# Bot management

> Telling automated traffic from people and handling it on its own terms: challenging a suspicious client, rate limiting it, or blocking it, rather than failing every rule match outright.

Security

## In Quorum

Bot management research halves a WAF’s false positives and keeps its block rate. A suspicious client gets a challenge, so a real user it flags still loads the page. Bots still earn nothing and still cost capacity when they get through, so the WAF stays the first place to stop them.

## Design

[WAF](https://wiki.playquorum.dev/design/05-components.md#waf)

## Read next

[WAF (web application firewall)](https://wiki.playquorum.dev/glossary/waf-web-application-firewall.md), [Rate limiting](https://wiki.playquorum.dev/glossary/rate-limiting.md), [DDoS (distributed denial of service)](https://wiki.playquorum.dev/glossary/ddos-distributed-denial-of-service.md), [Load shedding](https://wiki.playquorum.dev/glossary/load-shedding.md)

## Learn more

- [Cloudflare Learning Center: What is bot management?](https://www.cloudflare.com/learning/bots/what-is-bot-management/)

## See also

- [Glossary](https://wiki.playquorum.dev/glossary.md)

Source: https://wiki.playquorum.dev/glossary/bot-management