DETECT
& BLOCK Bots by Identity
Four sensors, one actor. Honeypot decoys catch bots with zero false positives. Behavioral analysis catches headless browsers and automation frameworks. An edge sensor catches the crawlers that never run JavaScript at all. Every detection resolves to a single actor identity that survives IP rotation — so one decoy hit follows it across every address it rotates to.
14 day free trial · No credit card required
Why WebDecoy?
Honeypot Deception
Invisible decoy links and fake API endpoints that no real visitor can reach. When one is touched you have a confirmed bot—not a score, not a guess. Zero false positives, by construction.
Behavioral Analysis
Bot Scanner detects headless browsers, automation frameworks, and sophisticated bots that evade traditional detection—mouse entropy, interaction timing, canvas and WebGL signals.
Edge Sensor
A one-click Cloudflare Worker that catches the crawl pass itself—Googlebot, GPTBot, ClaudeBot, and curl. The clients that never run JavaScript, and so were never visible to a page tag.
Persistent Actor Identity
JA4 TLS and device fingerprints tie thousands of rotating IPs back to one actor. Catch it once and the detection follows it everywhere—IP rotation stops being an escape hatch.
Stop AI Scrapers
Detect and block GPTBot, ClaudeBot, Perplexity, and 20+ AI crawlers. Protect your content from unauthorized training data harvesting.
Verified Crawlers
“Allow Googlebot” stops meaning “trust a header.” Crawlers are verified against published IP ranges with forward-confirmed reverse DNS, plus Web Bot Auth signatures from operators that sign. Anything claiming an identity it can’t prove is scored as impersonation.
Enforcement You Approve
Monitor mode builds a reviewable deny-list with the evidence attached—which decoy, which path, when. You approve it, then clearance revocation and auto-expiring WAF rules act on exactly what you approved.
SDK, API & Webhooks
Embed detection with the Node SDK or JavaScript tag, drive everything through the REST API, and push events to Slack, SIEM, or PagerDuty.
LLM Referral Tracking
See visitors arriving from ChatGPT, Perplexity, Gemini, and 8 more AI platforms. Track the AI search traffic your analytics is missing.
See the Crawlers JavaScript Can’t
Googlebot’s crawl pass is plain HTTP with no DOM. GPTBot and ClaudeBot never run JavaScript at all. A page tag is structurally incapable of seeing them—so we put a sensor in front of your origin. One click on Cloudflare.
- Install and uninstall in one click—no wrangler, no YAML
- Detects the crawl pass, scripted clients, and forged crawler identities
- Enforces at the edge—denied clients stopped before your origin
- Fails open by design—it cannot take your site down
GET /robots.txt HTTP/1.1
User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)
CF-Connecting-IP: 142.111.58.63
// flags: known_crawler_ua, crawler_path
// forwarded to WebDecoy, response untouched
— server-side verification —
// rDNS: acedatacenter.com
// ASN: not Google (15169)
// verdict: agent_impersonationEndpoint Decoys: API Honeypots
Go beyond web scraper detection. Deploy fake API endpoints that catch credential stuffing attacks, SQL injection attempts, and API enumeration before attackers reach your real infrastructure.
- Detect SQL injection, XSS, XXE & more
- Zero false positives - only attackers trigger
- Full forensic payload capture
- AbuseIPDB threat intelligence integration
POST /api/admin/login HTTP/1.1
Content-Type: application/json
{
"username": "admin' OR '1'='1",
"password": "' UNION SELECT * --"
}
// DETECTED: SQL Injection
// Severity: Critical
// Actor blocked at WAF by JA4 (every IP)Catch VPNs, Proxies & Location Spoofing
Fraudsters hide behind VPNs and proxies. Our Geographic Consistency Detection exposes them by analyzing timezone, language, and IP mismatches in real-time.
- Timezone vs GeoIP continent-level mismatch detection
- Browser language vs expected country language analysis
- VPN likelihood scoring (0-100 consistency score)
- Stop credential stuffing and payment fraud at the source
{
"geo_consistency": {
"consistency_score": 35,
"is_vpn_likely": true,
"flags": [
"timezone_mismatch",
"language_mismatch"
]
},
"analysis": {
"browser_tz": "Asia/Shanghai",
"geoip_tz": "America/New_York",
"languages": ["zh-CN", "zh"],
"expected": ["en"]
},
"verdict": "block"
}See Your AI Search Traffic
When someone asks ChatGPT about your product and clicks through, where does that show up in your analytics? Nowhere — until now. WebDecoy tracks LLM referral traffic across 11 AI platforms.
- Dashboard with top AI platforms, trends, and landing pages
- ChatGPT, Perplexity, Gemini, Claude, DeepSeek, Copilot, and more
- Zero configuration — works automatically with the detection script
- Score of 0 — these are human visitors, not bots
{
"source": "llm_referral",
"score": 0,
"flags": ["llm_referral"],
"referrer": "https://chat.openai.com/",
"platform": "chatgpt",
"landing_page": "/pricing",
"timestamp": "2026-02-07T14:23:00Z"
}
// Human visitor from AI search
// Not a bot — analytics onlyBehavioral Analysis That Catches Every Bot
Bot Scanner goes beyond honeypots with real-time behavioral analysis. Detect headless browsers, automation frameworks, and AI crawlers before they scrape a single page.
