--- title: "AWS WAF Bot Control: bot management profile | Agent Ready Crawlers" description: "AWS WAF Bot Control: bot management and agent identity profile with a graded rubric, price read 2026-11-04, what it does not do, dated news and sources." canonical: https://agentreadycrawlers.com/vendors/aws-waf-bot-control site: "Agent Ready Crawlers" last_updated: 2026-11-05 section: "Vendors" --- # AWS WAF Bot Control: bot management profile | Agent Ready Crawlers > AWS WAF Bot Control: bot management and agent identity profile with a graded rubric, price read 2026-11-04, what it does not do, dated news and sources. Source: https://agentreadycrawlers.com/vendors/aws-waf-bot-control Site: Agent Ready Crawlers Last reviewed: 2026-11-05 Vendor, ranked 1 (tied) of 15 # AWS WAF Bot Control In short AWS WAF Bot Control is Amazon's bot filter inside its web application firewall: it grades yes on agent verification, per-purpose policy, charging, through an x402 response, and reporting, for 8 of 10 points, with commerce agents not published. Pricing combines a flat monthly charge for each web ACL with a fee per million requests once a free allowance is used. Managed rule group in AWS WAF that labels and blocks bots, verifies AI agents with Web Bot Auth, and since June 2026 can charge AI bots per request with HTTP 402 on CloudFront. Vendor description of itself, checked against its documents on 2026-11-04. [Alternatives to AWS WAF Bot Control](https://agentreadycrawlers.com/vendors/aws-waf-bot-control/alternatives/) ยท [aws.amazon.com](https://aws.amazon.com/waf/features/bot-control/) Type [Bot management](https://agentreadycrawlers.com/vendors/by-type/bot-management/) Operator Amazon Homepage [aws.amazon.com](https://aws.amazon.com/waf/features/bot-control/) Last read 2026-11-05 ## The rubric, with evidence | Question | Grade | What the vendor documents | Evidence | | --- | --- | --- | --- | | Tells a verified agent from a spoof | Yes | Web Bot Auth (rule set Version_4.0+), verified self-identifying bots | Bot Control docs section on Web Bot Authentication. Source, read 2026-11-04. | | Per-purpose policy (train, search, answer, act) | Yes | rules on bot category and name labels; prices can differ by bot identity and verification status | Monetize action uses Bot Control labels for pricing. Source, read 2026-11-04. | | Charging for access | Yes | HTTP 402 x402 monetization on CloudFront, Coinbase x402 settlement in stablecoins | What's new post 2026-06-15. Source, read 2026-11-04. | | Lets signed commerce agents through | Not published | Visa TAP or Mastercard Agent Pay support (checked 2026-11-04) | Not mentioned in Bot Control docs or announcements read. Source, read 2026-11-04. | | Cost | Not graded | published: USD 10/month per web ACL plus USD 1 or USD 10 per million requests after free allowance | WAF pricing page. Source, read 2026-11-04. | | Reporting | Yes | Bot Control console dashboard, AI activity dashboard, CloudWatch metrics and logs | Bot Control docs and Feb 2026 announcement. Source, read 2026-11-04. | | Where it runs | Not graded | edge or regional: CloudFront edge and regional resources such as load balancers and API Gateway | Web Bot Auth applies to CloudFront and Regional resources. Source, read 2026-11-04. | ## Cost Bot Control USD 10/month per web ACL. Common level: first 10M requests/month free, then USD 1.00 per million. Targeted level: first 1M requests/month free, then USD 10.00 per million. Standard AWS WAF web ACL and rule charges also apply; AI traffic monetization has no extra charge. [Source](https://aws.amazon.com/waf/pricing/), read 2026-11-04. ## What AWS WAF Bot Control does not do - Monetize only works with CloudFront-associated web ACLs, not regional resources (Bot Control docs). - Stripe payouts and Machine Payments Protocol are not live yet; settlement is via Coinbase x402 in stablecoins (what's new, 2026-06-15). - Web Bot Auth is off unless the rule group version is pinned to Version\_4.0 or later (Bot Control docs). - AWS WAF Bot Control cannot verify bots that reach it through a proxy or load balancer unless the customer adds a rule ahead of the rule group. - AgentCore Browser signing does not guarantee access; AWS says each site's bot policy decides. ## Documented facts Features are as the vendor documents them; we have not tested them. A claim a vendor makes about itself is marked as a vendor claim. - Primary source Common Bot Control costs USD 10 per month per web ACL with the first 10 million requests a month free, then USD 1 per million