Salesforce released guidance on bot mitigation strategy that acknowledges a fundamental shift in ecommerce traffic patterns. Automated traffic now makes up Salesforce Commerce Blog, and during Cyberweek, malicious bot traffic comprises approximately Salesforce Commerce Blog. Scraping instances have increased Salesforce Commerce Blog, representing the largest attack vector. However, not all bot traffic is harmful; AI assistants and LLM-powered search tools crawling ecommerce sites determine brand visibility when shoppers ask ChatGPT, Claude, or Perplexity for product recommendations.
Salesforce recommends a three-layer defense framework: edge defense through CDN/WAF rules (rate limiting, IP blocking, Managed Challenge, Waiting Room), application-level hardening (robots.txt tuning, rate limiting on sensitive pages like checkout and cart), and analytics integrity through server-side validation. The core challenge for commerce practitioners is selective traffic management—allowing beneficial AI crawlers while blocking scrapers, scalpers, and credential stuffers. Blocking AI crawlers indiscriminately risks disappearing from a new discovery channel that powers high-intent traffic; leaving traffic unmanaged risks slower site performance and distorted analytics.
Salesforce positions bot mitigation as a shared responsibility between brands, platform providers, and eCDNs. Pre-peak preparation is critical: audit robots.txt files, configure self-service eCDN settings in log mode before peak traffic, evaluate Waiting Room for flash sales, loop in edge teams early for approval-gated protections, and stress-test checkout and login flows. The brands that balance these defenses before peak season enter high-traffic events with fast, stable storefronts and full visibility in AI-driven retail markets.