Multi-Layer Bot Detection Platform

WebDecoy combines honeypot deception, behavioral analysis, and an edge sensor with deliberately different blind spots, then resolves every detection to one actor identity and lets you decide what happens next.

Bot Scanner

Behavioral Analysis Engine

Go beyond honeypots with real-time behavioral analysis. Bot Scanner detects headless browsers and automation frameworks that evade traditional detection methods.

Headless Detection

Detect Puppeteer, Playwright, Selenium, and Nightmare with 95%+ accuracy using advanced fingerprinting techniques.

TLS Fingerprinting

JA4 TLS fingerprints reveal the true client behind a disguised user agent, and become the actor identity that follows a bot across every IP it rotates through.

Behavioral Signals

Mouse entropy, interaction timing, and scroll patterns distinguish real users from automation scripts.

IP Enrichment

Real-time threat intelligence from GreyNoise, AbuseIPDB, and IPQualityScore. Detect datacenter, VPN, and Tor exit nodes.

New Feature

LLM Referral Tracking

See visitors arriving from ChatGPT, Perplexity, Gemini, Claude, and 7 other AI platforms. Track the fastest-growing acquisition channel your analytics is missing.

11 AI Platforms Referral Dashboard Traffic Trends Zero Config
Bot Scanner SDK Installation
<!-- One line to install Bot Scanner -->
<script
  async
  src="https://cdn.webdecoy.com/bot-detection/v1/bot-detection.min.js"
  data-aid="your-property-uuid"
  data-sid="your-scanner-uuid"
></script>

// Prefer server-side? Use the Node SDK instead.
npm install @webdecoy/node

import { WebDecoy, tripwire, honeytoken } from '@webdecoy/node';
Edge Sensor

The Crawlers a Page Tag Can Never See

Googlebot’s crawl pass is plain HTTP with no DOM. GPTBot and ClaudeBot never run JavaScript at all. A one-click Cloudflare Worker puts a sensor in front of your origin, where those requests actually are.

Sees the Crawl Pass

Googlebot’s crawl pass, GPTBot, ClaudeBot, CCBot, PerplexityBot, ByteSpider, Amazonbot, and curl (plus your robots.txt and sitemap fetches).

Impersonation at the Edge

Chrome always sends sec-ch-ua on a navigation. A request claiming Chrome without it is lying: a check impossible from JavaScript, because the impersonator never runs any.

One-Click Install

Connect Cloudflare, pick a zone, deploy. Preflight refuses route conflicts and grey-cloud zones rather than silently no-op’ing. Uninstall is one click too.

Fails Open by Design

The origin response returns unconditionally; the beacon is never awaited on the response path, and an adversarial test suite proves it stays up when everything downstream fails.

Explore the Edge Sensor
Agent Identity & Trust

Verify Agents. Catch Impersonators. Grade Humans.

A user-agent string is a claim, and claims are free. WebDecoy makes a crawler earn the allowlist: published IP ranges with forward-confirmed reverse DNS today, cryptographic signatures as operators adopt them.

IP Range + Forward rDNS

The primary path, and the one Google itself recommends: published IP ranges plus reverse DNS that must forward-confirm back to the source IP.

Agent Impersonation

Fake GPTBot, Googlebot from a datacenter or VPN host, a crawler whose rDNS points elsewhere. Each becomes a tripwire-grade detection.

Signature Verification

RFC 9421 Web Bot Auth signatures checked against the operator’s published key directory. Few operators sign today, but the verification is in place for when they do.

Graded Human Trust

Clearance tokens carry a trust level (clean, human-likely, attested-human), and routes can require a minimum grade.

Explore Agent Identity

Core Detection Features

AI Bot Detection

Identify GPTBot, ClaudeBot, Perplexity, and 20+ other AI scrapers, then prove it. A signature or a published IP range earns "verified"; a matching user agent alone earns nothing.

Verified Agents

See every AI agent that touched your site, how its identity was established, and who tried to impersonate it, with per-agent allow and deny overrides.

Custom Honeypots

Create invisible decoy links specifically designed to attract bots while remaining invisible to real users. Customize paths, content, and triggers.