- Detect Puppeteer, Playwright, Selenium with 95%+ accuracy
- JA4 TLS fingerprinting IDs the actor behind rotating IPs
- Mouse entropy and interaction timing analysis
- Sub-second detection to response automation
{
"detection_source": "bot_scanner",
"signals": {
"headless_browser": true,
"automation_framework": "puppeteer",
"mouse_entropy": 0.12,
"webgl_spoofed": true
},
"threat_score": 92,
"actor": {
"fingerprint_tier": "device",
"distinct_ips_seen": 5183,
"rotating": true
},
"ip_enrichment": {
"is_datacenter": true,
"abuse_score": 87
},
"action": "blocked",
"latency_ms": 47
}A Queue of Judgments, Not a Config Screen
Most bot products answer “why did you think this was a bot?” with an opaque ID or a score. A honeypot hit is explainable in one sentence—and that sentence is the whole credibility of the product.
- Monitor mode builds the deny-list while blocking nothing
- Review each entry with its evidence, then approve or dismiss
- Enforce is a gate, not a toggle—four preconditions, or it refuses
- Outcome counters are event counts, never inventory dressed as results
[pending] 9f3c4a71
device · 40 IPs · 3 sites · 2h ago
why: requested /wp-admin-backup.php at 03:41:12
— a path that exists nowhere on your site,
linked only from a hidden element on /pricing
[ Deny — 30 days ] [ Dismiss ] [ Open actor → ]
// nothing in the queue blocks traffic
// until you approve it“Allow Googlebot” Shouldn’t Mean “Trust a Header”
Copying the GPTBot user-agent string is one line of code. WebDecoy makes a crawler earn the allowlist—and scores anything claiming an identity it can’t prove as impersonation.
- Published IP ranges plus forward-confirmed reverse DNS—how Googlebot is actually verified
- Agent impersonation as a first-class detection class
- Web Bot Auth (RFC 9421) signature verification, ready as operators adopt signing
- Graded human trust—require a minimum level per route
User-Agent: Googlebot/2.1
Source IP: 66.249.66.1
rDNS → crawl-66-249-66-1.googlebot.com
forward → 66.249.66.1 ✓ confirmed
ASN → 15169 (Google) ✓
// verified_status: verified
— same user agent, different source —
rDNS → (none)
ASN → M247 Europe SRL ✗
// verified_status: spoofed
// detection: agent_impersonationMulti-Layer Bot Defense
WebDecoy combines invisible honeypot decoys, behavioral analysis, and an edge sensor that sees the crawlers a page tag never can. Detect when AI bots visit your website, then block, poison their training data, or trigger your security automation.
Get Started for Free Opens in a new tabConnects to Your Entire Security Stack
WebDecoy integrates with the tools you already use. Install the edge sensor on Cloudflare in one click, push composite, auto-expiring enforcement rules to your Cloudflare or AWS WAF, stream metrics to your SIEM, and automate response across your infrastructure.
MITRE ATT&CK Threat Mapping
Every detection automatically maps to MITRE ATT&CK tactics and techniques. Speak the same threat language as your SOC team, SIEM, and compliance frameworks.
TA0043
Reconnaissance
TA0006
Credential Access
TA0002
Execution
TA0007
Discovery
{
"detection": "credential_stuffing",
"mitre_attack": {
"tactics": ["TA0001", "TA0006"],
"techniques": ["T1078", "T1110.004"]
},
"technique_names": [
"Valid Accounts",
"Credential Stuffing"
],
"threat_score": 94
}Made for Your Industry
News Publishers
Protect articles from AI summarization
E-commerce
Protect pricing and inventory data
SaaS Companies
Protect documentation and code
API-First Companies
Detect API attacks & credential stuffing
Agencies
Manage multiple client sites
What is WebDecoy?
WebDecoy is a bot detection platform built on four sensors with deliberately different blind spots. Honeypot decoys—invisible links and fake API endpoints—catch bots with zero false positives, because no real visitor can reach them. Bot Scanner adds behavioral analysis and device fingerprinting for headless browsers and automation frameworks. The edge sensor catches everything that never opens a browser at all: Googlebot’s crawl pass, GPTBot, ClaudeBot, and curl. And agent identity verifies the crawlers you want to allow, so “allow Googlebot” stops meaning “trust a header.”
Every detection resolves to a persistent actor identity—JA4 TLS and device fingerprints that tie thousands of rotating IPs back to one client. Catching an actor once means catching it everywhere, which is what makes IP rotation stop working as an escape hatch. Endpoint Decoys extend the same approach to your APIs, catching credential stuffing, SQL injection, and enumeration attempts.
Enforcement is a decision you make, not a switch you flip. Monitor mode builds a reviewable deny-list with the evidence attached—which decoy, which path, when—and blocks nothing until you approve it. Then session clearance revocation handles browsers and composite, auto-expiring rules in the Cloudflare or AWS WAF you already own handle datacenter bots. Integrate with Cloudflare, AWS WAF, Splunk, Elastic, and Datadog via SDK, REST API, or native integrations, with every detection mapped to MITRE ATT&CK tactics for your SOC.
Ready to stop bots before they attack?
Get a personalized demo and see how WebDecoy can protect your specific use case.
Schedule a DemoJoin Companies Protecting Their Content
Start with our free plan. Scale to enterprise as you grow.
14 day free trial · No credit card required