Frequently Asked Questions

WebDecoy is an AI bot detection and mitigation platform built on sensors with deliberately different blind spots: invisible honeypot decoys that catch bots with zero false positives, Bot Scanner for behavioral analysis and headless browser detection, and a Cloudflare edge sensor that catches the crawlers which never run JavaScript at all. Every detection resolves to a persistent actor identity that survives IP rotation. Then you decide what happens: block, redirect, revoke clearance, or poison their training data.

Setup takes about 5 minutes. Create a WebDecoy account, add a decoy link to your website, or configure your own domain with a DNS record (CNAME or A record) for seamless integration. You'll start detecting bots instantly.

No. WebDecoy is designed for non-technical users. We provide step-by-step guides, and our simple dashboard makes everything point-and-click. If you need help, our support team is here.

Yes. Our Free plan includes 3 decoys, 100 detections per month, basic analytics, and community support. No credit card required. Upgrade anytime.

Absolutely. Start with our Free plan and experience WebDecoy yourself. If you want to explore paid features, we offer a 30-day money-back guarantee on all paid plans.

Bot Scanner is WebDecoy's behavioral analysis engine that detects headless browsers (Puppeteer, Playwright, Selenium), automation frameworks, and AI crawlers in real-time. Unlike honeypots that wait for bots to click links, Bot Scanner actively analyzes visitor behavior, TLS fingerprints (JA3/JA4), and interaction patterns to detect bots with 95%+ accuracy.

Bot Scanner analyzes multiple signals: mouse movement entropy (real humans have natural, unpredictable movements), interaction timing patterns, TLS fingerprints, WebGL/Canvas fingerprints, and browser API behavior. These signals are combined to create a threat score. Headless browsers and automation tools produce distinctive signatures that humans cannot replicate.

Bot Scanner detects Puppeteer (including stealth plugin), Playwright, Selenium, Nightmare, WebDriver, Phantom.js, and other headless browser frameworks. Detection accuracy is 95%+ even against sophisticated evasion techniques.

No. The false positive rate is less than 0.1%. Real browsers produce distinctive behavioral signals (natural mouse movement, proper fingerprints, expected timing) that automation cannot replicate. Verified search engines (Googlebot, Bingbot) are whitelisted and never blocked.

Add a single script tag to your page, pointing at https://cdn.webdecoy.com/bot-detection/v1/bot-detection.min.js with your property and scanner IDs. Installation takes less than 5 minutes. The script is about 10KB gzipped and loads asynchronously. If you would rather detect on the server, install the @webdecoy/node SDK instead.

Bot Scanner can automatically: revoke a bot's session clearance so it stays locked out on every IP it rotates to, push a composite actor signature to your WAF (Cloudflare, AWS WAF) for datacenter bots, send webhook alerts (Slack, PagerDuty, custom endpoints), stream events to SIEM (Splunk, Elastic, Datadog), serve poisoned data, redirect to custom pages, or log for analysis. Response time is under 1 second from detection to enforcement.

Because a JavaScript-only install cannot see them. The page tag identifies crawlers by reading navigator.userAgent, which requires a JavaScript runtime. Googlebot's crawl pass is a plain HTTP fetch with no DOM, and GPTBot, ClaudeBot, CCBot and PerplexityBot never execute JavaScript at all. This is a structural limit of browser-side detection (ours or anyone’s), and it is exactly what the edge sensor fixes. Install it on Cloudflare in one click and the crawl pass starts showing up straight away, with no bait to place and nothing to tune.

A Cloudflare Worker that runs in front of your origin, sees the raw HTTP request, and forwards only bot-like traffic to WebDecoy. It catches everything that never opens a browser: Googlebot's crawl pass, GPTBot, ClaudeBot, CCBot, PerplexityBot, ByteSpider, curl, and scripted HTTP clients. Install it in one click from Integrations → Cloudflare, or deploy it yourself from github.com/WebDecoy/edge Opens in a new tab . It complements the page tag rather than replacing it. See the edge sensor page for the full coverage matrix.

No. The origin response is returned unconditionally, and the detection beacon runs inside ctx.waitUntil() so it is never awaited on the response path. Every code path is wrapped in try/catch, the beacon carries a hard timeout, and a config fetch failure serves stale config rather than disabling anything. The adversarial test suite asserts that ingest returning a 500, timing out, and failing DNS each leave the response untouched, and that a throw inside the filter still serves the origin response.

