> For the complete documentation index, see [llms.txt](https://waap.docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://waap.docs.link11.com/reference-information/hostile-bot-detection-lwcsi.md).

# Hostile Bot Detection / LWCSI

For detecting hostile bots, Link11 WAAP uses a multi-layered mechanism, collectively known as "bot challenges". Its results are shown to admins in the ["challenges" metric](/how-link11-waap-works/traffic-reporting-and-analytics.md#metrics) in L11WAAP's analytics; for a discussion of how challenges impact traffic statistics, see [here](/how-link11-waap-works/traffic-reporting-and-analytics.md#the-challenge-process) and [here](/how-link11-waap-works/traffic-reporting-and-analytics.md#how-requests-are-reflected-in-l11waaps-statistics).

Bot challenges mitigate threats based on the requestor's identity and environment. When L11WAAP receives the first request from a previously unknown traffic source (below described as the "user"), this is the typical process that is followed.

1. **L11WAAP challenges the user's browsing environment.** L11WAAP uses a variety of proprietary, multi-faceted techniques to verify that this requestor is a human using a browser, instead of a bot using a headless browser or emulator. (For more detailed information, see [Environmental detection and browser verification](/reference-information/hostile-bot-detection-lwcsi/environmental-detection-and-browser-verification.md).)
2. **If the challenge is not passed, the request is suspected to be a bot, and another challenge is issued.** This process continues until a challenge is passed, or a threshold is reached (e.g., via a Dynamic Rule) to ban the requestor. 
3. **If the challenge is passed, the browser's session is authenticated**, and the browser receives cookies from L11WAAP.
4. **The browser then automatically resubmits the original request**, but this time, the cookies are included. The user is granted access to the requested URL, resources, etc.
5. **Subsequent requests will also include the cookies,** and thus, they are not challenged.

This process happens quickly (in a few milliseconds), and is **invisible** to the user. 

Much of the challenge process is based on a variety of methods, collectively known as Link11 WAAP Client Side Inspection (**LWCSI**). It detects bots via a multi-layered approach, described on the following pages:

* [Environmental detection and browser verification](/reference-information/hostile-bot-detection-lwcsi/environmental-detection-and-browser-verification.md)
* [Client authentication](/reference-information/hostile-bot-detection-lwcsi/client-authentication.md)
* [Biometric behavioral verification](/reference-information/hostile-bot-detection-lwcsi/biometric-behavioral-verification.md)

{% hint style="info" %}
Out of the box, L11WAAP uses "active" bot challenges. **We also recommend that admins enable "passive" challenges.** More information is here: [Active Challenges versus Passive Challenges](/how-link11-waap-works/traffic-reporting-and-analytics.md#active-challenges-versus-passive-challenges).
{% endhint %}

Lastly, in addition to the LWCSI mechanisms described above, L11WAAP also includes [Interactive Challenges](/console-walkthrough/system/interactive-challenge.md).