through partners.
- AWS WAF Bot Control vs DataDome: AWS WAF charges AI bots natively over x402 at no extra fee beyond WAF charges; DataDome charges through partners from its USD 8,670 Advanced plan.
- TollBit vs AWS WAF Bot Control: TollBit sells publisher analytics and a paywall reached by redirect; AWS WAF returns HTTP 402 itself and settles through Coinbase.
- Vercel vs AWS WAF Bot Control: Vercel splits AI crawlers from AI assistants on all plans for free; AWS WAF labels bots by category and name and can charge them, at USD 10 a month per web ACL plus request fees.
What AWS WAF Bot Control does for this layer
From the vendor's own pages
AWS WAF Bot Control records each Web Bot Auth check as a label: web_bot_auth:verified, web_bot_auth:invalid, web_bot_auth:expired or web_bot_auth:unknown_bot. (docs.aws.amazon.com) When the web_bot_auth:verified label is present, Bot Control's category rules and its TGT_TokenAbsent rule do not match, so verified signers pass. (docs.aws.amazon.com) Bot Control adds a bot:account label holding an opaque hash of the AWS account that owns an AgentCore agent, so rules can allow, block or rate-limit agents per account without exposing account IDs. (docs.aws.amazon.com) Bot Control treats bots labelled bot:user_triggered:verified, which end users may invoke directly, like unverified bots. (docs.aws.amazon.com)
Bot Control decides whether a bot is verified from the request's origin IP and cannot be set to read a forwarded IP header instead. (docs.aws.amazon.com) Amazon Bedrock AgentCore Browser's Web Bot Auth signing is in Preview and, when enabled, adds Signature, Signature-Agent and Signature-Input headers to every request. (docs.aws.amazon.com) AWS says AgentCore registers with bot control vendors such as Cloudflare and reCAPTCHA and gives them public keys for verification. (docs.aws.amazon.com) AWS's AgentCore guide warns that not every website recognises signed agent traffic and that domain owners may still block, monitor or rate-limit it. (docs.aws.amazon.com)
Products and plans
| Product | What it does | Price model | From | As of |
|---|---|---|---|---|
| AWS WAF Bot Control | Managed rule group with Common and Targeted levels, bot labels, Web Bot Auth verification and the Monetize action. | per web ACL plus per request | USD 10 | 2026-11-05 |
| Amazon Bedrock AgentCore Browser | Hosted browser for agents that can sign requests with Web Bot Auth (Preview). | |||
Standards
| Standard | Status | Evidence |
|---|---|---|
| Web Bot Auth | Supports | Bot Control Version_4.0 or later verifies Web Bot Auth and labels the result. (docs.aws.amazon.com) |
| Published IP list | Supports | Bot Control uses the request origin IP to verify bots. (docs.aws.amazon.com) |
| Reverse DNS check | No statement | The rule group page read 2026-11-05 does not name reverse DNS. |
| Visa Trusted Agent Protocol | No statement | No statement in the AWS WAF docs read 2026-11-05. |
| Mastercard Agent Pay | No statement | No statement in the AWS WAF docs read 2026-11-05. |
Our checks
| Check | Result | Method | Date |
|---|---|---|---|
| Homepage fetch | HTTP 200 | GET with the crawl user agent after a robots.txt check | 2026-11-05 |
Related pages on this site
Sources
- aws.amazon.com: bot control
- aws.amazon.com: pricing
- docs.aws.amazon.com: waf bot control
- aws.amazon.com: aws waf ai traffic monetization
- aws.amazon.com: aws waf web bot auth support
- aws.amazon.com: aws waf ai activity dashboard
- AWS WAF Bot Control rule group - AWS WAF Developer Guide
- Reducing CAPTCHAs with Web Bot Auth - Amazon Bedrock AgentCore
Last reviewed 2026-11-05