The installer provisions negating routes alongside the main route. A Cloudflare route with no script attached negates less specific patterns, and the most specific pattern wins. The default set covers static prefixes for Astro, Next, Nuxt, SvelteKit, Vite, Hugo and WordPress, and you can add your own. Workers is available on the Cloudflare Free plan at 100,000 requests per day. Cloudflare Pages sites can use _routes.json instead, where excluded paths never invoke the Function at all.

The install refuses and names the conflicting pattern and script. Cloudflare runs only one Worker per matched route, so silently taking the route would stop your code from running. That is not our call to make. If the existing Worker is a hand-deployed WebDecoy one, the installer offers to adopt it instead, with explicit confirmation of what changes. Installing onto a DNS-only (grey-cloud) zone is also refused before anything is written, because Worker routes only fire on proxied records and would otherwise silently never run.

By published IP ranges and forward-confirmed reverse DNS: the primary path, and the method Google itself recommends for verifying Googlebot. WebDecoy loads the range lists Google, Bing, OpenAI, Perplexity, Apple and DuckDuckGo publish, refreshing them regularly, and degrades a verdict to unverified rather than false-verifying if that data goes stale. For rDNS, a matching PTR record is not enough: the hostname must resolve back to the source IP, and matching happens on dot boundaries, so a record like fake.googlebot.com.evil.net cannot pass. Crawlers forging Googlebot from datacenter and VPN hosts are caught by exactly this check.

Web Bot Auth is a profile of RFC 9421 HTTP Message Signatures for automated clients, defined in IETF drafts authored at Cloudflare and Google. Operators publish public keys at a well-known path on a domain they control, and their bots sign each request. WebDecoy verifies those signatures in the detection pipeline, at the edge validator, and locally inside the Node SDK. Adoption is still early, and we would rather say so than oversell it: most automated traffic carries no signature yet, and Googlebot does not sign. Google's guidance is to verify it by IP range and reverse DNS instead. Treat signature verification as the layer that strengthens as operators adopt it, not the one doing the work today.

It is a detection class that only becomes possible once verification exists. When a request claims an identity that can be checked and that check fails, the request is caught in a lie rather than merely looking suspicious. WebDecoy floors the actor's threat score at tripwire grade and marks it spoofed, the same weight it gives a honeypot hit. A legitimate crawler that simply doesn't sign yet degrades to "claimed" and is never accused.

Session clearance used to answer one question: has this session tripped a decoy? It now carries a trust level (clean, human-likely, or attested-human) plus the evidence that earned it, and a protected route can require a minimum. human-likely comes from browser-integrity checks at the interstitial or interaction cadence that reads as a real hand; attested-human comes from a third-party attestation such as a Cloudflare Turnstile verdict. Evidence only ever raises a grade, and a high threat score caps it.

No. An absent claim reads as clean, exactly what every visitor received before graded trust existed. Sessions with sparse interaction (keyboard-only navigation, assistive technology, browsers that suppress canvas or WebGL) are unscored rather than scored badly, because behavioral signals must never become an accessibility barrier. Evidence can only lift a token, never lower it.

No. Cloudflare exposes verified-bot categories on its own zones, and relying on that would restrict verification to Cloudflare customers. WebDecoy verifies Web Bot Auth signatures itself in the ingest pipeline, in the edge validator, and locally in the Node SDK, so the same verification runs wherever you deploy. The Go implementation behind it is open source at github.com/WebDecoy/web-bot-auth Opens in a new tab under Apache 2.0.

We detect 20+ AI bots including GPTBot (OpenAI), ClaudeBot (Anthropic), Perplexity, GoogleBot for Research, Bingbot, Applebot, and many others. Bot Scanner adds behavioral detection for headless browsers and automation frameworks. Our detection engine is updated weekly.

Decoy links are invisible honeypot links placed on your website. They're hidden from real users but visible to web crawlers and AI bots. When a bot visits a decoy link, we detect it and can take action.

No. New WebDecoy accounts come with a working honeypot URL on our shared domain the moment you sign up: no DNS records, no certificates, no setup. You can create as many decoys as you want this way. Custom domains are an optional upgrade for when you'd rather host decoys under your own brand.

Custom domains are an optional upgrade: decoys work out of the box on our shared domain without any DNS setup. When you want decoys hosted under your own hostname, add a CNAME or A record pointing to WebDecoy in your DNS provider. We provision a Let's Encrypt SSL certificate automatically. Example: decoys.yoursite.com → webdecoy.com

Yes. You have several options: automatically block detected bot IP addresses, return HTTP 403 Forbidden, redirect to custom pages, or return intentionally bad data to poison their training. Choose what works best for you.

