Kavra LabWhat a bot is
Short for robot, a bot is any software that talks to your site instead of a human. It can be a ten-line script that requests one page every minute or a fleet of real browsers running thousands of sessions in parallel. What makes it a bot is not the tool but the fact that no person is making each decision.
Bots are a normal part of the web. Search engines, uptime monitors, link previews and accessibility checkers all rely on them. The problem is the share of automated traffic that exists to take something: accounts, data, inventory or money. That is why the useful question is rarely "is this a bot?" but "what kind of bot, and what is it trying to do?"
Common types of bots
| Type | What it does | Usually |
|---|---|---|
| Search crawler | Reads pages so they appear in search results | Wanted |
| AI agent | Browses or buys on behalf of a user | Depends on the operator and task |
| Monitoring bot | Checks uptime, speed or page changes | Wanted |
| Scraper | Copies prices, listings or content at scale | Unwanted |
| Credential stuffing bot | Tests leaked username and password pairs | Unwanted |
| Scalping bot | Buys limited stock or tickets in seconds | Unwanted |
| Spam and signup bot | Creates fake accounts, posts spam, requests OTPs | Unwanted |
How bots reach your site
The simplest bots are HTTP clients that fetch pages directly and never run JavaScript. More capable ones drive a real headless browser so the site's own scripts run as normal. The most advanced add an antidetect browser to fake a different device for every session, route traffic through residential or mobile proxies so each request comes from a real home IP, or run on racks of real phones in a device farm.
Each step up costs the operator more, so the effort tells you something. A bot that pays for proxies and spoofed devices to reach your login or bonus page is almost never there by accident.
- Simple scripts: cheap, fast, easy to block by how they connect.
- Headless and automated browsers: run your JavaScript, harder to separate from users.
- Disguised automation: spoofed devices and home IPs, built to pass one check at a time.
- Human-assisted bots: a person solves the challenge, the script does the rest.
How to detect and manage bots
Blocking every bot would cut you off from search engines and useful agents, and blocking by IP alone misses bots on home networks. Good bot management verifies the bots that say who they are, then judges everything else on evidence from several layers at once: network, device, browser integrity and behavior. Kavra does this on every visit and returns allow, verify or block with the reasons behind it. See how it separates verified AI agents from impostors and catches headless and automated browsers, and read about good bots and bad bots.