Zero-Setup Hosting, BYO Domain Optional

Start instantly on the WebDecoy shared domain: no DNS, no setup. Or bring your own domain with a simple CNAME/A record when you want decoys under your own brand.

Instant Response Actions

Trip a decoy and the bot loses its session clearance on every IP it rotates to. Composite, auto-expiring rules in your Cloudflare or AWS WAF stop datacenter bots at the edge you already own, in milliseconds.

Data Poisoning

Return false or misleading data to bots. Train their models on intentionally bad data to reduce their effectiveness.

Endpoint Decoys

Deploy API honeypots that mimic real endpoints. Detect SQL injection, credential stuffing, and API enumeration attacks with zero false positives.

Geographic Consistency

Analyze timezone, language, and GeoIP data to detect VPNs and proxies. Score visitor consistency and flag location spoofing in real-time.

LLM Referral Tracking

Track visitors arriving from ChatGPT, Perplexity, Gemini, Claude, and 8 more AI platforms. Measure your AI search traffic with zero configuration.

Endpoint Decoys: API Honeypot Protection

Advanced API security that catches attackers before they reach your real infrastructure. Deploy fake endpoints that detect and analyze malicious API traffic in real-time.

Attack Detection

Automatically detect and categorize attack patterns:

  • Critical SQL Injection
  • Critical Command Injection
  • Critical XXE Attacks
  • High XSS & Path Traversal

Forensic Capture

Full attack payload analysis:

  • Request body capture
  • HTTP method tracking
  • Authorization header detection
  • Content-type analysis

Zero False Positives

Only real attackers trigger detections:

  • Endpoints don't exist in your app
  • Legitimate users never find them
  • Only scanners & attackers trigger
  • AbuseIPDB integration
Learn More About Endpoint Decoys

Real-Time Analytics Dashboard

Monitor all bot detection activity in real-time. See which bots visit your site, when they visit, what they access, and take immediate action.

Detection Timeline

View bot activity over time with interactive charts and graphs

Bot Distribution

See which bots are targeting you most frequently

Geographic Analysis

Track bot activity by location and IP address

Enterprise Integrations

Connect WebDecoy to your entire security stack. Block bots at the edge, stream metrics to your SIEM, and automate response across your infrastructure.

CDN & Edge

  • Cloudflare WAF
  • Akamai
  • Fastly

Cloud WAF

  • AWS WAF
  • Cloudflare Firewall
  • Composite signatures + challenges

Observability

  • Datadog
  • Custom SIEM
  • Real-time metrics

Automation

  • Vercel Edge
  • Custom Webhooks
  • REST API
View All Integrations
SOC Integration

MITRE ATT&CK Mapping

Every WebDecoy detection automatically maps to MITRE ATT&CK tactics and techniques. Your SOC team gets standardized threat intelligence that integrates with existing workflows.

  • Reconnaissance (TA0043) - Web crawling, AI bot detection
  • Credential Access (TA0006) - Brute force, credential stuffing
  • Execution (TA0002) - SQL injection, command injection
  • Discovery (TA0007) - Path traversal, API enumeration
Learn About ATT&CK Mapping
Webhook Payload
{
  "detection_type": "sql_injection",
  "severity": "critical",
  "mitre_attack": {
    "tactics": ["TA0002", "TA0006"],
    "techniques": ["T1203", "T1110.004"],
    "technique_names": [
      "Exploitation for Client Execution",
      "Credential Stuffing"
    ]
  },
  "source_ip": "185.x.x.x",
  "threat_score": 94
}

Enterprise Features

Team Management

Invite team members with role-based access. Granular permissions for viewing data, managing settings, and billing.

Actor Enforcement Management

Manage both enforcement layers in one place: decoy-revoked session clearance for browser actors, and composite fingerprint rules (never a bare JA4) pushed to your Cloudflare or AWS WAF for datacenter bots. Every rule auto-expires and is reversible.

Audit Logs

Complete audit trail of all actions. Track who made changes, when, and why for compliance and security.

Scheduled Reports

Automated weekly or monthly reports sent to your team. Customizable metrics and insights.

