Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Automated API abuse is the use of an application’s legitimate functions by software, at an abusive scale or in an abusive sequence, to produce an outcome the owner did not intend. It is not limited to denial-of-service floods or to exploiting a software bug. A login endpoint can be abused by replaying leaked passwords, a product API by extracting every record, and a checkout flow by buying up limited stock, and none of those requests has to be malformed. The practical work is to map each endpoint to the abuse it attracts, apply controls proportionate to that risk, and avoid blocking the automation you want to keep.
What counts as automated API abuse
OWASP’s Automated Threats to Web Applications project defines its scope as scenarios “automated by software causing a divergence from accepted behavior producing one or more undesirable effects on a web application.” The same definition excludes tool-based exploitation of single-issue vulnerabilities. That exclusion is what separates automated abuse from classic injection or access-control bugs: the individual requests may be valid, and the harm comes from how many of them arrive and in what order.
As an Amazon Associate I earn from qualifying purchases.
For API design, this means a fully patched API can still be abused. Traditional API security risks still need their own treatment, and the OWASP API Security Top 10 project covers those risks and mitigations for developers and assessors. Automated abuse sits alongside them, and it is the part that anti-automation controls address.
The abuse patterns OWASP names
OWASP’s project lists the recurring patterns below. The endpoint column reflects where OWASP places each pattern; where the guidance does not map a pattern to an endpoint, the table says so.
#1 Best Overall
| Abuse pattern | What the automation does | Endpoints most exposed (per OWASP) |
|---|---|---|
| Credential stuffing | Replays breached username and password pairs against login | Login |
| Fake account creation | Creates large numbers of accounts that serve no real user | Signup |
| Scraping | Extracts content or data at large scale | Search, catalog, public APIs |
| Scalping and inventory hoarding | Buys or holds limited stock faster than legitimate buyers can | Cart and checkout |
| Denial of inventory | Holds stock so legitimate buyers cannot purchase it | Not stated separately by OWASP |
| Carding | Tests stolen payment card data through purchase flows | Cart and checkout |
| Cashing out stolen accounts | Monetizes compromised accounts | Not stated by OWASP |
| Token cracking | Attempts to recover or guess tokens | Not stated by OWASP |
| Automated vulnerability scanning | Probes an application for weaknesses across its interfaces | Public APIs (automated probing) |
Abuse also distorts business metrics. Traffic counts, conversion rates and stock levels can all look healthy while the automation that inflates or depletes them is the real activity.
Automated does not mean malicious
OWASP’s Bot Management and Anti-Automation Cheat Sheet states the goal directly: “The objective is not to block all bots (search engine crawlers, monitoring agents, and accessibility tools are legitimate) but to raise the cost of abusive automation while keeping legitimate users and bots unaffected.”
The aim is therefore cost, not exclusion. Search crawlers, uptime monitors, assistive technologies and scripts that customers run against your API all produce automated traffic you probably want. A control that treats every non-human client as hostile breaks search visibility, monitoring and integrations, and it teaches legitimate developers to work around your limits.
Rank #2
Map each endpoint to its likely abuse
Endpoint function predicts the abuse. A login route invites credential stuffing, a signup route invites fake accounts, a search or catalog route invites scraping, and cart and checkout flows invite scalping and carding. Start the risk assessment from what each endpoint does for the business, then ask what an automated client would gain from it.
| Endpoint type | Likely abuse | Starting controls listed by OWASP |
|---|---|---|
| Login | Credential stuffing | Rate limiting, breached-password checks, MFA |
| Signup | Fake account creation | Verification and velocity limits |
| Search and catalog | Scraping | Identity-based rate limits and behavioral signals |
| Public API | Scraping and automated probing | API keys, per-key quotas, signed requests |
| Cart and checkout | Scalping, inventory hoarding, carding | Not stated in OWASP’s starting suggestions |
OWASP presents these as starting points for each endpoint type, not as a universal checklist that guarantees protection.
A defensive sequence
- Inventory endpoints. List public and sensitive API endpoints. Map each one to a business function and to the likely threat in the table above.
- Set baselines per endpoint. Record request rate, authentication failures, unusual account or token activity, and the business outcome that matters for the endpoint, such as completed signups or units sold. OWASP recommends endpoint-specific monitoring rather than treating all automation alike.
- Apply proportional controls. Choose the controls for each endpoint from the section below, not from a single site-wide rule.
- Measure side effects. Track false positives, legitimate integrations, accessibility impact and the privacy cost of the signals you collect. Do not assume every non-human client is abusive.
- Re-measure after each change. F5 Labs reports that persistent operators change tactics after controls are deployed, so compare the same baselines again once a control is live.
Choosing controls for each endpoint
Login: rate limiting, breached-password checks and MFA
Rate limiting slows the replay of credential pairs. Breached-password checks reject passwords already known to appear in leaked lists, which removes the value of replayed credentials for those accounts. MFA means a correct password alone no longer opens the account where it is enabled. The trade-off is friction for legitimate users, so define how users recover access before enforcing MFA on large groups.
