How to Add Bot Detection
to Go with Middleware

Go's net/http middleware pattern — wrapping http.Handler with another http.Handler — is one of the cleanest middleware designs in any language. It's composable, testable, and requires zero dependencies. That makes it the perfect place to add bot detection: intercept every request, score the IP, and block or annotate before your business logic runs.

In this guide, you'll build a production-ready bot detection middleware for Go using IPASIS IP intelligence. We start with a basic handler wrapper and progressively add in-memory caching, per-route protection tiers, rate limiting, circuit breakers, context propagation, and structured logging — all with zero external dependencies beyond the standard library (optional Redis for distributed caching).

Step 1: Basic Bot Detection Middleware

Go's middleware pattern is a function that takes an http.Handler and returns an http.Handler. Our middleware queries IPASIS, attaches the risk data to the request context, and blocks high-risk IPs.

// middleware/botdetect.go
package middleware

import (
    "context"
    "encoding/json"
    "fmt"
    "net"
    "net/http"
    "strings"
    "time"
)

type IPRisk struct {
    IP         string  `json:"ip"`
    RiskScore  float64 `json:"risk_score"`
    IsVPN      bool    `json:"is_vpn"`
    IsProxy    bool    `json:"is_proxy"`
    IsTor      bool    `json:"is_tor"`
    IsBot      bool    `json:"is_bot"`
    Country    string  `json:"country_code"`
    AbuseScore float64 `json:"abuse_score"`
}

type contextKey string
const ipRiskKey contextKey = "ip_risk"

// GetIPRisk retrieves risk data from request context.
func GetIPRisk(r *http.Request) *IPRisk {
    if v, ok := r.Context().Value(ipRiskKey).(*IPRisk); ok {
        return v
    }
    return nil
}

// BotDetect returns middleware that checks IPs against IPASIS.
func BotDetect(apiKey string) func(http.Handler) http.Handler {
    client := &http.Client{Timeout: 2 * time.Second}

    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            ip := extractIP(r)

            risk, err := checkIP(client, apiKey, ip)
            if err != nil {
                // Fail open — don't block on API errors
                next.ServeHTTP(w, r)
                return
            }

            // Attach risk data to context
            ctx := context.WithValue(r.Context(), ipRiskKey, risk)
            r = r.WithContext(ctx)

            // Block critical-risk IPs
            if risk.RiskScore >= 90 {
                w.Header().Set("Content-Type", "application/json")
                w.WriteHeader(http.StatusForbidden)
                json.NewEncoder(w).Encode(map[string]string{
                    "error":  "request_blocked",
                    "reason": "suspicious_ip",
                })
                return
            }

            next.ServeHTTP(w, r)
        })
    }
}

func checkIP(client *http.Client, apiKey, ip string) (*IPRisk, error) {
    url := fmt.Sprintf("https://api.ipasis.com/v1/ip/%s", ip)
    req, _ := http.NewRequest("GET", url, nil)
    req.Header.Set("Authorization", "Bearer "+apiKey)

    resp, err := client.Do(req)
    if err != nil {
        return nil, err
    }
    defer resp.Body.Close()

    var risk IPRisk
    if err := json.NewDecoder(resp.Body).Decode(&risk); err != nil {
        return nil, err
    }
    return &risk, nil
}

func extractIP(r *http.Request) string {
    // Check X-Forwarded-For first (reverse proxy)
    if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
        parts := strings.Split(xff, ",")
        return strings.TrimSpace(parts[0])
    }
    // Check X-Real-IP
    if xri := r.Header.Get("X-Real-IP"); xri != "" {
        return xri
    }
    // Fall back to RemoteAddr
    host, _, err := net.SplitHostPort(r.RemoteAddr)
    if err != nil {
        return r.RemoteAddr
    }
    return host
}

Wire it into your server with a single line:

// main.go
package main

import (
    "log"
    "net/http"
    "os"
    "yourapp/middleware"
)

func main() {
    mux := http.NewServeMux()
    mux.HandleFunc("/", homeHandler)
    mux.HandleFunc("/api/data", apiHandler)

