Holiday traffic spikes don't break stores so much as expose what was already fragile. A checkout that limped through September at 300 orders a day can face ten times that in a single weekend, plus a few hundred automated clients quietly testing stolen cards, scraping prices, and holding your best-selling SKU hostage in abandoned carts.

Bot monitoring is the part of peak-season prep that gets deferred until after the CDN configuration and the shipping cutoffs. That's a mistake. By the time a carding run hits the Friday after Thanksgiving, the only options left are reactive ones: block an ASN, raise a challenge level, hope for the best. The work that actually helps happens in the quiet weeks before, when you can measure, tune and rehearse.

What follows is a checklist for that window. It assumes you have some visibility already — server logs, a WAF, an analytics stack, maybe a dedicated bot tool — and that the goal isn't to block every automated request. It's to stop bots from doing expensive things.

Build a baseline before you need one

You can't recognise abnormal behaviour without knowing what normal looks like. Pull two to four weeks of traffic from a steady period and write down the numbers, not just glance at a dashboard. Store them somewhere your on-call person can find them in December.

• Requests per session, segmented by user agent, IP, ASN and path
• Session depth — how many product pages a typical buyer opens before checkout
• Add-to-cart to completed-order ratio, plus median time from cart to payment
• Login attempts and new account creations per hour
• Failed payment attempts broken out by IP, device fingerprint and card BIN
• Volume on search, autocomplete and any product API you expose

Segment by page type too. Your homepage has a different traffic signature than a paginated category listing, and both differ from the checkout endpoint. A single global average hides exactly the anomalies you're looking for.

Know the three threats you'll actually meet

Scrapers

Price comparison engines, competitor monitoring tools and resellers pulling your catalogue. Signs include sequential product IDs requested in order, sessions that never load images or CSS, suspiciously regular request intervals, and deep pagination that no human would ever click through. Scraping is cheap to ignore and expensive to dismiss: it leaks your pricing strategy and your inventory levels to anyone who wants them.

Carding bots

These are the ones that cost real money. Automated scripts try stolen card numbers against your payment flow, often with a low-priced item, looking for a success they can exploit. Watch for bursts of failed authorisations followed by a pass, many accounts sharing one device fingerprint, mismatched billing and shipping addresses, disposable email domains, and bulk gift card purchases. Some operations check cards with a small order rather than a full checkout, so treat repeated authorisation attempts as a signal on their own.

Inventory hoarding

Bots add high-demand items to a cart without paying, reserving stock that legitimate shoppers then can't buy. Some do it to resell later; some do it simply to deny inventory. The tell is quantity: carts holding twenty of a limited item, or dozens of near-identical carts created from one device in the same hour, recurring each time your stock count refills.

Instrument the cart and the checkout, not just the front door

Most monitoring stops at request volume, which is the least interesting number on the page. The expensive events happen later in the funnel, so instrument them deliberately.

• Cart creations per device fingerprint per hour, and how fast they repeat
• Items per cart compared with your normal basket size
• Time between add-to-cart and the start of checkout — real buyers pause; scripts don't
• Coupon and promo code attempts per session
• Address edits and payment method changes mid-checkout

If your inventory reservation has a timeout, check whether it's short enough to release stock from abandoned carts before the next wave of shoppers arrives. That's a product decision, but bot traffic makes it urgent.

Write alerts a tired person can act on

An alert that fires forty times a night gets muted by the second night. Tie each rule to a business consequence and give it a threshold, a destination and a runbook.

• Failed payments from one ASN spike above your baseline — page the payments team; check for carding.
• Cart creation rate from a single fingerprint triples — review manually; likely hoarding.
• Catalogue request rate from one IP range climbs steadily — low severity; log and review next morning.
• Checkout error rate crosses a set percentage for ten minutes — this is a revenue alert, not a bot alert, but it catches false-positive blocks.

Alert on rate of change rather than raw totals, or a busy Saturday will look like an attack. Deduplicate aggressively. And name the person who owns each alert over the holidays before the holidays start — a shared inbox is not an owner.

Rehearse with last year's traffic and your own bots

Before you trust any detection rule, test it. Replay a sanitised sample of recorded traffic and confirm nothing legitimate gets challenged. Then write a crude script that scrapes fifty product pages and try to trigger your own alert. Verify that your allowlists cover payment provider callbacks, feed partners, uptime monitors, warehouse integrations and legitimate search engine crawlers. Nothing erodes a team's faith in bot defences faster than blocking a payment webhook during the busiest week of the year.

Decide the response ladder now, not at 2 a.m.

Write down what happens at each severity level: log only, rate limit, issue a challenge, delay the response, shadow-ban, or hard block. Slowing a scraper is often better than blocking it outright, because blocking tells the operator exactly how to evade you next time. Reserve hard blocks for carding and hoarding, and keep a manual override path for support staff who get a complaint from a real customer caught in the net. False positives cost revenue in the same week you can least afford it.

Ten days out: the short checklist

1. Baseline numbers documented and shared with whoever is on call.
2. Alerts tested, tiered, deduplicated and assigned to a named owner.
3. Cart, checkout and payment endpoints instrumented, not just the homepage.
4. Allowlists reviewed for every legitimate automated caller.
5. Response ladder written down, with escalation contacts and override steps.
6. A daily review slot booked for the peak weeks — fifteen minutes to look at bot metrics before they become an incident.

None of this requires a new platform. It requires knowing your own numbers, watching the right endpoints, and agreeing in advance what you'll do when something odd shows up. Do that before the first big sale, and December becomes a busy month rather than a firefight.

Photo: Nataliya Vaitkevich / Pexels