Forum Moderators: Robert Charlton & goodroi
One way is to only use sessions for users that have already logged in. Bots cannot log in. This isn't a sure-fire method because your users could still copy URLs with sessions in them and place them on other sites, as links to your site, where the bots will still be able to find them.