SSO Integration

Single Sign-On support. SAML 2.0 and OAuth 2.0 for enterprise authentication.

Advanced Security

GDPR compliant. No PII storage. End-to-end encryption for sensitive data.

Enforcement

A Queue of Judgments, Not a Config Screen

Enforcement that starts blocking the moment you enable it is a leap of faith. WebDecoy builds the deny-list while still in monitor mode, so by the time you turn enforcement on you are acting on a list you have already read.

Monitor Builds the List

A decoy hit in monitor mode writes a pending deny-list entry that affects nothing: never minting, never the edge config. The list fills up while you are still watching.

Evidence, Not a Score

Every row explains itself in one sentence: which decoy fired, which path, how it was reachable, when. Approve or dismiss, and dismiss is as prominent as deny.

Enforce Is a Gate

Four preconditions: clearance key installed, routes scoped, edge validator alive, WAF connected. Fail any one and the switch is disabled with a stated reason, not a click that quietly does nothing.

Honest Counters

Every number rendered as an outcome is an event count (mint attempts actually refused, requests actually challenged), never a row count dressed up as a result.

Two lanes, stated plainly. Browsers get session clearance tokens, revoked on every IP the moment a decoy is tripped. Clients that never open a browser resolve only to a network-tier JA4 fingerprint, so they are handled by composite, auto-expiring WAF rules instead. Different evidence, different enforcement. The product says which is which rather than implying one story.

Response Actions

Automated Threat Response

Once a judgment is approved, response is automatic. Revoke the actor's session clearance, block datacenter bots at the edge, alert your team, and feed your SIEM, all in milliseconds.

Edge Blocking

Push a composite actor signature to Cloudflare or AWS WAF: challenge first, block last, auto-expiring. The safe, cheap layer for datacenter and scripted bots; session clearance handles the residential rotators no rule can catch.

Response time: <1 second

Webhook Alerts

Send HMAC-signed detection events to Slack, PagerDuty, or any custom endpoint. Trigger your security playbooks automatically.

Supports retry with exponential backoff

SIEM Integration

Stream events to Splunk, Elastic, Datadog, or CrowdStrike. Every detection includes MITRE ATT&CK technique IDs.

Syslog, CEF, and native formats

Data Poisoning

Serve fake or misleading content to detected bots. Pollute AI training datasets with intentionally bad data.

Configurable per bot type

Smart Redirects

Redirect bots to custom pages, tarpit endpoints, or competitor sites. Control exactly where unwanted traffic goes.

Custom redirect rules per detection type

SDK & API

Full REST API and JavaScript SDK for custom integrations. Build automated workflows that match your security policies.

npm: @webdecoy/node

Supported AI Bots

We detect a wide range of AI scrapers and bots. Our detection engine combines behavioral analysis with user agent verification to catch bots that bypass robots.txt.

  • GPTBot (OpenAI)
  • ClaudeBot (Anthropic)
  • Perplexity
  • GoogleBot (Research)
  • Bingbot
  • Applebot
  • Metabot
  • And 15+ others

Always Growing

Our detection engine combines behavioral analysis with continuous updates. New bot patterns, threat intelligence, and response actions added weekly.

Actor Identity & Session Clearance: Jul 2026

Bots are now tracked as persistent actors across rotating IPs. Real sessions earn signed clearance that a decoy hit revokes on every IP; confirmed datacenter actors are blocked by composite fingerprint rules via automatic AWS WAF and Cloudflare integration.

LLM Referral Tracking: Feb 2026

Track visitors from ChatGPT, Perplexity, Gemini, Claude, and 7 more AI platforms. AI search analytics dashboard.

Bot Scanner GA: Nov 2024

Behavioral analysis engine with headless browser detection, TLS fingerprinting, and real-time threat scoring.

SDK Release: Nov 15, 2024

JavaScript SDK (@webdecoy/client) for embedded detection and custom response automation.

Questions about our bot detection capabilities?

Our team can help you understand how WebDecoy fits your specific security needs.

Talk to an Expert

Ready to Protect Your Content?

Start with our free plan and upgrade as you grow.

14 day free trial · No credit card required

Start 14-Day Free Trial Opens in a new tab