    // Wrap the entire mux with bot detection
    protected := middleware.BotDetect(os.Getenv("IPASIS_API_KEY"))(mux)

    log.Println("Server starting on :8080")
    log.Fatal(http.ListenAndServe(":8080", protected))
}

func apiHandler(w http.ResponseWriter, r *http.Request) {
    // Access risk data set by middleware
    risk := middleware.GetIPRisk(r)
    if risk != nil && risk.IsVPN {
        // Handle VPN users differently
        log.Printf("VPN user from %s (risk: %.0f)", risk.Country, risk.RiskScore)
    }
    w.Write([]byte("OK"))
}

Step 2: In-Memory TTL Cache

Calling an external API on every request adds latency and burns through your quota. Go's sync.Map gives us a concurrent-safe cache with no dependencies. We'll add TTL-based expiration using a background goroutine.

// middleware/cache.go
package middleware

import (
    "sync"
    "time"
)

type cacheEntry struct {
    risk      *IPRisk
    expiresAt time.Time
}

type IPCache struct {
    data sync.Map
    ttl  time.Duration
}

func NewIPCache(ttl time.Duration) *IPCache {
    c := &IPCache{ttl: ttl}
    // Background cleanup every minute
    go func() {
        ticker := time.NewTicker(time.Minute)
        for range ticker.C {
            c.data.Range(func(key, value any) bool {
                if entry, ok := value.(*cacheEntry); ok {
                    if time.Now().After(entry.expiresAt) {
                        c.data.Delete(key)
                    }
                }
                return true
            })
        }
    }()
    return c
}

func (c *IPCache) Get(ip string) (*IPRisk, bool) {
    val, ok := c.data.Load(ip)
    if !ok {
        return nil, false
    }
    entry := val.(*cacheEntry)
    if time.Now().After(entry.expiresAt) {
        c.data.Delete(ip)
        return nil, false
    }
    return entry.risk, true
}

func (c *IPCache) Set(ip string, risk *IPRisk) {
    c.data.Store(ip, &cacheEntry{
        risk:      risk,
        expiresAt: time.Now().Add(c.ttl),
    })
}

Update the middleware to use the cache:

// Updated BotDetect with caching
func BotDetectCached(apiKey string, cacheTTL time.Duration) func(http.Handler) http.Handler {
    client := &http.Client{Timeout: 2 * time.Second}
    cache := NewIPCache(cacheTTL)

    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            ip := extractIP(r)

            // Check cache first
            risk, found := cache.Get(ip)
            if !found {
                var err error
                risk, err = checkIP(client, apiKey, ip)
                if err != nil {
                    next.ServeHTTP(w, r)
                    return
                }
                cache.Set(ip, risk)
            }

            ctx := context.WithValue(r.Context(), ipRiskKey, risk)
            r = r.WithContext(ctx)

            if risk.RiskScore >= 90 {
                w.Header().Set("Content-Type", "application/json")
                w.WriteHeader(http.StatusForbidden)
                json.NewEncoder(w).Encode(map[string]string{
                    "error": "request_blocked",
                })
                return
            }

            next.ServeHTTP(w, r)
        })
    }
}

// Usage: middleware.BotDetectCached(apiKey, 5*time.Minute)(mux)

Step 3: Per-Route Protection Tiers

Not every endpoint needs the same protection level. Login and payment endpoints should block at lower risk thresholds than your marketing pages. We define protection tiers and apply them per-route.