Rank #3
Signup: verification and velocity limits
Verification makes each account cost something to create, and velocity limits cap how quickly one client can create accounts. Both add friction at the point where legitimate users are most likely to abandon signup, so measure completion rates before and after the change.
Search and catalog: identity-based limits and behavioral signals
Scraping is a volume problem. Identity-based rate limits tie the cap to an account, session or key rather than only to an address, so a client cannot escape a limit simply by changing one identifier. Behavioral signals such as request pacing and navigation patterns help where identity alone does not separate a scraper from a heavy human user.
Public APIs: keys, per-key quotas and signed requests
API keys let you attribute usage and revoke access. Per-key quotas bound how much any one integration can extract or probe. Signed requests add verification that a caller holds the key material for each request. Together they give you an accountable identity for each client, which is the precondition for every limit above.
Rank #4
- API Security in Action
- Manning Publications
- ABIS BOOK
Cart and checkout: business-rule limits
OWASP’s starting suggestions do not list controls for cart and checkout, so the limits here have to come from your own business rules. Examples include a cap on units per customer per product drop, a hold time on unpaid carts, and review of purchase patterns that are repeated across many accounts. These are design examples rather than OWASP recommendations, and they should be tested against your real purchase patterns.
Comparing controls on the same axes
Compare controls by the abuse they address, the friction they add, and what they cost to run. The inspected guidance does not give measured effectiveness figures for these controls, so judge them against your own baselines.
| Control | Helps most against | Main trade-off |
|---|---|---|
| Rate and velocity limits | Credential stuffing, scraping, fake signups | Can throttle busy legitimate clients; needs tuning |
| Breached-password checks | Credential stuffing against known-leaked passwords | Covers only passwords that appear in breach data |
| MFA | Credential stuffing against accounts with MFA enabled | Adds login friction; requires recovery paths |
| Verification at signup | Fake account creation | Drop-off among legitimate signups |
| Per-key quotas and signed requests | Scraping and probing of public APIs | Requires key issuance and lifecycle management |
| Behavioral signals | Scraping where identity alone is not enough | Collects more data; raises privacy and false-positive exposure |
OWASP warns that excessive fingerprinting can create privacy concerns, so keep the signals you collect tied to the control that uses them.
Best Value
What the 2025 figures show and what they do not
Two vendor reports give the clearest recent numbers. Each describes its own observation window and customer base.
Imperva’s 2025 Bad Bot Report
In its 2025 Bad Bot Report, Imperva says 31% of attacks it recorded and mitigated in the prior year were OWASP-defined automated threats. The same report says 44% of advanced bot traffic in 2024 targeted APIs. Both figures describe Imperva’s recorded and mitigated traffic and its advanced bot sample. Neither is a global rate for all internet attacks or all API requests.
F5 Labs’ 2025 Advanced Persistent Bots Report
F5 Labs’ 2025 Advanced Persistent Bots Report analyzes more than 200 billion web and API transactions from its Bot Defense customers, covering November 2023 through September 2024. Many of those customers had long-standing bot protection, so the sample shows what persistent automation still does against protected applications rather than an unprotected baseline. In that sample, more than half of web content page requests came from scrapers, and almost a quarter of web searches were automated.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The figures are single-period observations from each vendor’s own sample. They do not by themselves establish a year-over-year growth rate, so “rise” here describes scale and persistence rather than a measured trend.
Avoid blocking legitimate automation
- Decide explicitly how known good bots, such as search crawlers and monitoring agents, are treated, and document that decision.
- Give accessibility tools and customer integrations documented access through keys and quotas, not exemptions from logging.
- Track false-positive rates by endpoint and by client type, not as one overall number.
- Collect only the signals a control needs, so fingerprinting does not exceed its purpose.
- Keep a rollback path for each control, so a bad rule can be reversed without taking the endpoint offline.
When abuse moves after a control
Abuse often shifts rather than stops. Use the symptom to decide what to check next.
- Scraping continues after rate limiting. Check whether the traffic has moved to new keys or sessions. Shift the limit from address-based to identity-based, and watch behavioral signals on the same endpoint.
- Legitimate customers are blocked. Compare the blocked clients’ request patterns with the abusive ones. Adjust the quota for that key before loosening global limits, which would reopen the abuse.
- Login abuse drops but fake signups rise. The abuse has moved to another endpoint. Apply the signup controls from the table above and re-measure both endpoints together.
- Stock sells out in seconds while conversion falls. Check the cart and checkout baselines against your business rules, and confirm whether purchases are concentrated in a small set of accounts or sessions.
For the vendor and standards guidance behind these steps, see OWASP’s cheat sheet linked above and the OWASP API Security Top 10.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
