# Traffic Classification > Understanding what is accessing your site, how trustworthy the interaction is, and what action should be taken. --- ## Overview Traffic classification is the process of determining the type and trust level of an interaction based on observed signals. The goal is not simply to identify whether traffic is automated. Modern websites receive many types of automated traffic: * search engine crawlers * ad verification systems * AI indexing tools * security tools * testing frameworks * fraud automation Some automation is valuable and expected. Other automation creates risk. Traffic classification helps distinguish between these categories by combining evidence from multiple detection layers. --- # How Classification Works Traffic classification is built on evidence collected from four intelligence layers: ```text id="w4j8pq" Detection Signals ↓ 1. Network Intelligence 2. Protocol Intelligence 3. Browser Intelligence 4. Behavioural Intelligence ↓ Traffic Classification ↓ Policy Decision ``` No single signal determines classification. A classification represents the most likely explanation of the observed traffic based on available evidence. --- # Not All Automation Is Bad Automation is an essential part of the modern internet. Examples of legitimate automation include: * search engines discovering content, * ad verification systems ensuring advertising quality, * AI systems indexing publicly available information, * testing systems validating website functionality. The objective of traffic classification is not to block automation. The objective is to understand: * who is accessing the site, * why they are accessing it, * whether the activity should be trusted, * what action is appropriate. --- # Classification Categories ## Trusted Automated Traffic These categories represent known or expected automated access. --- ## SEO Crawler SEO crawlers help search engines discover and understand website content. SEO is critical for many websites, and SEO crawlers are allowed by default. Classification considers: * crawler identity, * expected behaviour, * infrastructure characteristics, * request patterns. The goal is to avoid interfering with legitimate search visibility. --- ## Ad Verification Tool Ad verification tools are used to validate advertising placement, quality, and compliance. These tools are allowed by default because they serve an important role in maintaining advertising ecosystems. Classification distinguishes verification activity from fraudulent automated activity. --- ## Helpful AI Crawler AI crawlers may access publicly available content for discovery and indexing purposes. Examples include systems similar to search-oriented AI indexing tools. These are treated differently from abusive scraping because their purpose and behaviour differ. --- # Human Traffic ## Real Visitor A Real Visitor represents a confirmed genuine user interaction. Signals may include: * consistent browser environment, * expected protocol behaviour, * normal interaction patterns, * no significant indicators of automation. --- ## Likely Real Visitor A Likely Real Visitor represents traffic where classification signals were not sufficient to determine the legitimacy of the access. This category reflects a conservative approach: > When there is insufficient evidence to confidently classify traffic as automated, avoid unnecessary blocking. This helps reduce false positives and preserve legitimate access. --- # Infrastructure Risk ## Untrusted IP Untrusted IP classification identifies traffic originating from known higher-risk infrastructure. Examples include: * known proxies, * datacenter infrastructure, * suspicious network sources. These sources can often be filtered quickly because infrastructure reputation provides strong evidence. However, IP reputation is treated as one signal rather than a complete identity. Future support may include authenticated testing workflows for legitimate users operating from these environments. --- # Automated and Untrusted Traffic ## Request Bot Request Bots are simple HTTP-based automation systems that do not execute JavaScript like a normal browser. Examples include: * curl-based tools, * Python requests libraries, * simple HTTP clients. Characteristics may include: * missing browser execution, * protocol-level inconsistencies, * absence of normal browser behaviour. Request Bots are differentiated from browser automation because they represent a different class of automation. --- ## Definitely Bot Definitely Bot represents confirmed automation, typically from a browser-capable environment. These clients often execute JavaScript and may attempt to behave like real browsers. Two common paths lead to this classification: --- ### Browser Execution Failure The client is expected to behave like a browser but fails required checks. Examples: * JavaScript does not execute correctly, * required browser capabilities are missing, * environment values are inconsistent. --- ### Browser Automation Detection The client successfully executes JavaScript but exposes strong indicators of automation. Examples: * automation framework characteristics, * inconsistent browser APIs, * impossible environment combinations, * strong automation signals. Some automation systems can generate valid cookies or solve challenges through external services, but the surrounding environment may still reveal that automation is occurring. --- ## AdvancedRequestBot AdvancedRequestBots are request-level automation systems designed to appear more like real browsers. They may use techniques such as: * advanced HTTP clients, * TLS impersonation, * browser-like request generation, * cookie-solving workflows. Unlike simple Request Bots, these systems attempt to reproduce browser-level signals without operating a complete browser environment. --- ## AdvancedStealthBrowser AdvancedStealthBrowsers are sophisticated browser automation environments designed to reduce traditional automation indicators. Characteristics may include: * customized browser environments, * reduced automation fingerprints, * deeper browser modification, * more realistic browser behaviour. These systems require deeper analysis because simple automation checks may no longer be sufficient. Detection relies on: * environmental consistency, * protocol behaviour, * network intelligence, * behavioural signals. --- # Future Classifications ## AuthenticatedTesting (Coming Soon) Many organizations need automated testing for development and regression workflows. AuthenticatedTesting is planned as a mechanism that allows approved automation systems to access protected sites without disabling protection. Potential approaches include: * authenticated headers, * verification mechanisms, * trusted testing identifiers. The goal is supporting legitimate testing without weakening production protection. --- ## PaidUser (Coming Soon) Some organizations need ways to monetize access from automated systems that consume publicly available content. PaidUser is planned as an access mechanism that can allow organizations to create controlled commercial access models. Potential use cases include: * approved data access, * API-style access, * monetized automated consumption. --- # Classification Philosophy Traffic classification is not a simple binary decision. A useful model is: ```text id="j6r4cz" Observed Traffic ↓ What generated it? ↓ How trustworthy is it? ↓ What purpose does it serve? ↓ What action should be taken? ``` The same technical behaviour can have different meanings depending on intent. Examples: * A search crawler may be automated but valuable. * A fraud bot may be automated and harmful. * A manual click farm may not be automated but may still be invalid. * A testing framework may resemble a bot but be authorized. Context matters. --- # Key Takeaways * Traffic classification determines what is accessing a site and how it should be treated. * Automation is not automatically malicious. * SEO crawlers, ad verification tools, and helpful AI crawlers are recognized separately from unwanted automation. * Request Bots are different from browser-based automation. * Definitely Bot generally represents browser-capable automation with strong evidence. * AdvancedRequestBots and AdvancedStealthBrowsers require deeper analysis. * Unknown states are handled conservatively to reduce false positives. * The strongest classifications come from combining network, protocol, browser, and behavioural intelligence. --- # Related Documentation * `bot-detection.md` * `invalid-traffic.md` * `browser-fingerprinting.md` * `replay-attacks.md` * `automation-analytics.md` * `click-fraud.md`