No. Decoy links are invisible and don't impact your site's performance. WebDecoy uses edge computing for bot detection, ensuring instant responses without slowing down your site.

Endpoint Decoys are API honeypots - fake API endpoints that detect malicious traffic. Unlike link decoys for web scrapers, Endpoint Decoys catch credential stuffing, SQL injection, API enumeration, and other backend attacks with zero false positives.

Endpoint Decoys automatically detect and categorize: SQL injection (critical), command injection (critical), XXE attacks (critical), XSS (high), path traversal (high), insecure deserialization (high), and mass assignment (medium). Each attack is logged with full forensic data.

Yes. Every WebDecoy detection automatically maps to MITRE ATT&CK tactics and techniques. For example, web crawler detection maps to Reconnaissance (TA0043), credential stuffing maps to Credential Access (TA0006), and SQL injection maps to Execution (TA0002). This enables seamless integration with SOC workflows and SIEM correlation rules.

WebDecoy detections cover multiple ATT&CK techniques including: T1595 (Active Scanning), T1594 (Search Victim-Owned Websites), T1110 (Brute Force) with sub-techniques for password spraying and credential stuffing, T1203 (Exploitation for Client Execution), T1059 (Command and Scripting Interpreter), T1083 (File and Directory Discovery), and more. Each detection includes technique IDs in webhook payloads.

Yes. Our REST API lets you programmatically create decoys, query detection events, manage webhooks, and configure settings. Full API documentation is available in your dashboard.

Yes. Set up webhooks to receive instant notifications when bots are detected. Send events to Slack, email, Discord, PagerDuty, or any custom HTTP endpoint.

WebDecoy works with all CDNs including Cloudflare, AWS CloudFront, and Akamai. For maximum stealth with custom domains, we support Cloudflare for SaaS for automatic SSL certificate provisioning.

Yes. Export detection logs, create custom reports, and download raw data for analysis. Professional and Business plans include scheduled email reports.

Enterprise plans include SAML 2.0 and OAuth 2.0 support for Single Sign-On integration with your identity provider. Contact sales for details.

Yes. Create Endpoint Decoys at paths like /api/admin/login, /api/users, or /graphql to catch attackers probing your API. Configure expected content types, allowed HTTP methods, and enable request body capture for forensic analysis.

Yes. Endpoint Decoy detections can be sent via webhooks to any SIEM including Splunk, Elastic, Datadog, and more. Each detection includes attack signatures, severity levels, HTTP method, headers, and optional request body for complete forensic analysis.

Yes. We don't store any personally identifiable information (PII). We only store bot detection events with IP addresses and user agents. See our Privacy Policy for complete details.

All data is encrypted in transit (TLS 1.3) and at rest. We use industry-standard security practices, regular penetration testing, and comply with SOC 2 requirements.

All webhooks are signed with HMAC-SHA256. Verify the signature using your webhook secret to ensure the request came from WebDecoy. We also support multiple retry attempts for reliability.

Yes. All data is backed up to geographically distributed servers. We maintain 99.99% uptime SLA and can quickly restore data if needed.

Yes. You can delete your account at any time, which permanently removes all your data. We also comply with GDPR data deletion requests.

We accept all major credit cards (Visa, Mastercard, American Express), bank transfers, and wire transfers for enterprise customers. Payments are processed securely through Stripe.

Yes. Upgrade or downgrade at any time. Changes take effect immediately, and we'll prorate charges or issue refunds based on your billing cycle.

Yes. Save 20% with annual billing. Enterprise customers get volume discounts and custom pricing. Contact our sales team for a quote.

30-day money-back guarantee on all paid plans. If WebDecoy isn't right for you, we'll issue a full refund. No questions asked.

Free plan: Community support. Starter: Email support. Professional: Priority email support. Business: Dedicated account manager and phone support.

First, make sure the decoy URL is accessible from the internet. Check that robots.txt isn't blocking it and that you're not blocking WebDecoy's detection crawler. Contact support if you need help.

Check that your webhook endpoint is accessible from the internet and responds with 200 OK. We retry failed webhooks 3 times. Check the webhook log in your dashboard to see delivery status.

Yes. Add decoy links in your HTML, load them dynamically with JavaScript, or use our API to manage decoys programmatically. Works great with React, Vue, Angular, etc.

Yes. You can place decoy links anywhere on your site - root, subdirectories, or specific paths. They'll work regardless of your URL structure.

Log in to your account and go to Settings → Billing. You can update payment methods, email address, and billing information anytime.