DETECT
& BLOCK Bots by Identity
Four sensors, one actor. Honeypot decoys catch bots with zero false positives. Behavioral analysis catches headless browsers and automation frameworks. An edge sensor catches the crawlers that never run JavaScript at all. Every detection resolves to a single actor identity that survives IP rotation, so one decoy hit follows it across every address it rotates to.
14 day free trial · No credit card required
Why WebDecoy?
Honeypot Deception
Invisible decoy links and fake API endpoints that no real visitor can reach. When one is touched you have a confirmed bot: not a score, not a guess. Zero false positives, by construction.
Behavioral Analysis
Bot Scanner detects headless browsers, automation frameworks, and sophisticated bots that evade traditional detection: mouse entropy, interaction timing, canvas and WebGL signals.
Edge Sensor
A one-click Cloudflare Worker that catches the crawl pass itself: Googlebot, GPTBot, ClaudeBot, and curl. The clients that never run JavaScript, and so were never visible to a page tag.
Persistent Actor Identity
JA4 TLS and device fingerprints tie thousands of rotating IPs back to one actor. Catch it once and the detection follows it everywhere. IP rotation stops being an escape hatch.
Stop AI Scrapers
Detect and block GPTBot, ClaudeBot, Perplexity, and 20+ AI crawlers. Protect your content from unauthorized training data harvesting.
Verified Crawlers
“Allow Googlebot” stops meaning “trust a header.” Crawlers are verified against published IP ranges with forward-confirmed reverse DNS, plus Web Bot Auth signatures from operators that sign. Anything claiming an identity it can’t prove is scored as impersonation.
Enforcement You Approve
Monitor mode builds a reviewable deny-list with the evidence attached: which decoy, which path, when. You approve it, then clearance revocation and auto-expiring WAF rules act on exactly what you approved.
SDK, API & Webhooks
Embed detection with the Node SDK or JavaScript tag, drive everything through the REST API, and push events to Slack, SIEM, or PagerDuty.
AI Traffic Exchange
See what AI crawlers take from your site and what ChatGPT, Claude and Gemini send back. Referrals are a floor, because platforms often strip the header that identifies them.
Inside WebDecoy
Not mockups. This is the product, showing real traffic. Every number below came from decoys, sensors, and verification running on live sites.
The AI crawler trust report
Every request that claims a known agent, split into proven, unproven, and forged. In this seven-day window: 1,767 requests forged the identity of a verified crawler.
See how verification works →
One actor, 564 IP addresses
This scraper rotated through 564 addresses and 7 user agents. WebDecoy’s composite fingerprint tracked it as a single actor the whole time, so one decoy hit follows it everywhere.
Explore actor identity →
Every detection, with its evidence
Source, category, verified-agent status, actor, and threat score on every row. Filterable, exportable, and each one explainable in a sentence.
See detection sources →
Detections in, enforcement out
Detection sources on one side: SDK, WordPress plugin, edge sensor, detection script. Enforcement targets on the other: Cloudflare, AWS WAF, Fastly, and Vercel. Plus Slack and your SIEM.
View all integrations →See the Crawlers JavaScript Can’t
Googlebot’s crawl pass is plain HTTP with no DOM. GPTBot and ClaudeBot never run JavaScript at all. A page tag is structurally incapable of seeing them, so we put a sensor in front of your origin. One click on Cloudflare.
- One-click install and uninstall: no wrangler, no YAML
- Detects the crawl pass, scripted clients, and forged crawler identities
- Enforces at the edge: denied clients stopped before your origin
- Fails open by design: it cannot take your site down
GET /robots.txt HTTP/1.1
User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)
CF-Connecting-IP: 142.111.58.63
// flags: known_crawler_ua, crawler_path
// forwarded to WebDecoy, response untouched
// server-side verification
// rDNS: acedatacenter.com
// ASN: not Google (15169)
// verdict: agent_impersonationEndpoint Decoys: API Honeypots
Go beyond web scraper detection. Deploy fake API endpoints that catch credential stuffing attacks, SQL injection attempts, and API enumeration before attackers reach your real infrastructure.
