Built in Austria · EU-hostedBuilt in Austria. 100% EU-hosted.Learn more

Stop malicious bots before they hit origin

Bot Protection classifies every request, then allows, challenges, or blocks — across sites, apps, and APIs. Observe first, enforce when ready, with analytics and settings you control.

Get a demo Start free trial

Trusted by global brands, public institutions, and universities

Apps, forms, and APIs at risk

Where bot abuse lands before teams notice.

Form and signup abuse: Bots flood forms and signups with fake submissions, burning ops time and polluting CRM data.
API and app attacks: Automated clients hammer endpoints, inflate load, and open paths for credential stuffing and fraud.
Spoofed and hidden bots: Clients fake Googlebot or mimic browsers so they slip past basic filters and waste capacity.
Skewed product decisions: Bot traffic distorts analytics and conversion metrics before teams notice.

Decision engine

Allow, challenge, or block for every request in real time.

Trusted traffic through.: Humans and verified clients keep moving without friction.
Step up when risk rises.: Challenge borderline sessions; block clear abuse before origin.

console.atmosvere.eu/analytics/bots

Bad bot analytics

Last 7 days

Blocked

14k

Challenged

59k

Of traffic

34%

Bot outcomes

BlockedChallenged

Mon

Tue

Wed

Thu

Fri

Sat

Sun

Top types

Credential stuffing35%
API abuse24%
Content scrapers22%
Carding probes19%

Protection analytics

See challenges, blocks, and mitigation with trends you can act on.

Protection actions.: Challenged, blocked, and mitigation rate over time.
Bad-bot pressure.: Spot spikes before they burn capacity or conversions.

Challenge outcomes

See how challenges resolve interactive, non-interactive, or unsolved.

Interactive solves.: Typed-code challenges completed by real users.
Non-interactive solves.: Frictionless / proof-of-work checks that passed without a puzzle.
Unsolved.: Challenges never completed — often bots that walk away.

console.atmosvere.eu/bot-protection

Challenges Breakdown

Last 7 days

Total Challenged

28k

Interactive Solved

Non-Interactive Solved

16k

Unsolved

Challenged Requests Breakdown

Interactive SolvesNon-Interactive SolvesUnsolved

Mon

Tue

Wed

Thu

Fri

Sat

Sun

Request mix

Humans, crawlers, and unrecognized clients in one traffic view.

Client types.: Allowed, challenged, and blocked by kind.
Trust partners.: Allow partner user agents, optionally locked to confirmed IPs.
Spoofed vs verified.: Compare fake crawler volume with real same-period crawls.

Customize protection

Tune enforcement to your risk publish and adapt as traffic changes.

Observe or enforce.: Site-wide observe, challenge-only, or full allow/challenge/block.
Challenge page style.: Based on risk, always type a code, or click-only.
Signals and paths.: VPN, datacenter, spoofed crawler, page overrides, and burst volume.
Automatic blocks.: From spoofed-crawler-only to strong bot signals or high risk score.

console.atmosvere.eu/bot-protection/settings

Protection settings

Publish to go live in about a minute.

General mode

Click a mode (demo).

Automatic blocks

Click a mode (demo).

Challenge page

Click a style (demo).

console.atmosvere.eu/bot-protection/settings?tab=pages

Page overrides

Click an action to change (demo).

Path	Action
/articles/*
/premium/*
/pricing
/api/catalog/*
/health

console.atmosvere.eu/bot-protection/settings?tab=signals

Signals

Click an action to change (demo).

Signal	Action
Spoofed crawler
VPN
Datacenter
Botnet IP lists
Request headers

Unrecognized clients

Request volume

Click a level (demo).

Key benefits

Full bot management for product and security teams

Allow, challenge, or block.: Classify every request before origin and enforce the right action in real time.
Observe, then enforce.: Run observe-only to learn traffic, then challenge or block when you are ready.
Spoofed crawler detection.: Catch clients that claim a known crawler identity from the wrong IP ranges.
Path and signal policies.: Tighten sensitive paths, tune VPN/datacenter/header signals, and publish in about a minute.
CAPTCHA when risk needs it.: Hosted challenge and blocked pages with adaptive or step-up modes via CAPTCHA Alternative.
APIs, apps, and sites.: Same check-request path for websites, apps, and APIs — on your server or at the edge.

Integration

Integrate in minutes Deploy on your stack, then set path rules in the admin panel.

console.atmosvere.eu/bot-security

Bot Security Settings

Configure global and route-based bot protection.

Page sensitivity overrides

Path	Sensitivity
/login/*
/checkout
/signup
/pricing
/blog/*

Exclude paths

/api/webhooks/*Excluded/healthExcluded/static/*Excluded

check-request.js

const API = 'https://api.trustedaccounts.org/api/v1/check-request';

const ip = req.headers['x-forwarded-for'] ?? '';
const requestedPath = req.originalUrl ?? '/';

const apiRes = await fetch(API, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: 'Bearer YOUR_SECRET_KEY',
  },
  body: JSON.stringify({ ip, requestedPath }),
  signal: AbortSignal.timeout(400),
});

const { decision } = await apiRes.json();
// On timeout, fail open per your policy — see integration guide
// ... handle allow, challenge, or block

For developers

Any tech stack On your server or at the edge (CDN).

View protection integration docs

Simple, transparent pricing

Bot Protection for sites, apps, and APIs. No hidden fees.

Bot Protection

Classify traffic, publish policy, and enforce allow, challenge, or block — with analytics and CAPTCHA Alternative included.

What's included

Allow, challenge, and block decisions before origin
Request mix, mitigation, and user-agent analytics
Path, signal, country, and trusted-client policies
European-owned infrastructure with GDPR-first architecture

Starting at

See pricing

View Full Pricing

Includes a 7-day free trial. Contact us for enterprise pricing.

Frequently asked questions

What is Bot Protection vs Bot Shield?: Bot Protection is the console product: classify traffic, publish policies, and enforce allow, challenge, or block. Bot Shield is the marketing name for that platform — including CAPTCHA Alternative, crawler management, and related use cases.
Will this slow down real users?: No. Decisions run on your server or at the edge before origin, with fail-open on timeout so legitimate traffic is not stuck behind a check.
Can we start without blocking anyone?: Yes. Use observe mode to classify and log decisions while always serving the page. Switch to challenge-only or full enforce when you are ready. New visits pick up published settings in about a minute.
Does it protect APIs as well as forms?: Yes. Integrate check-request on any request path — HTML pages, app routes, or APIs — then allow, challenge, or block before you spend origin capacity.
How do scrapers and AI crawlers fit in?: Spoofed crawlers and abusive automation are handled in Bot Protection. Verified AI and SEO crawlers are managed in Crawler Management; content theft is covered under Scraper Protection.
Where is Atmosvere hosted?: Made and hosted in the EU on European-owned infrastructure. Austrian company. EU-only data residency, GDPR-first.

Testimonials

Trusted by teams across Europe who rely on Bot Shield to protect applications, APIs, and infrastructure.

Martin Kautz
Head of Development & Engineering, RedaktionsNetzwerk Deutschland (RND)

Frank Zapototschny
Senior Online Marketing Manager, Media Lab Bayern

Mag. Karin Dietl
Data Protection Lawyer (CDPSE), Lecturer FH Vienna

European by design

Built for European trust. Austrian company. European-owned infrastructure. GDPR-first by default.

Requests analyzed: Billions
Bot checks: Hundreds
Infrastructure: EU-owned
Mission: 1

Stop bot abuse before it hits origin

Deploy Bot Protection, observe your traffic, then enforce allow, challenge, and block with full control.

Get a demo Start free trial