Summary: Traditional bot detection relies on IP addresses and user agents—easily spoofed. Edge-based client fingerprinting combines browser, device, and behavioral signals to identify bots with 98%+ accuracy and < 100ms latency. This technical guide shows how to build a real-time bot detection system at the edge.
The bot arms race:
Traditional bot detection is losing. Bots now use:
The result: IP-based and user-agent-based detection catches only 30-40% of bots. The rest passes through undetected.
The solution: Client fingerprinting at the edge—combining 50+ signals to create unique device identifiers that bots can't spoof without significant effort.
| Detection Method | What It Checks | Bot Bypass Difficulty | Detection Rate |
|---|---|---|---|
| IP Reputation | IP address | Easy (rotating proxies) | 30-40% |
| User Agent | Browser string | Trivial (any string) | 15-20% |
| Rate Limiting | Request frequency | Easy (slow down) | 20-30% |
| CAPTCHA | Human challenge | Easy (solver services) | 50-60% |
| Client Fingerprint | 50+ signals | Hard (must spoof all) | 95-99% |
Client fingerprinting collects 50+ signals from the browser/device:
The key insight: Spoofing one signal is easy. Spoofing all 50+ signals consistently is extremely hard. Inconsistencies reveal bots immediately.
Client → Edge Node → Fingerprint Engine → Decision Engine → Action
↓ ↓
Fingerprint DB ML Classification
Collected from network/TLS handshake (no JavaScript needed):
Detection Rate: 60-70% of bots detected from passive fingerprinting alone.
Collected via lightweight JavaScript challenge:
Detection Rate: Additional 25-30% of bots detected.
Collected during user interaction:
Detection Rate: Additional 5-10% of sophisticated bots detected.
| Fingerprinting Layer | Bots Detected | Cumulative |
|---|---|---|
| Passive (TLS/TCP/HTTP) | 65% | 65% |
| Active (Canvas/WebGL/Audio) | 28% | 93% |
| Behavioral (Mouse/Typing/Scroll) | 5% | 98% |
// Edge function: Extract passive fingerprints
export default {
async fetch(request) {
const fingerprint = {
// TLS fingerprint (from edge platform)
ja3: request.cf?.tlsJA3Hash || 'unknown',
// IP analysis
ip: request.headers.get('CF-Connecting-IP'),
country: request.headers.get('CF-IPCountry'),
asn: request.cf?.asn,
// HTTP/2 fingerprint
h2Settings: request.cf?.httpProtocol,
// Bot score from platform
botScore: request.cf?.botManagement?.score || 50,
};
// Check against known bot fingerprints
if (isKnownBotFingerprint(fingerprint.ja3)) {
return new Response('Blocked', { status: 403 });
}
// Add fingerprint to request headers for origin processing
const modifiedRequest = new Request(request, {
headers: new Headers(request.headers)
});
modifiedRequest.headers.set('X-Fingerprint', JSON.stringify(fingerprint));
return fetch(modifiedRequest);
}
};
// Lightweight JavaScript challenge (injected by edge function)
(function() {
const fp = {};
// Canvas fingerprint
const canvas = document.createElement('canvas');
const ctx = canvas.getContext('2d');
ctx.textBaseline = 'alphabetic';
ctx.font = '14px Arial';
ctx.fillText('EdgeOne Bot Detection', 2, 15);
fp.canvas = canvas.toDataURL().hashCode();
// WebGL fingerprint
const gl = canvas.getContext('webgl');
fp.webglVendor = gl?.getParameter(gl.VENDOR) || '';
fp.webglRenderer = gl?.getParameter(gl.RENDERER) || '';
// Screen fingerprint
fp.screen = `${screen.width}x${screen.height}x${screen.colorDepth}`;
fp.dpr = window.devicePixelRatio;
// Timezone
fp.timezone = Intl.DateTimeFormat().resolvedOptions().timeZone;
// Send fingerprint to edge for validation
fetch('/api/fingerprint', {
method: 'POST',
body: JSON.stringify(fp),
headers: { 'Content-Type': 'application/json' }
});
})();
// Behavioral tracking (lightweight, privacy-respecting)
let mouseEvents = [];
let keyEvents = [];
document.addEventListener('mousemove', (e) => {
mouseEvents.push({ x: e.clientX, y: e.clientY, t: Date.now() });
if (mouseEvents.length > 50) analyzeMouseBehavior();
});
function analyzeMouseBehavior() {
// Calculate mouse movement entropy
const angles = [];
for (let i = 1; i < mouseEvents.length; i++) {
const dx = mouseEvents[i].x - mouseEvents[i-1].x;
const dy = mouseEvents[i].y - mouseEvents[i-1].y;
angles.push(Math.atan2(dy, dx));
}
// Humans have high angle entropy; bots have low
const entropy = calculateEntropy(angles);
// Entropy < 2.0 = likely bot; > 3.0 = likely human
if (entropy < 2.0) flagAsSuspicious();
}
// Edge function: ML-based bot classification
export default {
async fetch(request) {
const fingerprint = extractFingerprint(request);
// Run lightweight ML model at edge
const features = [
fingerprint.ja3Score,
fingerprint.canvasConsistency,
fingerprint.webglConsistency,
fingerprint.mouseEntropy,
fingerprint.typingVariance,
fingerprint.screenConsistency,
fingerprint.timezoneMatch,
];
const botProbability = runMLModel(features);
if (botProbability > 0.95) return block(request);
if (botProbability > 0.70) return challenge(request);
return allow(request);
}
};
Ecommerce store with 72% bot traffic:
Before (IP + User Agent Detection):
After (Edge Client Fingerprinting):
Results:
When choosing a platform for fingerprinting-based bot detection, ensure it includes:
✅ Passive Fingerprinting (TLS/TCP)
✅ Active Fingerprinting (Browser)
✅ Behavioral Analysis
✅ ML Classification
✅ Edge Execution
✅ CAPTCHA-Less Blocking
Mistake 1: Relying on Single Fingerprint Signal
Single signals are easily spoofed. Combine 50+ signals for robust detection.
Mistake 2: Not Handling Fingerprint Evolution
Browsers update fingerprints regularly. Your detection must adapt to browser changes.
Mistake 3: Over-Blocking
Aggressive detection creates false positives. Start conservative, tune based on real data.
Mistake 4: Not Allowing Good Bots
Googlebot and Bingbot are legitimate. Whitelist known good bots by verified identity.
Mistake 5: Running Fingerprinting at Origin
Fingerprinting at origin wastes bandwidth and adds latency. Run at edge for zero-overhead detection.
Traditional bot detection is failing. Edge-based client fingerprinting detects 98%+ of bots with < 100ms overhead.
Get Started in 3 Steps:
| Plan | Best For | Specifications | Original Price | Promo Price |
|---|---|---|---|---|
| Free | Personal Developers, MVP Teams | Basic protection & static acceleration | —— | $0/month |
| Personal | Early-Stage Businesses | 50GB + 3M requests | CDN + Security | $4.2/month | $0.9/month |
| Basic | Growing Businesses | 500GB + 20M requests | OWASP TOP 10 | $57/month | $32/month |
| Standard | Enterprise Businesses | 3TB + 50M requests | WAF + Bot Management | $590/month | $299/month |
Get Started with Tencent Cloud EdgeOne
View Current Promotions & Discounts
Stop 98% of bots. Edge-based client fingerprinting detects bots that IP and user-agent detection misses. Try it free today.