We’re getting arround 25M impressions on our standard CloudPages that we associate with Bots/AI, which is heavily impacting our Super Message billing. We are trying to block them internally but hit two major roadblocks:
The pure SSJS 500 Error: Trying to read the User-Agent via pure SSJS (Platform.Request.GetRequestHeader or .UserAgent) crashes the page with a 500 Error:System.InvalidOperationException: Unable to retrieve security descriptor for this frame. Wrapping it in a try/catch returns null, causing a false positive that lets bots through. Has anyone found a native way to read headers in pure SSJS without triggering this security block?
RaiseError vs. Super Message Billing: We can bypass the error above by grabbing the header with AMPscript on Line 1 (%%[ set @ua = HTTPRequestHeader("User-Agent") ]%%), passing it to SSJS, and triggering Platform.Function.RaiseError to return a 403 status. The critical question: Does aborting the page with RaiseError actually prevent the Super Message from being billed? Or does executing that very first line of AMPscript already trigger the billable impression?
We are proposing an external WAF on the client's self-hosted domain as the ultimate fix, but we'd love to know if anyone has successfully stopped bot billing from inside SFMC.
