Introduction

This document covers how to view your site’s web traffic and configure its security settings from Pigmint Admin. To learn about what role these configurations play in our defense-in-depth strategy, check out this post: https://pigmint.io/blog/defense-in-depth-pigmint/

Bot Check

Bot Check is a mode that enables a ReCAPTCHA v3 challenge screen for all requests. This will mitigate bot traffic to your site. After a visitor successfully passes the challenge, their IP gets whitelisted and all requests coming from their IP address will bypass bot check challenges for 24 hours.

In certain situations, we may shorten the whitelisting period. While nuisance bot traffic is normal and unavoidable, please contact us if you feel that bots are negatively affecting the performance of your site.

How to Enable Bot Check

Security settings screen: Bot check "on", assess CAPTCHA with IP "on", minimum risk analysis score "0.5", and alerting "on".

Navigate to the “Security” tab.
Under “Site Security Settings”, toggle Bot Check “On”.
Save.

Configurations

Assess CAPTCHA with IP: If on, the user’s IP address will get sent to the ReCAPTCHA assessment server with the assessment request. This provides more context and allows for a more accurate assessment. However, this may result in lower scores for users using VPNs or proxies.

Minimum Risk Analysis Score: ReCAPTCHA scores are from 0.0 to 1.0, 0 meaning “definitely a bot” and 1 meaning “definitely a human”. Usually, legitimate users score between 0.8 and 1.0; however, many factors go into scoring, and setting 0.8 as the minimum may be too strict. If you enable bot check, it’s best to set the minimum reasonable low (we don’t recommend below 0.5) and monitor your traffic logs to see what your requests are scoring. You can update the minimum score at any time.

When bot check is enabled, the assessments will start appearing as “human” and “bot” instead of “ok” and “malicious”. See the definitions below for details on each log field.

Website assessment log: human assessment allowed on 4/3/2025, while the pending assessment was redirected to a bot check page.

Can I leave bot check on all the time?

Yes, but it’s not recommended. Keep in mind that this will effectively eliminate your SEO (Search Engine Optimization). Beneficial bots, like googlebot and bingbot, need to crawl your site to index its contents. If you leave bot check on all the time, these beneficial bots will not be able to access your site. Learn more about SEO here: https://pigmint.io/blog/seo-basics-for-small-business-owners/

If you’d like to keep bot mitigation on all the time, we can set tailored rules in Cloudflare’s WAF (Web Application Firewall). Some common rules include “challenge all requests from outside of the United States”, or “block all requests from [insert country]”. Contact us for more info.

Alerting

You can set alerts when request rates reach a set threshold. This is a simple rate-based trigger. The appropriate limit will differ based on how much traffic your site normally gets, and the norm can change over time. However, if, for example, your site usually gets less than 1000 unique requests per day, setting an alert for 1000 requests per second can be useful to notify you of unusual activity.

How to Enable Alerts

Site security settings panel with options for bot check, CAPTCHA, risk analysis, alerting, and notification emails.

Navigate to the “Security” tab.
Under “Site Security Settings”, toggle Alerting “On”.
Add the email address(es) that you want alerts to be sent to. Separate multiple email addresses with a comma.
Save.

Configurations

Alert Trigger: Specify the request rate at which you want to be alerted. For example: “notify me if my site gets 1000 requests in one second”

Alert Interval: Usually, the request rate will be sustained for a period of time. This is the frequency of alerts during the period of time that the request rate is being exceeded. For example:

The Alert Trigger is set to 1000 requests per 1 second
At 9:00:00 AM the site is getting 1000 requests per second.
The site gets over 1000 requests per second until 9:15:00 AM.
If the alert trigger was set to 1, an alert would be sent out every minute during the triggered event, 15 alerts total.
If the alert trigger was set to 30, only one alert would be sent out at the beginning of the triggered event.

Notification Emails: The emails the alerts should be sent to. You can list multiple emails — separate each email with a comma.

Traffic Logs

Review your traffic logs to get a glimpse into your web traffic.

Traffic logs for 4/3/2025 showing assessment, path, action, and reason for multiple malicious requests blocked or reported.

Log Fields

Timestamp: Timestamp of the event, adjusted to your local time.

Assessment:

ok: The request is valid.
bot: The requestor failed the ReCAPTCHA challenge.
malicious: The request failed analysis. This could be because the requesting IP is blacklisted, reached the rate limit, requested invalid routes too many times, or is requesting a blocked url.
human: The requestor passed the ReCAPTCHA challenge.
pending: No assessment was made, likely due to getting redirected to the ReCAPTCHA challenge page.

Path: The requested path in the url. E.g. https://yourwebsite.com/about -> /about

Action:

block: The request was blocked.
allow: The request was granted access to your site.
report: The request was blocked and the IP was reported to Pigmint.
redirect: The request was redirected to another route.

Reason: The reason for the action. If the assessment was “allow”, the reason is “N/A”

Score: The ReCAPTCHA evaluation score, from 0.0 to 1.0. 0 means that the requestor is a bot, and 1 means that the requestor is human. If bot check is off, the score is N/A.

Requestor ID: The requestor’s hashed IP address.

Filters

Search through your logs by filtering on any field.

A dialog box with filter options for data including start/end dates, assessment, path, action, requester ID, and health check.

Include Health Check

Our system checks your site routinely to ensure it it active and available. By default, these requests are hidden. To view these health check requests, check “Include Health Check” in the filter.

Example health check request.

Docs

Discover Pigmint

Browse Recent