- Detect SQL injection, XSS, XXE & more
- Zero false positives - only attackers trigger
- Full forensic payload capture
- AbuseIPDB threat intelligence integration
POST /api/admin/login HTTP/1.1
Content-Type: application/json
{
"username": "admin' OR '1'='1",
"password": "' UNION SELECT * --"
}
// DETECTED: SQL Injection
// Severity: Critical
// Actor blocked at WAF by JA4 (every IP)Catch VPNs, Proxies & Location Spoofing
Fraudsters hide behind VPNs and proxies. Our Geographic Consistency Detection exposes them by analyzing timezone, language, and IP mismatches in real-time.
- Timezone vs GeoIP continent-level mismatch detection
- Browser language vs expected country language analysis
- VPN likelihood scoring (0-100 consistency score)
- Stop credential stuffing and payment fraud at the source
{
"geo_consistency": {
"consistency_score": 35,
"is_vpn_likely": true,
"flags": [
"timezone_mismatch",
"language_mismatch"
]
},
"analysis": {
"browser_tz": "Asia/Shanghai",
"geoip_tz": "America/New_York",
"languages": ["zh-CN", "zh"],
"expected": ["en"]
},
"verdict": "block"
}Measure the AI Traffic Exchange
Put what AI crawlers take beside what AI products send back. WebDecoy reports pages crawled, referrals from ChatGPT, Claude, Gemini, Perplexity and others, and the crawl-to-referral ratio between them. A referral is only counted when the visit carries a header naming the AI platform, and platforms frequently strip it, so referrals are a floor and the ratio an upper bound.
- Attributable AI crawls and known AI referrals in one view
- Shared search + AI crawlers counted separately from AI-only crawls
- Distinct pages an AI platform linked someone to
- Freeze a 7-, 14-, 30-, or 90-day shareable report
Pages crawled AI crawlers only
AI referrals Visitors sent by an AI assistant
Crawl to referral Pages taken per visitor returned
Pages cited Distinct pages linked to
// Known-Referer referrals are a floor.
// The resulting ratio is an upper bound.
// Reports freeze a shareable snapshot.Behavioral Analysis That Catches Every Bot
Bot Scanner goes beyond honeypots with real-time behavioral analysis. Detect headless browsers, automation frameworks, and AI crawlers before they scrape a single page.
- Detect Puppeteer, Playwright, Selenium with 95%+ accuracy
- JA4 TLS fingerprinting IDs the actor behind rotating IPs
- Mouse entropy and interaction timing analysis
- Sub-second detection to response automation
{
"detection_source": "bot_scanner",
"signals": {
"headless_browser": true,
"automation_framework": "puppeteer",
"mouse_entropy": 0.12,
"webgl_spoofed": true
},
"threat_score": 92,
"actor": {
"fingerprint_tier": "device",
"distinct_ips_seen": 5183,
"rotating": true
},
"ip_enrichment": {
"is_datacenter": true,
"abuse_score": 87
},
"action": "blocked",
"latency_ms": 47
}A Queue of Judgments, Not a Config Screen
Most bot products answer “why did you think this was a bot?” with an opaque ID or a score. A honeypot hit is explainable in one sentence, and that sentence is the whole credibility of the product.
- Monitor mode builds the deny-list while blocking nothing
- Review each entry with its evidence, then approve or dismiss
- Enforce is a gate, not a toggle: four preconditions, or it refuses
- Outcome counters are event counts, never inventory dressed as results
[pending] 9f3c4a71
device · 40 IPs · 3 sites · 2h ago
why: requested /wp-admin-backup.php at 03:41:12
a path that exists nowhere on your site,
linked only from a hidden element on /pricing
[ Deny for 30 days ] [ Dismiss ] [ Open actor → ]
// nothing in the queue blocks traffic
// until you approve it“Allow Googlebot” Shouldn’t Mean “Trust a Header”
Copying the GPTBot user-agent string is one line of code. WebDecoy makes a crawler earn the allowlist, and scores anything claiming an identity it can’t prove as impersonation.
