---
layout: article
title: Challenge automated traffic
description: Create Appwrite Firewall challenge rules that verify suspected bots before their requests continue.
difficulty: intermediate
readtime: 5
---

A challenge rule makes a visitor's browser solve a small puzzle before the request continues. Browsers solve it and pass, usually without the visitor noticing. Scripts do not.

Use a challenge on pages that attract abuse, such as sign-up, sign-in, and password reset, where an IP or country block would also stop legitimate users.

This guide puts a challenge in front of the sign-up page of a site.

# Create the challenge rule

![Create firewall rule wizard with challenge settings](/images/docs/firewall/challenge-bots.avif)

1. Open **Firewall** in your project.
2. Click **Create rule**.
3. Enter a **Rule name**, for example `Challenge sign-up`.
4. Set **Resource type** to **Sites** and select your site.
5. Under conditions, set **Path** **Starts with** `/signup`.
6. Under **Then**, choose **Challenge**.
7. Keep **Difficulty** at `3`.
8. Keep **TTL (seconds)** at `1800`.
9. Click **Create rule**.

Scope challenge rules to a **Site** or a **Function**. An **API** rule rejects matching requests instead of challenging them, because an API client has no browser to solve the puzzle with. See [Challenge](/docs/products/firewall/actions#challenge).

# Choose the paths to cover

Every condition on a rule must match, so one rule covers one path prefix. Create one rule per path prefix.

Do not build a challenge rule on **User agent** contains `curl`. Appwrite denies known bots before a challenge is issued, so the rule produces denials and **Challenged** stays at zero. See [Known bots are denied](/docs/products/firewall/actions#known-bots-are-denied).

Cover the page a visitor loads, not the path the form posts to. Appwrite serves the challenge page only for browser navigation, so a rule on a `POST` target returns `403` rather than a challenge. A visitor who is cleared on the page carries that clearance through the form submission.

# Verify the rule

1. Open the protected path in a browser.
2. Confirm the challenge page appears before the page loads.
3. Reload the page. The challenge does not appear again, because you are now cleared.
4. Open **Firewall** and confirm the **Challenged** series rises in the traffic overview. The **Challenged** tile also reports solved challenges and the average solve time.

If automated traffic keeps getting through, raise the difficulty. If first page loads feel slow, lower it.

[Resource scopes](/docs/products/firewall/scopes)