What Is F5 Bot Defense? – Definition and How It Works
Learn what F5 Bot Defense is, how it absorbed Shape Security, and the signals that identify it on a site.
F5 Bot Defense is F5's anti-automation product line, built substantially on the Shape Security technology F5 acquired. It targets automated abuse of application flows rather than content scraping specifically.
1. Where It Came From
F5 was historically a load balancer and application delivery company, with a WAF. Acquiring Shape Security added client-side telemetry and behavioural analysis aimed at credential stuffing and account takeover.
The consequence is a product family spanning two heritages:
| Origin | Character |
|---|---|
| F5 WAF / ASM | Rule-based request filtering, signatures |
| Shape technology | Obfuscated client telemetry, behavioural scoring |
Which you meet depends on what the site deployed, and they behave quite differently.
2. Deployment Positions
F5 products sit in several places, which affects what you observe:
- On-premise appliance or virtual edition in front of the origin.
- Distributed Cloud service, as a SaaS edge.
- JavaScript integration embedded in the site's own pages.
The last is the Shape-derived model: telemetry collected client-side and posted to an endpoint, with scoring server-side. It leaves markers in the page rather than only in headers.
3. Identifying It
| Class | Signal |
|---|---|
| Cookie | TS-prefixed cookies (TS01…, TSPD_101) |
| Header | X-Cnection, unusual header casing |
| Content | large obfuscated inline scripts |
| Payload | encoded POST bodies to a telemetry path |
| URL | scripts from F5/Shape telemetry domains |
| DOM | injected hidden form fields |
The TS-prefixed cookies are the classic F5 BIG-IP marker and the most reliable single signal. The X-Cnection header — a deliberate misspelling of Connection — is a long-standing F5 artefact and a strong tell when present.
4. Two Different Difficulties
Rule-based F5 behaves like any WAF: signatures, rate limits, geographic rules. A polite, honest, well-formed client frequently passes. Blocks are explicit.
Shape-derived F5 is a much higher bar: rotating obfuscated telemetry, behavioural requirements, and server-side scoring you cannot observe. It typically guards login and payment rather than content.
Identifying which you face is therefore the useful step, and the cookie and script signals distinguish them: TS cookies alone suggest the appliance; a large obfuscated telemetry script alongside a login form suggests the Shape lineage.
5. Scoring Without Blocking
Like other fraud-oriented products, the Shape-derived path often reports rather than blocks. The site decides what to do with a score.
So a session can be classified as automated, permitted to continue, and flagged — with consequences appearing later on the account rather than immediately as an error. Absence of a block is not evidence of success.
6. What This Means for Collection
- Check what is protected. If it is a login or checkout, the public content beside it is frequently ungated.
- Distinguish rule-based from telemetry-based using the signals above; the former is often workable, the latter is not.
- Persist cookies, since
TScookies carry session state. - Validate content rather than status codes.
- Do not attempt the telemetry path. Rotating obfuscation makes reimplementation unstable by design.
- For your own site, coordinate with whoever owns the F5 integration for a test configuration.
7. The Header-Casing Detail
F5 devices have historically been recognisable by unusual header handling — the X-Cnection misspelling, and specific header ordering or casing behaviour on responses.
This is a good illustration of a general principle: infrastructure leaves fingerprints in details nobody designed as identifiers. The same reasoning that lets sites fingerprint your client lets you fingerprint theirs.
8. Summary
F5 Bot Defense spans two lineages — rule-based WAF filtering from F5's own heritage, and obfuscated client telemetry with behavioural scoring from the Shape Security acquisition.
Identify it from TS-prefixed cookies and the X-Cnection header artefact, and determine which lineage you face, because a rule-based deployment often passes a polite honest client while the telemetry-based one guards account flows with rotating obfuscation and scores rather than blocks.