// middleware/tiers.go
package middleware

type ProtectionTier struct {
    Name           string
    BlockThreshold float64
    ChallengeThreshold float64
    BlockVPN       bool
    BlockTor       bool
}

var (
    TierCritical = ProtectionTier{
        Name: "critical", BlockThreshold: 60,
        ChallengeThreshold: 30, BlockVPN: true, BlockTor: true,
    }
    TierHigh = ProtectionTier{
        Name: "high", BlockThreshold: 75,
        ChallengeThreshold: 50, BlockVPN: false, BlockTor: true,
    }
    TierStandard = ProtectionTier{
        Name: "standard", BlockThreshold: 90,
        ChallengeThreshold: 70, BlockVPN: false, BlockTor: false,
    }
    TierMonitor = ProtectionTier{
        Name: "monitor", BlockThreshold: 100,
        ChallengeThreshold: 100, BlockVPN: false, BlockTor: false,
    }
)

// ProtectRoute wraps a handler with tier-specific bot detection.
func ProtectRoute(tier ProtectionTier, cache *IPCache, apiKey string) func(http.Handler) http.Handler {
    client := &http.Client{Timeout: 2 * time.Second}

    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            ip := extractIP(r)

            risk, found := cache.Get(ip)
            if !found {
                var err error
                risk, err = checkIP(client, apiKey, ip)
                if err != nil {
                    next.ServeHTTP(w, r)
                    return
                }
                cache.Set(ip, risk)
            }

            ctx := context.WithValue(r.Context(), ipRiskKey, risk)
            r = r.WithContext(ctx)

            // Tier-specific blocking
            if risk.RiskScore >= tier.BlockThreshold {
                http.Error(w, "Forbidden", http.StatusForbidden)
                return
            }
            if tier.BlockTor && risk.IsTor {
                http.Error(w, "Forbidden", http.StatusForbidden)
                return
            }
            if tier.BlockVPN && risk.IsVPN {
                http.Error(w, "Forbidden", http.StatusForbidden)
                return
            }

            next.ServeHTTP(w, r)
        })
    }
}

// Usage with net/http:
// mux.Handle("/login", middleware.ProtectRoute(
//     middleware.TierCritical, cache, apiKey,
// )(http.HandlerFunc(loginHandler)))
// mux.Handle("/api/", middleware.ProtectRoute(
//     middleware.TierHigh, cache, apiKey,
// )(http.HandlerFunc(apiHandler)))

Step 4: Circuit Breaker for API Resilience

If the IPASIS API is down or slow, you don't want cascading failures. A circuit breaker tracks consecutive failures and "opens" the circuit — temporarily skipping API calls and failing open.

// middleware/breaker.go
package middleware

import (
    "sync/atomic"
    "time"
)

type CircuitBreaker struct {
    failures    atomic.Int64
    lastFailure atomic.Int64 // Unix timestamp
    threshold   int64
    resetAfter  time.Duration
}

func NewCircuitBreaker(threshold int, resetAfter time.Duration) *CircuitBreaker {
    return &CircuitBreaker{
        threshold:  int64(threshold),
        resetAfter: resetAfter,
    }
}

func (cb *CircuitBreaker) IsOpen() bool {
    if cb.failures.Load() < cb.threshold {
        return false
    }
    // Check if reset period has elapsed
    lastFail := time.Unix(cb.lastFailure.Load(), 0)
    if time.Since(lastFail) > cb.resetAfter {
        cb.failures.Store(0)
        return false
    }
    return true
}

func (cb *CircuitBreaker) RecordSuccess() {
    cb.failures.Store(0)
}

func (cb *CircuitBreaker) RecordFailure() {
    cb.failures.Add(1)
    cb.lastFailure.Store(time.Now().Unix())
}

// Updated middleware with circuit breaker
func BotDetectWithBreaker(apiKey string, cacheTTL time.Duration) func(http.Handler) http.Handler {
    client := &http.Client{Timeout: 2 * time.Second}
    cache := NewIPCache(cacheTTL)
    breaker := NewCircuitBreaker(5, 30*time.Second)

    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            ip := extractIP(r)

