Custom status codes for BotStopper errors

By default, challenge and denial pages return HTTP 200. Configure status_codes in the policy file to change those responses.

status_codes:
  CHALLENGE: 200
  DENY: 200

To return forbidden responses for both page types, use:

status_codes:
  CHALLENGE: 403
  DENY: 403

For subrequest authentication, set DENY: 403 so the proxy does not accept a denial as successful authentication.

See configuration for deployment configuration.