Integrations

Bot Detection That Powers Your Entire Security Stack

WebDecoy is not just a standalone tool. It is the intelligence layer that connects your CDN, WAF, SIEM, and observability platforms into a unified bot defense system.

Start Free Integration View Documentation

Choose your platform

Start with the setup that matches where your site runs. Monitoring, request verification, and provider firewall actions are separate choices.

WebDecoy installation and protection options by platform
Platform and setup guide	Detection	Protection
Netlify	Extension injects a crawler sensor at build time.	Opt-in clearance checks on protected paths; Monitor first, then Enforce.
Cloudflare	Managed Worker observes requests before your origin.	Worker clearance validation and separately configured WAF response actions.
Vercel	Log drain on Pro or Enterprise; Next.js SDK alternative.	Configure Firewall actions or SDK policy separately from the monitoring install.
AWS CloudFront	Browser script or SDK for detection.	Lambda@Edge clearance validator; optional AWS WAF integration.
WordPress	Plugin adds browser detection and decoy surfaces.	WordPress rules and form protection; an edge validator extends coverage before PHP.
Railway	SDK middleware for Express, Next.js, Fastify or Hono; one-click starters.	SDK policy in your app: Monitor first, then Enforce returns a 403.
Render	SDK middleware for Express, Next.js, Fastify or Hono; one-click starters.	SDK policy in your app: Monitor first, then Enforce returns a 403.
Shopify	App embed and Web Pixel cover storefront and checkout activity.	Order tagging and risk assessments support merchant decisions; no edge validator installed by the app.

Netlify: monitor traffic, then protect selected paths

The WebDecoy extension injects an edge sensor during your build. Three environment variables enable monitoring. Add WEBDECOY_ENFORCEMENT=on and redeploy to include clearance validation, then choose protected paths and review Monitor activity before enabling Enforce in WebDecoy.

Next.js middleware runs before the validator. Crawler exceptions depend on DNS verification or signed requests. WebDecoy does not manage Netlify Firewall Traffic Rules.

Netlify setup and capabilities → Read the launch announcement → Netlify documentation →

AI assistants: install and ask through MCP

WebDecoy runs a hosted MCP (Model Context Protocol) server at https://mcp.webdecoy.com/mcp. Connect your AI assistant and ask it to install WebDecoy in your app with the right package and code for your stack, then confirm the install is reporting. After that, ask about your sites: whether protection is actually enforced, which bots were seen (including forged crawlers like a fake Bingbot), what an actor did, and what your policy is configured to do.

Works with your assistant
Claude Code (/plugin marketplace add WebDecoy/claude-plugins, then /plugin install webdecoy@webdecoy), Claude.ai and Claude Desktop (Settings, Connectors, Add custom connector), ChatGPT (developer mode connector), Codex (codex mcp add webdecoy --url https://mcp.webdecoy.com/mcp), and any assistant that runs local MCP servers through the WebDecoy CLI for macOS and Linux (brew install webdecoy/tap/webdecoy, webdecoy login, then add the command webdecoy mcp).
OAuth sign-in, per-site access
Sign in with your WebDecoy account; there is no API key to copy. You choose which sites each assistant may see, and you can review or disconnect any assistant in Settings, Connected apps.
Read-only by default
Setup tools (add a site, create decoys with ready-to-paste embed code, create a site’s script tag, check a page serves the tag) work only if you tick “Also allow setup”. The assistant can never change policies, enforcement, settings or billing, and never receives secret keys: install guides name the environment variables, and you set them.

Available on every WebDecoy plan, including Free.

AI assistant setup guide → Read the announcement → Claude Code plugin source →

Developer Tools

Bot Scanner SDK & REST API

Embed behavioral analysis directly in your application. Our JavaScript SDK detects headless browsers and automation frameworks, then triggers your response actions automatically.

JavaScript SDK
npm install @webdecoy/node - MIT licensed, no API key required
REST API
Full programmatic control: create decoys, query detections, manage responses
Webhooks
HMAC-signed payloads with trigger filtering

SDK Quick Start

// Install: npm install @webdecoy/node
import { WebDecoy, tripwire, honeytoken } from '@webdecoy/node';

// A hidden decoy link, plus the secret path it points at.
const trap = honeytoken();

const wd = new WebDecoy({
  rules: [
    // Blocks the honeytoken path and the built-in scanner bait
    // (/.env, /.git/config, /wp-config.php, ...).
    // Runs locally, in memory. No account, no API key.
    tripwire({ paths: [trap.path], action: 'DENY' }),
  ],
});

// Inject the invisible, rel=nofollow decoy link into your HTML.
// Real users never see it; a link-following scraper requests it
// and gets a 403.
body = body.replace('</body>', trap.linkHtml + '</body>');

10+

Native Integrations

<5min

Setup Time

Enforcement Providers

Monitor

First, Enforce When Ready

Integration Categories

Connect WebDecoy to every layer of your infrastructure. From edge CDNs to observability platforms, our integrations ensure bot intelligence flows exactly where you need it.