            // Check cache
            risk, found := cache.Get(ip)
            if !found {
                // Check circuit breaker
                if breaker.IsOpen() {
                    // Circuit open — fail open, skip API
                    next.ServeHTTP(w, r)
                    return
                }

                var err error
                risk, err = checkIP(client, apiKey, ip)
                if err != nil {
                    breaker.RecordFailure()
                    next.ServeHTTP(w, r)
                    return
                }
                breaker.RecordSuccess()
                cache.Set(ip, risk)
            }

            ctx := context.WithValue(r.Context(), ipRiskKey, risk)
            r = r.WithContext(ctx)

            if risk.RiskScore >= 90 {
                w.Header().Set("Content-Type", "application/json")
                w.WriteHeader(http.StatusForbidden)
                json.NewEncoder(w).Encode(map[string]string{
                    "error": "request_blocked",
                })
                return
            }

            next.ServeHTTP(w, r)
        })
    }
}

Step 5: Risk-Aware Rate Limiting

Standard rate limiting treats all users equally. By combining IPASIS risk scores with golang.org/x/time/rate, you can give clean IPs generous limits while throttling suspicious ones aggressively.

// middleware/ratelimit.go
package middleware

import (
    "golang.org/x/time/rate"
    "net/http"
    "sync"
)

type RateLimiterPool struct {
    mu       sync.Mutex
    limiters map[string]*rate.Limiter
}

func NewRateLimiterPool() *RateLimiterPool {
    return &RateLimiterPool{
        limiters: make(map[string]*rate.Limiter),
    }
}

func (p *RateLimiterPool) GetLimiter(ip string, riskScore float64) *rate.Limiter {
    p.mu.Lock()
    defer p.mu.Unlock()

    key := ip
    if limiter, exists := p.limiters[key]; exists {
        return limiter
    }

    // Higher risk = lower rate limit
    var rps rate.Limit
    var burst int
    switch {
    case riskScore >= 75:
        rps, burst = 1, 2     // 1 req/sec, burst 2
    case riskScore >= 50:
        rps, burst = 5, 10    // 5 req/sec, burst 10
    case riskScore >= 25:
        rps, burst = 20, 40   // 20 req/sec, burst 40
    default:
        rps, burst = 100, 200 // 100 req/sec, burst 200
    }

    limiter := rate.NewLimiter(rps, burst)
    p.limiters[key] = limiter
    return limiter
}

// RiskRateLimit applies rate limiting based on IP risk score.
func RiskRateLimit(pool *RateLimiterPool) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            risk := GetIPRisk(r)
            ip := extractIP(r)

            score := 0.0
            if risk != nil {
                score = risk.RiskScore
            }

            limiter := pool.GetLimiter(ip, score)
            if !limiter.Allow() {
                w.Header().Set("Retry-After", "1")
                http.Error(w, "Too Many Requests", http.StatusTooManyRequests)
                return
            }

            next.ServeHTTP(w, r)
        })
    }
}

Step 6: Structured Logging with slog

Go 1.21 introduced log/slog — structured, leveled logging in the standard library. We'll log every risk decision with full context for security auditing and debugging.

// middleware/logging.go
package middleware

import (
    "log/slog"
    "net/http"
    "time"
)

// SecurityLogger logs bot detection decisions.
func SecurityLogger(logger *slog.Logger) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            start := time.Now()

            // Wrap response writer to capture status code
            wrapped := &statusWriter{ResponseWriter: w, status: 200}
            next.ServeHTTP(wrapped, r)

            risk := GetIPRisk(r)
            if risk == nil {
                return
            }

            attrs := []slog.Attr{
                slog.String("ip", risk.IP),
                slog.Float64("risk_score", risk.RiskScore),
                slog.Bool("is_vpn", risk.IsVPN),
                slog.Bool("is_proxy", risk.IsProxy),
                slog.Bool("is_tor", risk.IsTor),
                slog.Bool("is_bot", risk.IsBot),
                slog.String("country", risk.Country),
                slog.String("path", r.URL.Path),
                slog.String("method", r.Method),
                slog.Int("status", wrapped.status),
                slog.Duration("latency", time.Since(start)),
                slog.String("user_agent", r.UserAgent()),
            }

            level := slog.LevelInfo
            if risk.RiskScore >= 75 {
                level = slog.LevelWarn
            }
            if risk.RiskScore >= 90 || wrapped.status == 403 {
                level = slog.LevelError
            }

            logger.LogAttrs(r.Context(), level, "request_scored", attrs...)
        })
    }
}

type statusWriter struct {
    http.ResponseWriter
    status int
}

func (w *statusWriter) WriteHeader(code int) {
    w.status = code
    w.ResponseWriter.WriteHeader(code)
}

