Arcjet vs WebDecoy

Arcjet vs WebDecoy. Rate limiting SDK vs multi-signal bot detection. Complementary tools that work great together.

Arcjet vs WebDecoy

Arcjet and WebDecoy solve different problems and work great together. Arcjet excels at rate limiting—blocking volume-based attacks. WebDecoy excels at bot detection—catching sophisticated automation regardless of request volume.

What Each Does

Arcjet: Rate Limiting SDK

User Request
    ↓
Arcjet SDK
    ├── Rate Limiting
    │   ├── Token bucket
    │   ├── Sliding window
    │   └── Fixed window
    ├── Shield Rules
    │   └── Common attack patterns
    └── Basic Bot Detection
        └── Known bot signatures
    ↓
Allow / Rate Limit / Block

Arcjet’s focus: Prevent abuse through rate limiting. Block users exceeding request thresholds.

Strengths: Easy integration, free tier, effective against volume-based attacks.

WebDecoy: Multi-Signal Bot Detection

User Request
    ↓
WebDecoy Detection Stack
    ├── TLS Fingerprinting (JA3/JA4)
    │   └── User-Agent mismatch detection
    ├── IP Enrichment
    │   ├── AbuseIPDB + GreyNoise + IPQualityScore
    │   └── Datacenter/VPN/Tor detection
    ├── Geographic Consistency
    │   └── Timezone/IP/Language correlation
    ├── Honeypot Detection
    │   ├── Decoy Links (hidden spider traps)
    │   └── Endpoint Decoys (fake API routes)
    ├── Behavioral Analysis (Bot Scanner)
    │   └── Mouse entropy, keystrokes, forms
    └── Vision AI Detection (FCaptcha)
        └── GPT-4V, Claude Computer Use, Operator
    ↓
Threat Score (0-100) → Allow / Challenge / Block

WebDecoy’s focus: Detect bots through multiple independent signals. Catch sophisticated automation that evades rate limits.

Strengths: Multi-signal detection, honeypots, vision AI detection, TLS fingerprinting.

Detection Comparison

Why You Need Both

What Arcjet Catches

Arcjet is effective against:

• DDoS at application layer - Volume-based attacks
• Brute force attacks - High-volume credential attempts
• API abuse - Excessive requests from single sources
• Basic bots - Known signatures

What Arcjet Misses

Sophisticated attackers evade rate limiting:

• Rotating IPs - Distribute requests across proxies
• Low-and-slow - Stay under rate limits
• Residential proxies - Look like legitimate traffic
• Distributed attacks - Many IPs, few requests each

A bot making 10 requests/minute across 100 rotating IPs won’t trigger rate limits.

What WebDecoy Catches

WebDecoy catches what rate limiting misses:

TLS Fingerprinting

// Bot claims Chrome but has Playwright TLS fingerprint
{
  "tls": {
    "claimed": "Chrome/121",
    "actual": "Playwright",
    "mismatch": true,
    "score": +45
  }
}

Honeypots

// Bot follows hidden link no human sees
{
  "honeypot": {
    "decoy_link_triggered": true,
    "path": "/trap/a8f3d2e1",
    "score": +50
  }
}

IP Enrichment

// IP flagged by multiple threat intelligence sources
{
  "ip_enrichment": {
    "abuseipdb": { "score": 85 },
    "greynoise": { "classification": "malicious" },
    "ipqs": { "datacenter": true },
    "score": +35
  }
}

Vision AI Detection

// FCaptcha detects AI agent controlling browser
{
  "vision_ai": {
    "screenshot_loop": true,
    "pixel_perfect_clicks": true,
    "classification": "vision_ai_agent"
  }
}

Using Both Together

The ideal setup uses Arcjet for rate limiting and WebDecoy for detection:

import Arcjet from '@arcjet/node';
import { WebDecoy } from '@webdecoy/express';

const aj = new Arcjet({ key: process.env.ARCJET_KEY });
const webdecoy = new WebDecoy({ apiKey: process.env.WEBDECOY_KEY });

app.post('/api/login', async (req, res) => {
  // Layer 1: Rate limiting (Arcjet)
  const arcjetDecision = await aj.protect(req, {
    rules: [
      rateLimit({ max: 5, window: '1m' }),  // 5 attempts per minute
    ]
  });

  if (arcjetDecision.isDenied()) {
    return res.status(429).json({
      error: 'Too many requests',
      retryAfter: arcjetDecision.headers['Retry-After']
    });
  }

  // Layer 2: Bot detection (WebDecoy)
  const detection = await webdecoy.analyze(req);

  if (detection.shouldBlock()) {
    console.log('Bot blocked:', {
      tls_mismatch: detection.signals.tls?.mismatch,
      honeypot: detection.signals.honeypot?.triggered,
      threat_score: detection.threat_score
    });
    return res.status(403).json({ error: 'Access denied' });
  }

  if (detection.shouldChallenge()) {
    return res.redirect('/captcha');
  }

  // Process legitimate login
  // ...
});

This gives you:

• Arcjet: Stops volume-based attacks immediately
• WebDecoy: Catches sophisticated bots that stay under rate limits

Pricing Comparison

Arcjet

• Free: 10,000 requests/month
• Pro: $25/month (100K requests)
• Business: Custom pricing

WebDecoy

Combined Cost

For comprehensive protection:

• Arcjet Pro: $25/month (rate limiting)
• WebDecoy Starter: $59/month (bot detection)
• Total: $84/month for both layers

When to Choose Each

Arcjet Only If:

• Rate limiting is your only need
• You want to start with a free tier
• Basic bot signatures are sufficient
• Budget is very constrained

WebDecoy Only If:

• You already have rate limiting (CDN, WAF, etc.)
• Sophisticated scrapers are your primary threat
• You need vision AI detection
• You want honeypot-based detection

Both If:

• You want comprehensive protection
• You face both volume and sophistication threats
• Defense in depth is worth $84+/month

Real-World Scenario

Threat: Credential stuffing attack with rotating residential proxies.

Arcjet alone:

• Each IP makes 3 requests (under 5/minute limit)
• 1000 IPs = 3000 attempts
• Result: Attack succeeds under rate limits

WebDecoy alone:

• TLS fingerprint: Automation detected ✅
• Honeypot: Login form honeypot filled ✅
• Behavioral: Keystroke timing anomaly ✅
• Result: Blocked, but no rate limiting for high-volume

Both together:

• Arcjet: Catches any IP exceeding limits
• WebDecoy: Catches automation under limits
• Result: Comprehensive protection

What WebDecoy Provides

1. Multi-Signal Detection - TLS + IP + Geo + Behavioral + Honeypots
2. Vision AI Detection - FCaptcha catches GPT-4V, Claude Computer Use, Operator
3. Honeypot Technology - Decoy Links and Endpoint Decoys
4. IP Enrichment - AbuseIPDB, GreyNoise, IPQualityScore
5. TLS Fingerprinting - JA3/JA4 with User-Agent mismatch detection
6. Transparent Detection - See exactly which signals triggered
7. SIEM Integration - Splunk, Elastic, CrowdStrike on all plans

Get Started

Try WebDecoy: Start Your Free Trial and add bot detection to your Arcjet rate limiting.

Using Arcjet already? WebDecoy complements it perfectly. View Integration Docs

Questions? Contact us to discuss your security stack.