Bounded crawling is the practice of limiting automated web crawling by rules such as allowed domains, crawl depth, URL patterns, request counts, or time windows. It keeps a crawler from wandering across the broader internet and makes its behavior more predictable and easier to govern.
In cyber security, bounded crawling matters because many legitimate tools use crawling for monitoring, enrichment, and content extraction, but the same mechanics can stress servers or cross into unauthorized collection if controls are weak. Defenders use boundaries to reduce load, respect access policies, and prevent data from being pulled from places it should not reach. Attackers may try to bypass those limits with redirects, parameter tricks, or path expansion, so operators should enforce scope server-side, apply rate limiting, and log crawl activity for review.