Stopbot returns several signals because identifying a bot and deciding whether a request may continue are not the same operation. Treating isBot and blockAccess as interchangeable can produce incorrect allow or block behavior.

What isBot tells you

The isBot field represents the bot classification produced by the detection process. A value of 1 means the request was classified as bot activity. A value of 0 means that the detection process did not classify it as a bot.

What blockAccess tells you

The blockAccess field is the final access decision after the active configuration has evaluated the available request context. Integrations should use this field when deciding whether the protected request may continue.

  • blockAccess: 0 means the active rules allow the request to continue.
  • blockAccess: 1 means at least one applicable rule produced a deny decision.
  • detectActivity explains the reason associated with that decision.
  • threatURL separately reports the submitted URL threat signal.

Why isBot can be 0 while blockAccess is 1

A visitor can look like an ordinary browser and still violate another policy. For example, a configuration may allow traffic only from selected countries, reject a network category, match a hostname rule, or deny a URL that was identified as a threat. In those cases the request does not need to be a bot for access to be blocked.

{
  "isBot": 0,
  "blockAccess": 1,
  "threatURL": 0,
  "detectActivity": "[Disallow] - IP Non-ISP"
}

This response is internally consistent: the visitor was not classified as a bot, but the configured access policy denied the network category.

A reliable integration pattern

  1. Confirm the API request completed successfully before consuming decision fields.
  2. Use blockAccess as the final allow or deny signal.
  3. Use isBot, threatURL, and detectActivity for context, logging, and investigation.
  4. For Blocker V2, apply the returned page response exactly as configured after a block decision.
  5. Test both allowed and denied cases before enabling enforcement in production.

Use each field for its intended job

The safest mental model is simple: isBot describes classification, while blockAccess communicates the final policy outcome. Keeping those responsibilities separate makes integrations easier to debug and prevents a valid response from appearing contradictory.

Continue building

Put the decision fields into practice.

Review the current API documentation before changing production traffic handling.