How Do I Reduce Bot Checks for Logged-in Users While Using Anubis?

If you've noticed your logged-in members facing frequent anti-bot checks while using your site with Anubis protection, you're not alone. Many site operators want to keep security tight but reduce friction for trusted users. In this post, I’ll explain why these bot checks exist, what’s happening behind the scenes with Proof-of-Work, the history of Hashcash (the foundation of these checks), and why modern JavaScript features matter. You’ll also get practical advice on using trusted user bypass rules and cookie-based allowlists to create a smoother experience for your members.

Why Do Anti-Bot Pages Exist in the First Place?

At first glance, it might seem like these anti-bot pages — sometimes called "bot checks" — are annoying roadblocks. But they are critical to keeping your site safe and reliable.

The Problem: Bots Can Drain Your Site’s Resources

Bots, especially automated scraping or bad-actor bots, can do things like:

Drain your bandwidth and server capacity by hammering your website with requests Harvest content, pricing info, or user data Launch brute-force login attempts Distort your analytics with fake traffic

All these actions can cause slower experiences for real users and pose security risks.

What These Checks Do

Anti-bot pages introduce a small hurdle designed to be easy and invisible for real humans but challenging for bots. This might be a CAPTCHA, a JavaScript challenge, or a Proof-of-Work puzzle. The goal is to make it expensive or inconvenient for automated programs to keep hammering your site nonstop.

What Is Proof-of-Work? Explained in Plain English

One of the key anti-bot methods Anubis uses is Proof-of-Work. Despite the intimidating name, the concept is straightforward.

Think of It Like a Puzzle Your Browser Solves

Imagine your browser is given a simple but tricky puzzle every time it loads a page. The browser has to do some calculations — like guessing a number that fits certain rules — before it can "pass" and access the content. This shows the server the request is coming from a real browser, not a quick bot trying thousands of requests per second.

Because these puzzles require actual computing effort (work), bots trying to send many requests get slowed down, while regular users hardly notice the split-second delay.

Proof-of-Work vs CAPTCHA: What's the Difference?

CAPTCHA: Usually a visible test asking users to identify pictures, type distorted text, or click a checkbox. Proof-of-Work: A behind-the-scenes calculation your browser performs without disturbing the user.

Anubis primarily uses Proof-of-Work, not "captcha" in the traditional sense, so your users won’t typically see a challenge unless something suspicious is detected.

The Background: Hashcash and How Proof-of-Work Got Started

Proof-of-Work as a concept dates back to a 1997 proposal called Hashcash. It was originally designed to reduce unwanted emails (spam) by making sending them require a bit of computational effort — something easy https://stateofseo.com/anubis-says-could-not-load-its-javascript-how-do-i-fix-it/ for a legitimate sender sending one message, but costly for spammers sending millions.

How Hashcash Works, Simply Put

The sender’s device must find a value (a "nonce") that, when combined with the message, produces a specific kind of cryptographic fingerprint ("hash") that starts with zeros. This requires trial and error, testing many values, which takes time and computing power. When the sender finds a valid nonce, they send it along with the message. The recipient quickly verifies the nonce is valid — much cheaper than the sender’s initial work.

Anubis uses a similar principle. The browser does the Proof-of-Work puzzle once, then proves this to the server, which accepts the request.

JavaScript Requirements and Modern Features

For Proof-of-Work proof of work speed issue to work well, the browser needs to run certain JavaScript efficiently. This is why Anubis requires that modern browsers with JavaScript enabled load your pages without triggering unnecessary checks.

Why JavaScript Matters Here

The Proof-of-Work puzzle runs in JavaScript, so clients without JS or with very old browsers can’t solve it. Modern features like fast hashing functions and crypto APIs speed up puzzle solving. Disabling JavaScript or using outdated browsers often leads to repeated or fallback challenges, frustrating legitimate users.

Because of this, it is important to communicate to your users the importance of keeping JavaScript enabled and browsers updated, but more importantly, take server-side steps so your trusted logged-in users avoid these checks whenever possible.

How to Reduce Bot Checks for Your Logged-In Users with Anubis

Your members are your trusted users. For a frictionless experience, it’s best to let Anubis know they should bypass or get fewer challenges. Here is how to do it in practice.

1. Use Trusted User Bypass Rules

Anubis supports bypass rules that let you exempt certain users from anti-bot protections based on criteria like being logged in.

How it works: When a user logs in, your backend can signal Anubis — often via custom headers or tokens — that this user is "trusted." Implementation tips:
Set trusted user bypass rules in Anubis’s dashboard or configuration files. Match rules using session cookies, user agent, IP address, or custom headers from your login system. Test carefully to make sure bypass only applies to logged-in users and not open to abuse.

2. Implement a Cookie-Based Allowlist

Cookies are a great way to track a verified user’s status across visits without forcing repeated Proof-of-Work puzzles.

Once a logged-in user has solved the Proof-of-Work challenge once, Anubis can set a cryptographically secured cookie to mark them as allowed. On subsequent requests, the presence of this cookie tells Anubis to skip or reduce further checks. Ensure these cookies are secure, HTTP-only (if possible), and have a sensible expiration time to balance convenience and security.

3. Balance Security and Convenience

While reducing friction is important, remember to maintain a baseline of protection against abuse. Your trusted user rules and cookie allowlists should be:

Revoked or refreshed after logouts Limited in duration to prevent leaked credentials from giving indefinite bypass Monitored for abuse signatures like suspicious IP changes

Quick Checklist to Reduce Bot Checks for Logged-in Users

Step Action Why it Helps 1 Configure trusted user bypass rules tied to login status Immediately reduces bot checks for verified members 2 Set cookie-based allowlist tokens after Proof-of-Work completion Prevents repeated puzzles across pages and visits 3 Encourage users to enable JavaScript and use modern browsers Ensures puzzles run smoothly and invisibly 4 Test your rules across devices and sessions Prevents accidental blocks or bypass gaps 5 Monitor traffic and adjust rules regularly Keeps balance between security and smooth UX

Final Thoughts

Anti-bot pages and Proof-of-Work puzzles might feel like hurdles for your users, but they are vital defenses to keep your website safe from abuse. By thoughtfully implementing trusted user bypass rules and cookie-based allowlists with Anubis, you can reduce friction drastically for your valued logged-in members without sacrificing security.

Remember: the fastest fix is usually to set clear trusted user rules tied to login states and have your system-friendly cookies handle the rest. And always encourage users to keep JavaScript enabled — it's key to a smooth member experience.

If you want to learn more about configuring these settings in Anubis or need help crafting your bypass rules, don't hesitate to reach out to your Anubis support or consult their official documentation.