Web traffic is one of the most important areas for business security because the web is the main path for both legitimate business activity and attacks. Employees browse websites, use SaaS applications, download files, click links in emails, and interact with cloud services. Attackers use the same channels to deliver malware, steal credentials, and automate abuse.

A modern business security strategy needs to answer:

1. Who is accessing my systems?
2. Is the traffic human or automated?
3. Is the bot good, bad, or unknown?
4. Should this traffic be allowed, challenged, rate-limited, or blocked?

1. Understanding web traffic

Web traffic generally comes from:

Legitimate human users

Examples:

• Employees
• Customers
• Partners
• Remote workers

Normal behavior:

• Browsing pages
• Logging into applications
• Filling forms
• Downloading documents
• Making purchases

Good bots

Not all bots are bad. Some are essential:

Bot	Purpose	Example
Search engine crawlers	Index websites	Google, Bing
Monitoring bots	Check uptime	Website monitoring services
Security scanners	Identify vulnerabilities	Approved security tools
API bots	Automate business processes	Integrations

Good bots usually:

• Identify themselves properly
• Respect robots.txt rules
• Follow predictable patterns
• Do not overload systems

Bad bots

Bad bots are automated tools used for abuse:

Type	Goal
Credential stuffing bots	Try stolen usernames/passwords
Scrapers	Steal pricing, content, inventory
Spam bots	Submit fake forms/comments
DDoS bots	Overwhelm services
Vulnerability scanners	Search for weaknesses
Malware bots	Deliver malicious files

A large percentage of internet traffic is automated, so simply blocking “bots” would break useful services. The challenge is classification.

---

2. How businesses filter web traffic

A layered approach works best.

Layer 1: DNS filtering

DNS is often the first security checkpoint.

Example:

User types:

example-login-security.com

DNS security checks:

• Is this domain known malware?
• Is it phishing?
• Is it newly registered?
• Is it associated with criminal infrastructure?

If suspicious:

User → DNS filter → BLOCK

Common business solutions:

• Secure DNS services
• Firewall DNS filtering
• Endpoint security DNS protection

---

Layer 2: Web proxy / Secure Web Gateway (SWG)

A web gateway sits between users and the internet:

Employee
   |
   ↓
Web Security Gateway
   |
   ↓
Internet

It can inspect:

• Website reputation
• URLs
• Categories
• Downloads
• File types
• SSL/TLS traffic (with appropriate controls)
• User identity

Example policy:

Category	Action
Business websites	Allow
Banking	Allow
Gambling	Block
Malware sites	Block
Unknown newly created domains	Challenge

---

Layer 3: Firewall filtering (Fortinet example)

A FortiGate firewall can inspect web traffic using:

• Web filtering
• Application control
• Intrusion prevention
• Antivirus scanning
• Botnet detection
• Threat intelligence feeds

Example:

Employee Laptop
       |
       |
   FortiGate
       |
       +-- Is IP malicious?
       |
       +-- Is domain dangerous?
       |
       +-- Is download infected?
       |
       +-- Is behavior abnormal?
       |
       ↓
    Internet

---

3. Detecting good vs bad bots

Modern systems use multiple signals.

A. Identity signals

A good bot usually provides:

• Verified user agent
• Reverse DNS verification
• Known IP ranges

Example:

Good:

Googlebot
Verified Google IP

Suspicious:

Mozilla/5.0
Random cloud server IP
10,000 requests/minute

---

B. Behavior analysis

Humans behave differently from bots.

Human pattern:

• Clicks vary
• Reading time exists
• Mouse movement
• Different navigation paths

Bot pattern:

• Perfect timing
• Thousands of requests
• Same URL repeatedly
• No interaction

Example:

Normal customer:

Page 1
(wait 20 seconds)
Page 2
(wait 40 seconds)
Checkout

Bot:

/product?id=1
/product?id=2
/product?id=3
/product?id=4
(5000 requests/min)

---

C. Rate limiting

A simple but powerful control:

Example:

Normal user:
100 requests / minute = OK

Unknown bot:
10,000 requests / minute = Block

---

D. CAPTCHA and challenges

Do not challenge everyone. It creates user frustration.

Better:

Low risk:

Allow

Medium risk:

Browser challenge

High risk:

Block

---

4. A business web security architecture

A mature setup often looks like this:

                Internet
                    |
                    |
          Web Application Firewall
                    |
                    |
             Firewall (FortiGate)
                    |
        -------------------------
        |                       |
    Employees              Servers
        |
 Endpoint Security
        |
 Browser Protection

For external websites:

Visitors
   |
Bot Detection
   |
WAF
   |
Application

---

5. Recommended controls for a business

Minimum

✅ DNS filtering
✅ Firewall with web filtering
✅ Endpoint protection
✅ MFA
✅ Patch management
✅ Logging and monitoring

Better

✅ Secure Web Gateway
✅ Zero Trust access
✅ User behavior analytics
✅ Bot management
✅ Threat intelligence feeds

Advanced

✅ SIEM monitoring
✅ SOAR automation
✅ Machine-learning anomaly detection
✅ Managed detection and response (MDR)

---

6. Fortinet specifically

For a business using Fortinet, a typical stack could include:

• FortiGate → firewall + web filtering + IPS
• FortiGuard services → threat intelligence and URL reputation
• FortiClient → endpoint security
• FortiAnalyzer → logs and security analysis
• FortiManager → centralized management

The goal is not “block everything.” The goal is:

Allow legitimate people and trusted automation, slow down suspicious behavior, and stop malicious traffic before it reaches users or systems.