What is a Verified Bot; how does TR7 treat verified search engine crawlers?

Short answer

A Verified Bot is a search engine or AI crawler that is verified to come from the address ranges published by its owner (e.g. Googlebot, Bingbot). TR7 performs the verification not according to the User-Agent but according to whether the source address is in the Verified Bot group in the network type database; a client that introduces itself as Googlebot but comes from outside these ranges is not counted as a Verified Bot. In Bot/DDoS protection there is a separate exemption switch for each protection: Trust Verified Bots in Bot Protection and IP Reputation Protection and Verified bots skip the queue in Waiting Room are on by default, while Trust Verified Bots in L7 DDoS Protection is off by default. In Load Balancer conditions, a rule specific to this traffic is written with Network Type Category or Network Type Group = Verified Bot.

Where It Is Used in TR7

Where	Field / label	Default	What it does
Bot/DDoS Management → Bot Protection → Edit	Trust Verified Bots	On	The score is still calculated and recorded; the Action Rules action and the browser check are not applied
Bot/DDoS Management → IP Reputation Protection → Edit	Trust Verified Bots	On	Even if the address is in a reputation category, it does not enter the rule list; it is counted as Trusted Bot on Dashboard
Bot/DDoS Management → L7 DDoS Protection → Edit	Trust Verified Bots	Off	Exempts verified bots only from the source IP based limits (Source IP Request / Connection / Error Protection); the country, network type and total limits continue to be applied
Bot/DDoS Management → Waiting Room	Verified bots skip the queue	On	Verified crawlers do not see the waiting page
Bot/DDoS Management → Bot Protection → Factors	Crawler Impersonation	-	Adds points to a client that introduces itself as a search engine bot and comes from outside the published ranges
Load Balancer → Conditions	Network Type Category / Network Type Group = Verified Bot	-	An action specific to verified bot traffic

The settings are located on the Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management tab of the vService.

Common Misconceptions

• "A request whose User-Agent says Googlebot is a verified bot." The verification looks at whether the source address is in the published ranges; an imitating client is not counted as a Verified Bot and receives points from the Crawler Impersonation factor.
• "A Verified Bot is not caught by any protection." The exemption is a separate switch per protection. The switch in L7 DDoS Protection is off by default; even when it is turned on, it covers only the source IP based limits.
• "The Bot Protection exemption resets the score." The score is still calculated and written to Event Logs and Dashboard; only the action is not applied.

How it is done in the documentation

• Bot Protection Edit · Trust Verified Bots
• L7 DDoS Protection Edit · Trust Verified Bots
• IP Reputation Protection Edit · Trust Verified Bots
• Network Type Category · Scenario 3: Special Behavior for Verified Bots

Related questions

• How do I detect bots; can I allow good bots (Googlebot etc.) and block bad ones?
• What is a bot; how is the difference between a good bot and a bad bot handled in TR7?
• What is Network Type; how does it differ from IP Reputation?