Stop unwanted bot swarms. Keep useful agents moving.

A group of automated visitors can turn one unwanted action into a recurring business problem. Blokk Bot connects automation evidence, the rules you approve and a supported response, so protection follows your policy as bots and agents work in parallel.

Protecting your own application? Explore the API integration.

Protect the workflow a swarm is trying to use.

A bot swarm is a group of automated workers acting towards a shared goal. An AI-agent swarm can divide a task between agents: one discovers pages, another compares products and another takes an action. That activity can serve a customer or exceed the access your business wants to provide. The useful boundary is what they do, what is authorised and what it costs your service.

Start with the shared destination: a catalogue, an account action, a form or an expensive API operation. A page-view spike alone cannot tell you whether visitors are coordinated. Keep evidence of a common account or authorised client separate from similarities in timing or behaviour.

One policy needs a clear scope.

1. Choose the action and the budget. Describe the unwanted repetition and the resource it consumes. Select a useful time window and decide whether a limit belongs to an account, an authenticated client or the operation itself.
2. Use evidence your integration can establish. Review the observations, their source and their binding. Treat an agent’s name or browser declaration as a claim unless separate evidence establishes it.
3. Match the response to that scope. Confirm where your integration can act. Test the restriction, permitted exceptions, expiry and release before relying on automatic handling.
4. Review what the response achieved. Keep the matched rule, the action actually taken and the later finding separate. Check whether unwanted activity continued through another route.

Application budgets matter even when no bot verdict is available. OWASP’s guidance on unrestricted resource consumption recommends limits appropriate to the operation, including request frequency and third-party spending. Blokk Bot’s assessments support your response policy; they do not replace those controls.

Start with Shopify. Protect application actions beyond it.

For Shopify, begin with free monitoring and the protection preview. Inspect observed activity that matches the supported account policy, then confirm the available checkout control before enabling paid protection. The account workflow addresses a defined pattern of overt automation; it does not establish that separate accounts belong to one swarm. Explore Shopify coverage and Free, Starter and Plus.

For an application you control, integrate at the backend action where your policy can take effect. Use the bot detection API alongside your existing access controls. Shared limits across accounts require application logic and evidence appropriate to that scope; an individual assessment is not a cross-account identity.

Test the group and the exceptions.

A useful regression run includes one automated worker, several concurrent workers, permitted automation and ordinary use of the same action. Also test independent accounts, missing optional browser evidence and recovery after a restriction expires. Run controlled scenarios only on systems you own or are authorised to test.

Record whether traffic ran, whether an assessment arrived and whether the intended action was actually restricted. A scripted result proves that scenario, not the behaviour of every real agent. The setup and testing guide explains the full review loop.

Choose the activity you want to stop.

Tell us which workflow bots or agents are repeating, which automation you want to permit and where the response needs to happen. We’ll help you choose a focused starting point. Read how to choose an automatic bot response or explore the product.