It has little to do with rogue bots. The bots that hit those pages get a page returned without an anti-forgery cookie and that is perfectly fine. It looks like DNN is actually returning the correct error because the cookie is indeed missing but we need to find a way to suppress those errors.

I understand the issue as I have been dealing with it for a very long time. In fact this is causing more issues that are related such as having to purge site logs due to it growing out of control.

The two most common errors have to do with malicious bots hitting pages that do not exist and the antiforgery  non-malicious bots from google bot indexing your site. There are "good" bots and "bad" bots.  Each administrator may have a different opinion of a "Good bot" as well.

I want to use this as a way to tackle the "bad" bots. There are things you will notice in common as far as the bad bots go that are going to separate them from the "good" bots. I believe using the info from the browser type is going to tell you maybe if it is good and give a small clue along with IP addresses such as a geo filter.

What needs to happen in my opinion what I would love to see done is creating a way to detect the Good bots and allow them to browse the site without errors in the logs. I believe possibly in the error log or another area in the persona bar there could be an option to views these specific errors and allow an admin to "Add to Safe List" similar to junk mail filter in mail programs. It is the only way I believe... Known registered IP's of safe bots can be added and maintained as a list. And possibly also known bad bots but that list is toooooooooo huge so forget it. Lets focus on the far less number of good bots.

The anti-forgery issues can then also help detect "good" or bad and handle them according to this "safe list".  The unsafe it can then simply reject those connections to the site and maybe put one message per ip that this bot was blocked X many times with maybe the last 5 or 10 recorded...

Maybe this makes sense but I think we can kill two birds with one stone here...

A temporary fix would be something more like what is discussed on github for a solution to get by if desired to set it up like this.  Put an option to supress that message... or any message for that matter incase it is a known issue and you dont need to be notified more about it. But that is up to an admin as others have pointed out it is good to know what is going on with your site with detials such as what this error provides.

Does the bot still load the page?  Will it index material?  This could even have bigger issue if it stops bot from indexing your site as well.  Not saying it does as I a would not doubt the bot gets around it.

So interesting enough I found release mode in Visual Studio. I knew there was a step missing I kept building not realizing I was in debug and I would not get a package built to test my work for a few months now. I feel like such an old newbie it has been a long time since I have used Visual Studio but I should have remembered this I think it is funny :)

I will play with some ideas I have cooking in my head maybe I can find a way to handle this in a fun way :)

I am still working on my IDE setup... I need to build a seperate machine and possibly a laptop I am debating which way to go here maybe some advice here or suggestions before I build an awesome setup.    I will throw a thread up for the fun of it see what you all are geared up with.
 

On thing you can do is put the site behind a service like Cloudflare. One of the things you can use it for is to block bots and other "bad browsers" before they ever reach your site. It's got a free tier, so it's worth looking into.