BOT AND AI CRAWLER VISIBILITY
See what bots
crawl your site.
See which bots and AI crawlers visit, what they request, and the signals behind each detection. Start by observing your traffic before deciding what to block.
Free plan · No credit card · No time limit
Move your cursor to reveal bot identities
WebDecoy.
Now on Shopify.
We’re live on Shopify. See the bots behind suspicious traffic, bring risk evidence into your orders, and track AI crawlers and referrals. All inside Shopify admin.
Free plan available · Enable the app embed to start storefront detection · No separate login
Why WebDecoy?
Honeypot Deception
Invisible decoy links and fake API endpoints that no real visitor can reach. When one is touched you have a confirmed bot: not a score, not a guess. Zero false positives, by construction.
Behavioral Analysis
Bot Scanner detects headless browsers, automation frameworks, and sophisticated bots that evade traditional detection: mouse entropy, interaction timing, canvas and WebGL signals.
Edge Sensor
A one-click Cloudflare Worker that catches the crawl pass itself: Googlebot, GPTBot, ClaudeBot, and curl. The clients that never run JavaScript, and so were never visible to a page tag.
Persistent Actor Identity
JA4 TLS and device fingerprints connect detections across rotating IPs. Open the actor’s journey for AI interpretation of likely targets and access patterns, with supporting requests you can inspect.
Stop AI Scrapers
Detect and block GPTBot, ClaudeBot, Perplexity, and 20+ AI crawlers. Protect your content from unauthorized training data harvesting.
Verified Crawlers
“Allow Googlebot” stops meaning “trust a header.” Crawlers are verified against published IP ranges with forward-confirmed reverse DNS, plus Web Bot Auth signatures from operators that sign. Anything claiming an identity it can’t prove is scored as impersonation.
Enforcement You Approve
Monitor mode builds a reviewable deny-list with the evidence attached: which decoy, which path, when. You approve it, then clearance revocation and auto-expiring WAF rules act on exactly what you approved.
SDK, API & Webhooks
Embed detection with the Node SDK or JavaScript tag, drive everything through the REST API, and push events to Slack, webhooks, or your SIEM.
AI Traffic Exchange
See what AI crawlers take from your site and what ChatGPT, Claude and Gemini send back. Referrals are a floor, because platforms often strip the header that identifies them.
Inside WebDecoy
Not mockups. This is the product, showing real traffic. Every number below came from decoys, sensors, and verification running on live sites.
The AI crawler trust report
Every request that claims a known agent, split into proven, unproven, and forged. In this seven-day window: 601 requests forged the identity of a verified crawler.
See how verification works →
One actor, 1,562 IP addresses
This scraper rotated through 1,562 addresses behind one unchanging user agent. WebDecoy’s composite fingerprint tracked it as a single actor the whole time, so one decoy hit follows it everywhere.
AI Journey Insights adds the next question: what is this activity after? See likely targets, concentration, and timing, then inspect the requests behind each observed pattern.
Explore AI Journey Insights →See the Crawlers JavaScript Can’t
Googlebot’s crawl pass is plain HTTP with no DOM. GPTBot and ClaudeBot never run JavaScript at all. A page tag is structurally incapable of seeing them, so we put a sensor in front of your origin. One click on Cloudflare.
- One-click install and uninstall: no wrangler, no YAML
- Detects the crawl pass, scripted clients, and forged crawler identities
- Enforces at the edge: denied clients stopped before your origin
- Fails open by design: it cannot take your site down
GET /robots.txt HTTP/1.1
User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)
CF-Connecting-IP: 142.111.58.63
// flags: known_crawler_ua, crawler_path
// forwarded to WebDecoy, response untouched
// server-side verification
// rDNS: acedatacenter.com
// ASN: not Google (15169)
// verdict: agent_impersonationA Queue of Judgments, Not a Config Screen
Most bot products answer “why did you think this was a bot?” with an opaque ID or a score. A honeypot hit is explainable in one sentence, and that sentence is the whole credibility of the product.
- Monitor mode builds the deny-list while blocking nothing
- Review each entry with its evidence, then approve or dismiss
- Enforce is a gate, not a toggle: four preconditions, or it refuses
- Outcome counters are event counts, never inventory dressed as results
[pending] 9f3c4a71
device · 40 IPs · 3 sites · 2h ago
why: requested /wp-admin-backup.php at 03:41:12
a path that exists nowhere on your site,
linked only from a hidden element on /pricing
[ Deny for 30 days ] [ Dismiss ] [ Open actor → ]
// nothing in the queue blocks traffic
// until you approve itConnects to Your Entire Security Stack
WebDecoy integrates with the tools you already use. Install the edge sensor on Cloudflare in one click, push composite, auto-expiring enforcement rules to your Cloudflare or AWS WAF, stream metrics to your SIEM, and automate response across your infrastructure.
Prefer to work in your AI assistant? Connect it to the WebDecoy MCP server to install WebDecoy in your app and ask whether protection is actually enforced.