AWAFAWAF

First steps

An installed AWAF already works with default settings. This guide helps you enable extra bot analysis data and verify that protection works correctly.

1. Install AWAF

First install AWAF using the quick start guide. After installation, make sure the site opens and /antibot/config.ini exists.

  • If protection is not connected yet, return to the quick start and include AWAF in index.php or another early shared entry point.
  • If the site is behind a CDN, Cloudflare, or nginx proxy, configure real IP forwarding first.

2. Add AWAF Tags

Open the site template that contains </head> and insert the code before it. This is usually the shared header template of the theme or CMS.

<!-- AWAF Tags -->
<script type="text/javascript" src="/antibot/js/tags.js"></script>
<!-- End AWAF Tags -->

AWAF Tags is optional for protection. It silently passes the referrer and additional parameters that help analyze visitors. If you cannot add this code, use the utm_referrer setting below.

3. Configure the main Metrika counter

Open /antibot/config.ini and set the counter ID for the main site. This lets you see visitor IP and fingerprint data in Metrika.

[main]
metrika_site = "12345678"
save_referer = On
utm_referrer = Off
  • metrika_site is the Metrika counter ID for the main site.
  • save_referer = On passes the referrer silently when AWAF Tags is installed.
  • utm_referrer = Off should stay disabled when AWAF Tags is installed.

4. If AWAF Tags is not installed

Enable utm_referrer = On only when you cannot add AWAF Tags to the site template. In this mode, the referrer is passed through the URL parameter utm_referrer.

[main]
utm_referrer = On

When AWAF Tags is installed, keep utm_referrer = Off to avoid adding referrer data to URLs.

5. Configure a separate Metrika counter for bots

If you want to see what bots do on the check page, set a separate Metrika counter in metrika. This is usually a separate counter so bot activity is not mixed with legitimate users.

[main]
metrika = "87654321"

You can skip this step. For the first launch, the other settings can stay at their defaults.

6. Check that everything works

Open the site in a normal browser and visit several pages. Then check logs/antibot.log.

  • The log should contain new entries with IP, RayID, and check result.
  • A normal user should open the site without errors.
  • Suspicious traffic should receive CAPTCHA or BLOCK according to the settings.
  • If the log is empty, check that AWAF is included in an early site entry point.

7. Watch traffic for 24 hours

After installation, do not change many settings at once. Watch traffic for 24 hours: the share of bot traffic should decrease.

  • Check logs/antibot.log and Metrika.
  • You can send the log to ChatGPT or DeepSeek for analysis and more precise blocking rules.
  • If real users are blocked, first check proxy/CDN settings and URL whitelist entries for service paths.