requests. [Source](https://aws.amazon.com/waf/pricing/), read 2026-11-04. - Primary source Targeted Bot Control costs USD 10 per month per web ACL with the first 1 million requests a month free, then USD 10 per million requests. [Source](https://aws.amazon.com/waf/pricing/), read 2026-11-04. - Primary source AI traffic monetization carries no additional charge beyond standard AWS WAF fees. [Source](https://aws.amazon.com/waf/pricing/), read 2026-11-04. - Primary source Bot Control supports Web Bot Auth for bots and AI agents on CloudFront and Regional resources in commercial Regions; it needs AWSManagedRulesBotControlRuleSet Version\_4.0 or later, explicitly selected. [Source](https://docs.aws.amazon.com/waf/latest/developerguide/waf-bot-control.html), read 2026-11-04. - Primary source AWS announced Web Bot Auth support in AWS WAF in November 2025. [Source](https://aws.amazon.com/about-aws/whats-new/2025/11/aws-waf-web-bot-auth-support), read 2026-11-04, dated 2025-11-21. - Primary source AI traffic monetization (15 Jun 2026) returns a machine-readable HTTP 402 under the x402 protocol with prices, accepted payment methods and license terms. [Source](https://aws.amazon.com/about-aws/whats-new/2026/06/aws-waf-ai-traffic-monetization), read 2026-11-04, dated 2026-06-15. - Primary source Settlement runs through Coinbase's x402 Facilitator with stablecoin payouts; Stripe direct payouts and Machine Payments Protocol support are listed as coming soon. [Source](https://aws.amazon.com/about-aws/whats-new/2026/06/aws-waf-ai-traffic-monetization), read 2026-11-04, dated 2026-06-15. - Primary source The Monetize action works only on web ACLs attached to CloudFront distributions and takes a PriceMultiplier from 1 to 100. [Source](https://docs.aws.amazon.com/waf/latest/developerguide/waf-bot-control.html), read 2026-11-04. - Primary source AWS warns that monetization classification is probabilistic and recommends Test mode before live charging. [Source](https://docs.aws.amazon.com/waf/latest/developerguide/waf-bot-control.html), read 2026-11-04. - Primary source Labels from Bot Control carry bot category and bot name and flow into CloudWatch metrics and web ACL logs. [Source](https://docs.aws.amazon.com/waf/latest/developerguide/waf-bot-control.html), read 2026-11-04. - Primary source Targeted protection adds browser interrogation, fingerprinting, behavior heuristics and optional machine learning for bots that do not self-identify. [Source](https://docs.aws.amazon.com/waf/latest/developerguide/waf-bot-control.html), read 2026-11-04. - Primary source AWS launched an AI activity dashboard for AWS WAF in February 2026 for visibility into AI bot and agent traffic. [Source](https://aws.amazon.com/about-aws/whats-new/2026/02/aws-waf-ai-activity-dashboard/), read 2026-11-04, dated 2026-02-24. ## Compared with - [Cloudflare vs AWS WAF Bot Control](https://agentreadycrawlers.com/compare/cloudflare-vs-aws-waf-bot-control/): AWS WAF charges AI bots with an x402 HTTP 402 and settles in stablecoins through Coinbase (since 2026-06-15, CloudFront only); Cloudflare charges through pay per crawl with itself as Merchant of Record. - [AWS WAF Bot Control vs Akamai](https://agentreadycrawlers.com/compare/aws-waf-bot-control-vs-akamai/): AWS WAF publishes Bot Control prices (USD 10 a month per web ACL, USD 1 per million common requests after 10 million) and charges bots natively over x402; Akamai is sales-led and charges through partners. - [AWS WAF Bot Control vs DataDome](https://agentreadycrawlers.com/compare/aws-waf-bot-control-vs-datadome/): AWS WAF charges AI bots natively over x402 at no extra fee beyond WAF charges; DataDome charges through partners from its USD 8,670 Advanced plan. - [TollBit vs AWS WAF Bot Control](https://agentreadycrawlers.com/compare/tollbit-vs-aws-waf-bot-control/): TollBit sells publisher analytics and a paywall reached by redirect; AWS WAF returns HTTP 402 itself and settles through Coinbase. - [Vercel vs AWS WAF Bot Control](https://agentreadycrawlers.com/compare/vercel-botid-vs-aws-waf-bot-control/): Vercel splits AI crawlers from AI assistants on all plans for free; AWS WAF labels bots by category and name and can charge them, at USD 10 a month per web ACL plus request fees. ## What AWS WAF Bot Control does for this layer ### From the vendor's own pages AWS WAF Bot Control records each Web Bot Auth check as a label: web\_bot\_auth:verified, web\_bot\_auth:invalid, web\_bot\_auth:expired or web\_bot\_auth:unknown\_bot. ([docs.aws.amazon.com](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html)) When