What are bot protection policies and CAPTCHA in AGS for; how do they differ from Bot/DDoS protection?

Short answer

Bot Protection Policies catch the automated traffic in the requests AGS handles (the login, MFA and other access pages, and requests whose session is not authenticated) with a Trigger Type (Static, Requests, Auth Failures, Bot Score) and apply an Action (Deny, Tarpit, Block, Bandwidth Limit, Captcha, Show Content). CAPTCHA Providers define the verification service used in the Captcha action of these policies and in the CAPTCHA level of the lockout policies: TR7 Captcha, which runs on the device, or Google reCAPTCHA, hCaptcha, Cloudflare Turnstile. Bot/DDoS Protection, on the other hand, protects all the traffic of the vService and looks at volume, source reputation and client behavior; the AGS Bot Score trigger uses the bot score produced by this module's Bot Protection.

How Does It Work?

1. The policy is bound to the vService; when AGS is first enabled, Standard Rate Limiting, Bot Score CAPTCHA Challenge and Bot Score Deny are bound automatically.
2. On every request AGS handles, the trigger is evaluated: Static matches on every request; Requests and Auth Failures count per key of the selected Policy Scope (Global, IP Address, IP + User Agent, Composite) within the Trigger Window Duration; Bot Score compares the request's bot score with the Bot Score Threshold.
3. The action is applied on the triggered request; with the Captcha action, the user is redirected to the verification of the selected CAPTCHA provider, and a successful solution is considered valid for the Do Not Ask Again Timeout duration.

Comparison

	AGS Bot Protection Policies	Bot/DDoS Protection
Scope	Requests AGS handles; the application requests of users whose session is authenticated do not pass through these policies	All HTTP requests coming to the vService
What it looks at	Request rate, number of failed authentications, bot score or every request	Volume (L7 DDoS Protection), source reputation (IP Reputation Protection), client behavior and bot score (Bot Protection)
What for	Password guessing attacks and automation aimed at login pages	Volumetric attacks, sources with a bad reputation and bots aimed at the whole application
Monitoring	The vService's AGS Bot Protection tab (appears if there is a policy that keeps a count or block table)	Bot/DDoS Protection screens

The two work together on the same vService and do not replace each other. The score the Bot Score trigger reads is the score produced by the Bot Protection of Bot/DDoS Protection; even when this protection is not on in the vService, on an AGS-enabled vService the score is calculated with all the factors and the Bot Score policies work.

Policies and CAPTCHA in TR7

• The policies are defined on the AGS → Protection Policies → Bot Protection Policies screen and are selected on the vService in the Flowchart's General Settings window, in the Bot Protection Policies field; multiple policies work together.
• Built-in policies: Static TR7 CAPTCHA Protection (Captcha on every request), Standard Rate Limiting (300 requests / 1 minute, Deny 429), Strict Rate Limiting (100 requests / 1 minute, Block 5 minutes), Rate Limiting with TR7 CAPTCHA (150 requests / 1 minute, Captcha), Bot Score CAPTCHA Challenge (score 60 and above, Captcha) and Bot Score Deny (score 85 and above, Deny 403) (built-in profiles).
• CAPTCHA providers are defined on the AGS → Protection Policies → CAPTCHA Providers screen; the built-in Standard TR7 CAPTCHA and Hard TR7 CAPTCHA profiles are available. TR7 Captcha requires no external connection; Google reCAPTCHA, hCaptcha and Cloudflare Turnstile require the site and secret key, together with access to these services from the user's browser and from TR7.

Common Misconceptions

• "AGS bot policies protect the whole application." The policies are applied to the requests AGS handles; for the application traffic of a logged-in user, Bot/DDoS Protection is used.
• "Bot/DDoS Protection must be turned on for the Bot Score trigger." On an AGS-enabled vService, the bot score is calculated even if Bot/DDoS Protection is not on. If Bot Protection is configured in Bot/DDoS Protection, AGS reads the same score with the factors in that configuration.
• "Auth Failures and Account lockout are the same." The Auth Failures trigger counts failed authentications per client key (e.g. IP) and applies a bot action; what locks the account and runs the warning / CAPTCHA / lock levels is the Account Lockout Policy (What is an Account Lockout Policy; how does account lockout work?).

How it is done in the documentation

• Bot Protection Policies · What Are Bot Protection Policies?
• Bot Protection Policies · Built-in Profiles
• CAPTCHA Providers · What Are CAPTCHA Providers?
• AGS - AAM · The Difference from WAF and Bot/DDoS

Related questions

• What is the difference between AGS, the WAF and Bot/DDoS protection?
• Can I verify humans with a CAPTCHA?
• How do I detect bots; can I allow good bots (Googlebot etc.) and block bad ones?
• What is an Account Lockout Policy; how does account lockout work?