Deployed 720d0c3 with MkDocs version: 1.6.1

references/authentication/auth_actions/index.html

@@ -1296,6 +1296,21 @@
     </span>
   </a>
 
+    <nav class="md-nav" aria-label="Configuring Actions">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#bot-detection" class="md-nav__link">
+    <span class="md-ellipsis">
+      Bot Detection
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
 
         <li class="md-nav__item">
@@ -1524,6 +1539,21 @@
     </span>
   </a>
 
+    <nav class="md-nav" aria-label="Configuring Actions">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#bot-detection" class="md-nav__link">
+    <span class="md-ellipsis">
+      Bot Detection
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
 
         <li class="md-nav__item">
@@ -1596,6 +1626,10 @@ <h2 id="configuring-actions">Configuring Actions</h2>
     'action_email_activate_show'  =&gt; '\CodeIgniter\Shield\Views\email_activate_show',
     'action_email_activate_email' =&gt; '\CodeIgniter\Shield\Views\Email\email_activate_email',
 ];</code></pre>
+<h3 id="bot-detection">Bot Detection</h3>
+<p>The <code>ActionController::verify()</code> method includes built-in protection against web crawlers and bots. When a bot (such as Googlebot, Bingbot, etc.) attempts to access verification links, the system will return a 404 error instead of processing the request.</p>
+<p>This security feature prevents bots from accidentally or intentionally consuming verification tokens or codes by following links in emails during their crawling activities.</p>
+<p>CodeIgniter automatically handles bot detection through its User Agent library. It checks the User-Agent string against the <code>UserAgents::robots</code> config defined in <strong>app/Config/UserAgents.php</strong> to identify known web crawlers.</p>
 <h2 id="defining-new-actions">Defining New Actions</h2>
 <p>While the provided email-based activation and 2FA will work for many sites, others will have different
 needs, like using SMS to verify or something completely different. Custom actions must adhere to the following requirements:</p>
@@ -1638,7 +1672,7 @@ <h2 id="defining-new-actions">Defining New Actions</h2>
     <span class="md-icon" title="Last update">
       <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg>
     </span>
-    <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date" title="February 14, 2025 19:18:58 UTC">February 14, 2025</span>
+    <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date" title="November 3, 2025 20:39:05 UTC">November 3, 2025</span>
   </span>