the web\_bot\_auth:verified label is present, Bot Control's category rules and its TGT\_TokenAbsent rule do not match, so verified signers pass. ([docs.aws.amazon.com](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html)) Bot Control adds a bot:account label holding an opaque hash of the AWS account that owns an AgentCore agent, so rules can allow, block or rate-limit agents per account without exposing account IDs. ([docs.aws.amazon.com](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html)) Bot Control treats bots labelled bot:user\_triggered:verified, which end users may invoke directly, like unverified bots. ([docs.aws.amazon.com](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html)) Bot Control decides whether a bot is verified from the request's origin IP and cannot be set to read a forwarded IP header instead. ([docs.aws.amazon.com](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html)) Amazon Bedrock AgentCore Browser's Web Bot Auth signing is in Preview and, when enabled, adds Signature, Signature-Agent and Signature-Input headers to every request. ([docs.aws.amazon.com](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-web-bot-auth.html)) AWS says AgentCore registers with bot control vendors such as Cloudflare and reCAPTCHA and gives them public keys for verification. ([docs.aws.amazon.com](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-web-bot-auth.html)) AWS's AgentCore guide warns that not every website recognises signed agent traffic and that domain owners may still block, monitor or rate-limit it. ([docs.aws.amazon.com](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-web-bot-auth.html)) ## Products and plans | Product | What it does | Price model | From | As of | | --- | --- | --- | --- | --- | | AWS WAF Bot Control | Managed rule group with Common and Targeted levels, bot labels, Web Bot Auth verification and the Monetize action. | per web ACL plus per request Common level includes 10M requests a month free; Targeted includes 1M; AI traffic monetization has no extra charge. | USD 10 | 2026-11-05 | | Amazon Bedrock AgentCore Browser | Hosted browser for agents that can sign requests with Web Bot Auth (Preview). | No price recorded | ## Standards | Standard | Status | Evidence | | --- | --- | --- | | Web Bot Auth | Supports | Bot Control Version_4.0 or later verifies Web Bot Auth and labels the result. (docs.aws.amazon.com) | | Published IP list | Supports | Bot Control uses the request origin IP to verify bots. (docs.aws.amazon.com) | | Reverse DNS check | No statement | The rule group page read 2026-11-05 does not name reverse DNS. | | Visa Trusted Agent Protocol | No statement | No statement in the AWS WAF docs read 2026-11-05. | | Mastercard Agent Pay | No statement | No statement in the AWS WAF docs read 2026-11-05. | ## Our checks | Check | Result | Method | Date | | --- | --- | --- | --- | | Homepage fetch | HTTP 200 | GET with the crawl user agent after a robots.txt check | 2026-11-05 | ## Related pages on this site - [All bot management vendors](https://agentreadycrawlers.com/vendors/by-type/bot-management/) 23 profiles - [The full vendor list](https://agentreadycrawlers.com/vendors/) 73 profiles in four types - [Amazon Bedrock AgentCore Browser](https://agentreadycrawlers.com/crawlers/agentcore-browser/) no token - [Alternatives to Amazon Web Services (AWS WAF Bot Control, AgentCore Browser)](https://agentreadycrawlers.com/vendors/aws-waf-bot-control/alternatives/) graded on the rubric ## Sources - [aws.amazon.com: bot control](https://aws.amazon.com/waf/features/bot-control/) read 2026-11-04 - [aws.amazon.com: pricing](https://aws.amazon.com/waf/pricing/) read 2026-11-04 - [docs.aws.amazon.com: waf bot control](https://docs.aws.amazon.com/waf/latest/developerguide/waf-bot-control.html) read 2026-11-04 - [aws.amazon.com: aws waf ai traffic monetization](https://aws.amazon.com/about-aws/whats-new/2026/06/aws-waf-ai-traffic-monetization) read 2026-11-04 - [aws.amazon.com: aws waf web bot auth support](https://aws.amazon.com/about-aws/whats-new/2025/11/aws-waf-web-bot-auth-support) read 2026-11-04 - [aws.amazon.com: aws waf ai activity dashboard](https://aws.amazon.com/about-aws/whats-new/2026/02/aws-waf-ai-activity-dashboard/) read 2026-11-04 - [AWS WAF Bot Control rule group - AWS WAF Developer Guide](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html) read 2026-11-05 - [Reducing CAPTCHAs with Web Bot Auth - Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-web-bot-auth.html) read 2026-11-05 Last reviewed 2026-11-05