Step 7: Integration with Popular Routers

The middleware works with net/http out of the box, but most Go projects use a router. Here's how to integrate with Chi, Gin, and Echo.

Chi Router

// Chi uses the standard http.Handler middleware signature
r := chi.NewRouter()
r.Use(middleware.BotDetectCached(apiKey, 5*time.Minute))
r.Use(middleware.SecurityLogger(slog.Default()))

// Per-route protection tiers
r.Group(func(r chi.Router) {
    r.Use(middleware.ProtectRoute(middleware.TierCritical, cache, apiKey))
    r.Post("/login", loginHandler)
    r.Post("/signup", signupHandler)
    r.Post("/checkout", checkoutHandler)
})

r.Group(func(r chi.Router) {
    r.Use(middleware.ProtectRoute(middleware.TierHigh, cache, apiKey))
    r.Get("/api/*", apiHandler)
})

Gin Framework

// Gin adapter — wraps our net/http middleware
func GinBotDetect(apiKey string, cacheTTL time.Duration) gin.HandlerFunc {
    cache := NewIPCache(cacheTTL)
    client := &http.Client{Timeout: 2 * time.Second}
    breaker := NewCircuitBreaker(5, 30*time.Second)

    return func(c *gin.Context) {
        ip := c.ClientIP()

        risk, found := cache.Get(ip)
        if !found {
            if breaker.IsOpen() {
                c.Next()
                return
            }
            var err error
            risk, err = checkIP(client, apiKey, ip)
            if err != nil {
                breaker.RecordFailure()
                c.Next()
                return
            }
            breaker.RecordSuccess()
            cache.Set(ip, risk)
        }

        c.Set("ip_risk", risk)

        if risk.RiskScore >= 90 {
            c.AbortWithStatusJSON(403, gin.H{"error": "blocked"})
            return
        }
        c.Next()
    }
}

// Usage:
// r := gin.Default()
// r.Use(GinBotDetect(apiKey, 5*time.Minute))

Echo Framework

// Echo adapter
func EchoBotDetect(apiKey string, cacheTTL time.Duration) echo.MiddlewareFunc {
    cache := NewIPCache(cacheTTL)
    client := &http.Client{Timeout: 2 * time.Second}

    return func(next echo.HandlerFunc) echo.HandlerFunc {
        return func(c echo.Context) error {
            ip := c.RealIP()

            risk, found := cache.Get(ip)
            if !found {
                var err error
                risk, err = checkIP(client, apiKey, ip)
                if err != nil {
                    return next(c)
                }
                cache.Set(ip, risk)
            }

            c.Set("ip_risk", risk)

            if risk.RiskScore >= 90 {
                return c.JSON(403, map[string]string{"error": "blocked"})
            }
            return next(c)
        }
    }
}

// Usage:
// e := echo.New()
// e.Use(EchoBotDetect(apiKey, 5*time.Minute))

Step 8: Redis Cache for Distributed Systems

In-memory caching works for single instances. For horizontally scaled Go services behind a load balancer, share cache entries via Redis.

