See and control automated traffic on Cloudflare.
Deploy a WebDecoy Worker in front of your origin to observe non-JavaScript crawlers. Add clearance checks for selected paths and configure WAF actions for the threats you choose to stop.
Set up WebDecoy on Cloudflare
Connect the right site
Select your site in WebDecoy and open Integrations → Cloudflare. Choose Connect with Cloudflare and approve the requested scopes. A scoped API token is also supported.
Choose a proxied hostname
Open Edge Sensor, select your Cloudflare account and zone, and review the route. The hostname must use proxied DNS. A route already owned by an unrelated Worker cannot be silently replaced.
Deploy and verify the sensor
Choose Deploy edge sensor, then confirm the Edge Worker under Sensors and send a test request. Review asset exclusions so static files do not unnecessarily invoke the Worker.
Configure your response
For clearance, complete Enforcement → Setup, verify the validator, and choose protected paths in Policy. Start in Monitor. Configure Cloudflare WAF actions separately when you want provider rules to act on detections.
Catch the request a browser tag misses
AI crawlers and HTTP tools can fetch a page without executing its JavaScript. The sensor sees those requests before they reach your origin and reports traffic that looks automated.
Keep browser detection for behavioral and fingerprint signals. A request sensor and a browser script observe different evidence.
Choose clearance checks, WAF actions, or both
Clearance validation checks requests against your protected-path policy. In Monitor it records what would happen; in Enforce it can require verification before allowing access.
Cloudflare WAF actions use a separate provider connection and its available permissions and plan capabilities. Deploying a sensor is not proof that a blocking rule exists. Review the integration’s recorded actions and verify the validator before relying on either.
Fit the Worker to your existing routes
The managed installer checks route conflicts and supports adoption of a recognized WebDecoy Worker you deployed yourself. Review the stated changes before taking over a route.
Asset exclusions reduce unnecessary invocations. Workers usage and the availability of WAF fields depend on your Cloudflare plan; the crawler sensor does not require Cloudflare’s Enterprise bot score. Use the installation guide for current account and deployment limits.
Questions about Cloudflare
Does connecting Cloudflare start blocking visitors?
Sensing reports traffic. Clearance enforcement requires a deployed validator and your protected-path policy, while WAF actions require their own configuration. Verify each layer you enable.
Can I keep my existing Worker?
The managed installer refuses a route owned by an unrelated Worker. Review your route architecture before deploying; it does not replace another application’s Worker automatically.
Can I deploy WebDecoy myself?
Yes. The public WebDecoy/edge repository includes the Worker and deployment instructions. Bind the route and verify the deployment after installing it.
Choose your platform
Start with the setup that matches where your site runs. Monitoring, request verification, and provider firewall actions are separate choices.
| Platform and setup guide | Detection | Protection |
|---|---|---|
| Netlify | Extension injects a crawler sensor at build time. | Opt-in clearance checks on protected paths; Monitor first, then Enforce. |
| Cloudflare | Managed Worker observes requests before your origin. | Worker clearance validation and separately configured WAF response actions. |
| Vercel | Log drain on Pro or Enterprise; Next.js SDK alternative. | Configure Firewall actions or SDK policy separately from the monitoring install. |
| AWS CloudFront | Browser script or SDK for detection. | Lambda@Edge clearance validator; optional AWS WAF integration. |
| WordPress | Plugin adds browser detection and decoy surfaces. | WordPress rules and form protection; an edge validator extends coverage before PHP. |
| Shopify | App embed and Web Pixel cover storefront and checkout activity. | Order tagging and risk assessments support merchant decisions; no edge validator installed by the app. |