Bot Protection in Stape sGTM – Best Practices

Google Tag Manager Server Container
1

Hi,

we are currently reviewing our bot filtering setup in Stape and would like to understand what additional options are available to improve bot protection.

Our current setup is:

  • We use the Stape Bot Detection Power-Up

  • The Power-Up is enabled, but “Block requests from bots” is currently OFF

  • We use the bot detection headers in sGTM:

    • X-Device-Bot

    • X-Device-Bot-Score

  • In our sGTM triggers, we exclude traffic when:

    • X-Device-Bot = true

  • We also exclude some traffic based on country, e.g. CN and SG

  • For some page_view logic we additionally exclude known bot user agents such as AdsBot

Our general flow is:

Web GTM
→ sGTM hosted on Stape
→ GA4
→ Google Ads
→ Meta CAPI

So bot filtering is currently handled mainly inside sGTM at trigger level. The request can still reach the server container, but GA4 / Google Ads / Meta tags should not fire when Stape identifies the request as a bot.

We have a few questions:

  1. Is this considered a good/recommended setup, or would you also recommend enabling “Block requests from bots” in the Bot Detection Power-Up?

  2. If we enable “Block requests from bots”, what exactly happens compared with filtering via X-Device-Bot = true in sGTM triggers?

    • Is the request rejected before it reaches the server GTM container?

    • Does this provide better protection or mainly reduce sGTM processing/cost?

  3. Is there any disadvantage to enabling “Block requests from bots” when we already filter bot traffic inside sGTM?

  4. Could enabling hard blocking affect legitimate server-to-server traffic, Data Client requests, webhooks, CRM requests or other automated requests going through the same Stape container?

  5. Would you recommend using X-Device-Bot-Score in addition to X-Device-Bot?

    For example:

    • allow < 50

    • monitor 50–75

    • block > 75

  6. Are there any additional Stape features or recommended techniques we should use for bot protection?

  7. For GA4 / Google Ads / Meta traffic specifically, what would you consider the best-practice architecture:

    • filtering only inside sGTM,

    • hard blocking in the Stape Power-Up,

    • or a combination of both?

Our main goal is to prevent bot traffic from reaching GA4, Google Ads and Meta, while avoiding false positives and not blocking legitimate CRM/server-to-server requests.

Thank you very much

2

Hi Patrik,

Thank you for your questions.

Add request headers - the Power-Up will add bot detection request headers to incoming HTTP requests.
Block requests from bots - the Power-Up will block bot requests to the /collect (GA4) and /data (Data Tag) paths.

1. You can use either of these options. “Add request headers” gives you more control because you manually configure the filtering logic in your triggers, while “Block requests from bots” works automatically. The end result of both approaches is essentially the same, so I wouldn’t say that one is more recommended than the other.

2. If you enable “Block requests from bots”, the request will be blocked at the server level before it reaches the sGTM container. However, it will still count toward your usage because the request needs to be processed first in order to determine whether it is coming from a bot.

3. There are no particular disadvantages to using “Block requests from bots”. The main difference is simply that requests are blocked automatically rather than through exceptions configured in your sGTM triggers.

4. If you enable “Block requests from bots”, please note that if you send webhooks to /data, they may also be blocked if they are identified as bot requests. Therefore, we recommend sending webhooks to a different path, such as /webhooks, which you can configure in the Data Client settings.

5. Using X-Device-Bot-Score in addition to X-Device-Bot generally doesn’t provide much additional value. X-Device-Bot is already determined based on the bot score, so normally you would use either X-Device-Bot or build your own logic based on X-Device-Bot-Score.

6. Using the Bot Detection Power-Up is generally sufficient for bot protection. There are also additional approaches, such as blocking spam referrals at the trigger level. You can find more information about this in our related article.
Filtering bot traffic in GA4 using server-side GTM and Stape’s Bot Detection

7. As mentioned above, the end result of both approaches is essentially the same, so there isn’t one specific option that I would define as the best practice.

In your case, you essentially have two main options: either continue using “Add request headers” and simply avoid adding bot exceptions to events that are triggered by webhooks, or enable “Block requests from bots” and send your webhooks to a separate path instead of /data.