// middleware/redis_cache.go
package middleware

import (
    "context"
    "encoding/json"
    "time"

    "github.com/redis/go-redis/v9"
)

type RedisIPCache struct {
    client *redis.Client
    ttl    time.Duration
    prefix string
}

func NewRedisIPCache(redisURL string, ttl time.Duration) *RedisIPCache {
    opt, _ := redis.ParseURL(redisURL)
    return &RedisIPCache{
        client: redis.NewClient(opt),
        ttl:    ttl,
        prefix: "ipasis:risk:",
    }
}

func (c *RedisIPCache) Get(ctx context.Context, ip string) (*IPRisk, bool) {
    val, err := c.client.Get(ctx, c.prefix+ip).Result()
    if err != nil {
        return nil, false
    }
    var risk IPRisk
    if err := json.Unmarshal([]byte(val), &risk); err != nil {
        return nil, false
    }
    return &risk, true
}

func (c *RedisIPCache) Set(ctx context.Context, ip string, risk *IPRisk) {
    data, _ := json.Marshal(risk)
    c.client.Set(ctx, c.prefix+ip, data, c.ttl)
}

Step 9: Webhook and API Key Protection

Go services often expose webhooks for Stripe, GitHub, or Slack. These are prime targets for abuse. Add bot detection to validate webhook senders beyond just signature verification.

// Webhook protection handler
func webhookHandler(w http.ResponseWriter, r *http.Request) {
    risk := GetIPRisk(r)

    // Webhooks should come from known IPs
    // Flag unusual sources for manual review
    if risk != nil && (risk.IsVPN || risk.IsProxy || risk.RiskScore > 50) {
        slog.Warn("suspicious webhook source",
            "ip", risk.IP,
            "risk", risk.RiskScore,
            "is_vpn", risk.IsVPN,
            "path", r.URL.Path,
        )
        // Don't block — log and process (webhook replay is hard)
        // But flag for security team review
    }

    // Process webhook normally
    processWebhook(r)
    w.WriteHeader(http.StatusOK)
}

// API key + IP risk validation
func apiKeyMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        apiKey := r.Header.Get("X-API-Key")
        if apiKey == "" {
            http.Error(w, "Missing API key", http.StatusUnauthorized)
            return
        }

        risk := GetIPRisk(r)
        if risk != nil && risk.RiskScore >= 75 {
            // Suspicious IP using a valid API key
            // Could be a stolen key — log and rate limit
            slog.Error("high-risk IP using API key",
                "ip", risk.IP,
                "risk", risk.RiskScore,
                "key_prefix", apiKey[:8]+"...",
            )
        }

        next.ServeHTTP(w, r)
    })
}

Step 10: Complete Production Server

Here's a complete, production-ready Go server combining everything — caching, circuit breaker, protection tiers, rate limiting, and structured logging.

// main.go — Complete production server
package main

import (
    "context"
    "log/slog"
    "net/http"
    "os"
    "os/signal"
    "syscall"
    "time"
    "yourapp/middleware"
)

func main() {
    // Structured logger
    logger := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
        Level: slog.LevelInfo,
    }))
    slog.SetDefault(logger)

    apiKey := os.Getenv("IPASIS_API_KEY")
    if apiKey == "" {
        slog.Error("IPASIS_API_KEY not set")
        os.Exit(1)
    }

    // Shared cache and rate limiter pool
    cache := middleware.NewIPCache(5 * time.Minute)
    rateLimiterPool := middleware.NewRateLimiterPool()

    // Build middleware chain
    botDetect := middleware.BotDetectWithBreaker(apiKey, 5*time.Minute)
    rateLimit := middleware.RiskRateLimit(rateLimiterPool)
    securityLog := middleware.SecurityLogger(logger)

    // Routes
    mux := http.NewServeMux()

    // Public pages — monitor only
    mux.HandleFunc("/", homeHandler)
    mux.HandleFunc("/pricing", pricingHandler)

    // Auth endpoints — critical protection
    criticalMux := http.NewServeMux()
    criticalMux.HandleFunc("/login", loginHandler)
    criticalMux.HandleFunc("/signup", signupHandler)
    criticalMux.HandleFunc("/reset-password", resetHandler)
    mux.Handle("/login", middleware.ProtectRoute(
        middleware.TierCritical, cache, apiKey,
    )(criticalMux))