- Published IP ranges plus forward-confirmed reverse DNS: how Googlebot is actually verified
- Agent impersonation as a first-class detection class
- Web Bot Auth (RFC 9421) signature verification, ready as operators adopt signing
- Graded human trust: require a minimum level per route
User-Agent: Googlebot/2.1
Source IP: 66.249.66.1
rDNS → crawl-66-249-66-1.googlebot.com
forward → 66.249.66.1 ✓ confirmed
ASN → 15169 (Google) ✓
// verified_status: verified
// same user agent, different source
rDNS → (none)
ASN → M247 Europe SRL ✗
// verified_status: spoofed
// detection: agent_impersonationMulti-Layer Bot Defense
WebDecoy combines invisible honeypot decoys, behavioral analysis, and an edge sensor that sees the crawlers a page tag never can. Detect when AI bots visit your website, then block, poison their training data, or trigger your security automation.
Get Started for Free Opens in a new tabConnects to Your Entire Security Stack
WebDecoy integrates with the tools you already use. Install the edge sensor on Cloudflare in one click, push composite, auto-expiring enforcement rules to your Cloudflare or AWS WAF, stream metrics to your SIEM, and automate response across your infrastructure.
MITRE ATT&CK Threat Mapping
Every detection automatically maps to MITRE ATT&CK tactics and techniques. Speak the same threat language as your SOC team, SIEM, and compliance frameworks.
TA0043
Reconnaissance
TA0006
Credential Access
TA0002
Execution
TA0007
Discovery
{
"detection": "credential_stuffing",
"mitre_attack": {
"tactics": ["TA0001", "TA0006"],
"techniques": ["T1078", "T1110.004"]
},
"technique_names": [
"Valid Accounts",
"Credential Stuffing"
],
"threat_score": 94
}Made for Your Industry
News Publishers
Protect articles from AI summarization
E-commerce
Protect pricing and inventory data
SaaS Companies
Protect documentation and code
API-First Companies
Detect API attacks & credential stuffing
Agencies
Manage multiple client sites
What is WebDecoy?
WebDecoy is a bot detection platform built on four sensors with deliberately different blind spots. Honeypot decoys (invisible links and fake API endpoints) catch bots with zero false positives, because no real visitor can reach them. Bot Scanner adds behavioral analysis and device fingerprinting for headless browsers and automation frameworks. The edge sensor catches everything that never opens a browser at all: Googlebot’s crawl pass, GPTBot, ClaudeBot, and curl. And agent identity verifies the crawlers you want to allow, so “allow Googlebot” stops meaning “trust a header.”
Every detection resolves to a persistent actor identity: JA4 TLS and device fingerprints that tie thousands of rotating IPs back to one client. Catching an actor once means catching it everywhere, which is what makes IP rotation stop working as an escape hatch. Endpoint Decoys extend the same approach to your APIs, catching credential stuffing, SQL injection, and enumeration attempts.
Enforcement is a decision you make, not a switch you flip. Monitor mode builds a reviewable deny-list with the evidence attached (which decoy, which path, when) and blocks nothing until you approve it. Then session clearance revocation handles browsers and composite, auto-expiring rules in the Cloudflare or AWS WAF you already own handle datacenter bots. Integrate with Cloudflare, AWS WAF, Splunk, Elastic, and Datadog via SDK, REST API, or native integrations, with every detection mapped to MITRE ATT&CK tactics for your SOC.
Ready to stop bots before they attack?
Get a personalized demo and see how WebDecoy can protect your specific use case.
Schedule a DemoJoin Companies Protecting Their Content
Start with our free plan. Scale to enterprise as you grow.
14 day free trial · No credit card required