    // API — high protection
    mux.Handle("/api/", middleware.ProtectRoute(
        middleware.TierHigh, cache, apiKey,
    )(http.HandlerFunc(apiHandler)))

    // Webhooks — monitor and log
    mux.HandleFunc("/webhooks/stripe", webhookHandler)

    // Stack middleware: logging → bot detect → rate limit → routes
    handler := securityLog(botDetect(rateLimit(mux)))

    server := &http.Server{
        Addr:         ":8080",
        Handler:      handler,
        ReadTimeout:  10 * time.Second,
        WriteTimeout: 15 * time.Second,
        IdleTimeout:  60 * time.Second,
    }

    // Graceful shutdown
    go func() {
        sigCh := make(chan os.Signal, 1)
        signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
        <-sigCh
        slog.Info("shutting down server")
        ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
        defer cancel()
        server.Shutdown(ctx)
    }()

    slog.Info("server starting", "addr", ":8080")
    if err := server.ListenAndServe(); err != http.ErrServerClosed {
        slog.Error("server error", "err", err)
        os.Exit(1)
    }
}

Performance Benchmarks

Go's concurrency model makes it exceptionally fast for middleware processing. Here's how each layer affects request latency:

Bonus: Testing Your Middleware

Go's httptest package makes middleware testing trivial:

// middleware/botdetect_test.go
package middleware_test

import (
    "net/http"
    "net/http/httptest"
    "testing"
    "yourapp/middleware"
)

func TestBotDetectBlocksHighRisk(t *testing.T) {
    // Mock IPASIS API
    mockAPI := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        w.Header().Set("Content-Type", "application/json")
        w.Write([]byte(`{"risk_score": 95, "is_bot": true, "is_vpn": false}`))
    }))
    defer mockAPI.Close()

    handler := middleware.BotDetect("test-key")(
        http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            w.WriteHeader(200) // Should never reach here
        }),
    )

    req := httptest.NewRequest("GET", "/api/data", nil)
    req.RemoteAddr = "1.2.3.4:1234"
    rec := httptest.NewRecorder()

    handler.ServeHTTP(rec, req)

    if rec.Code != http.StatusForbidden {
        t.Errorf("expected 403, got %d", rec.Code)
    }
}

func TestBotDetectAllowsLowRisk(t *testing.T) {
    handler := middleware.BotDetect("test-key")(
        http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            risk := middleware.GetIPRisk(r)
            if risk != nil && risk.RiskScore < 90 {
                w.WriteHeader(200)
                return
            }
            w.WriteHeader(500)
        }),
    )

    req := httptest.NewRequest("GET", "/api/data", nil)
    rec := httptest.NewRecorder()

    handler.ServeHTTP(rec, req)
    // With no mock, API call fails, middleware fails open → 200
    if rec.Code != http.StatusOK {
        t.Errorf("expected 200 (fail open), got %d", rec.Code)
    }
}

Summary

You now have a production-grade bot detection system for Go that:

• Scores every IP via IPASIS with sub-millisecond cached lookups
• Protects routes at different tiers — critical for auth, high for APIs, monitor for public pages
• Degrades gracefully with circuit breakers and fail-open patterns
• Rate limits by risk — clean users get generous limits, suspicious IPs get throttled
• Logs everything with structured slog for security auditing
• Works with any router — net/http, Chi, Gin, Echo
• Scales horizontally with optional Redis shared caching

The beauty of Go's middleware pattern is composability. Each piece — caching, rate limiting, logging — is an independent func(http.Handler) http.Handler that you can stack, reorder, or remove without touching the others.

Related Guides

• Next.js Bot Detection Middleware Guide
• Express.js Bot Detection Middleware Guide
• Django Bot Detection Middleware Guide
• Rails Bot Detection Middleware Guide
• Laravel Bot Detection Middleware Guide
• Bot Detection Techniques for SaaS
• Redis Rate Limiting for Bot Protection