CDN & Edge

Cloudflare, Netlify, AWS

Cloud WAF

AWS WAF, Cloudflare WAF

SIEM & SOC

Splunk, CrowdStrike LogScale

Observability

Datadog Logs

Platforms

Vercel, WordPress, Shopify

Working in an AI assistant? Connect it through MCP to install WebDecoy and ask about your sites.

New · One-Click Install

Cloudflare Edge Sensor

A WebDecoy Worker that runs in front of your origin and does two jobs your page tag cannot do from inside the browser: it detects the clients that never run JavaScript (Googlebot’s crawl pass, GPTBot, ClaudeBot, CCBot, curl), and it enforces, stopping clients you have already denied before they reach your origin. Connect Cloudflare, pick a zone, deploy.

Key Capabilities

Deploy and Uninstall in One Click
A zone picker populated from your account, an editable route pattern, and a live status card with a 24-hour detection count. Uninstall removes every route and the script. We don’t offer an install we can’t reverse.
Preflight That Refuses
A third-party Worker already on your route pattern is a hard refusal, naming the conflict. A DNS-only zone is blocked before anything is written, because Worker routes only fire on proxied records and would silently never run.
Invocation Control
Negating routes for Astro, Next, Nuxt, SvelteKit, Vite, Hugo, and WordPress static prefixes keep the sensor off your assets, so a busy site doesn’t burn the Workers Free plan on .js and .css.
Fails Open, Measured
The origin response returns unconditionally and the beacon is never awaited on the response path. An adversarial test suite proves the response survives ingest failing, timing out, or the filter throwing.
Or Deploy It Yourself
The Worker is public at github.com/WebDecoy/edge with a Deploy to Cloudflare button that clones it into your own account.

Explore the Edge Sensor

Edge Sensor: install

Integrations → Cloudflare → Edge Sensor

  zone      example.com
  route     example.com/*
  excluded  /_astro/*  /_next/*  /assets/*
            /static/*  /wp-content/*  /cdn-cgi/*

✓ preflight: zone proxied, no route conflict
✓ worker deployed
✓ routes bound

detection  → reports, never blocks
enforcement→ stops clients you already denied

// one click to uninstall, removes everything

Runs on the Cloudflare Free plan: negating routes keep the sensor off your static assets

CDN & WAF Integration

Cloudflare WAF Integration

Close the loop from detection to enforcement. WebDecoy pushes a composite actor signature (fingerprint plus network plus path scope, never a bare JA4) into your Cloudflare WAF, and defaults to a Managed Challenge before it ever blocks. Every rule auto-expires, starts in monitor mode, and is reversible in one click. Zero latency. Zero configuration drift. This is the datacenter-bot layer of a two-layer model: browser-grade rotators are handled by session clearance, which a decoy hit revokes on every IP.

Key Capabilities

Composite Actor Signatures
Confirmed datacenter and scripted actors are enforced as composite rules: JA4 combined with network and path scope, never a bare fingerprint that could catch users who share it. Challenge first; block only on honeypot-grade evidence.
Monitor Mode & Auto-Expiry
Every integration starts in dry-run so you preview would-block traffic before enforcing. Rules carry a TTL, self-heal, and are revocable in one click. Verified bots always pass.
IP Blocks on Any Plan
Block IP works on every Cloudflare plan. Fingerprint (JA4) rules use cf.bot_management.ja4, which Cloudflare only offers with Bot Management, an Enterprise add-on. The zone check on the Enforcement page tells you which your zone supports.
Zero-Latency Edge Blocking
Bots blocked at the nearest edge location, 200+ data centers worldwide

Use case: Detect and respond to price-scraping traffic at the edge before it reaches an e-commerce origin. Start in monitor mode and measure the effect against your own traffic before enforcing.

Cloudflare WAF: connect

Integrations → Cloudflare

  Option 1  Connect with Cloudflare (OAuth consent)
            zone.read, firewall-services.write,
            workers-scripts.write, workers-routes.write

  Option 2  API token
            Zone > Firewall Services: Edit
            + Account ID, Zone ID, zone name

Enforcement → Response Actions
  Block actor at WAF  (needs Bot Management)
  Block IP            (any plan, auto-expires)

See the Cloudflare integration docs for setup and the zone check.

Vercel monitoring and Firewall actions

The marketplace integration provisions a log drain for connected projects on Vercel Pro or Enterprise. See crawler requests, including cache hits, without adding middleware or redeploying. On Hobby, use the Next.js SDK.

The drain reports requests after Vercel answers them. To block or challenge traffic, configure the separate Vercel Firewall integration or an application policy. IP visibility and drain sampling affect monitoring coverage.

Vercel setup and capabilities → Monitoring documentation → Firewall documentation →

Ready to Unify Your Bot Defense?

Connect WebDecoy to your existing infrastructure in minutes. No code changes required for most integrations.

Start Free Integration

Observability Integration

Datadog Integration

Send detection events to Datadog Logs. Each detection is submitted to the Datadog HTTP logs intake as one structured log entry, so you can build monitors and dashboards on top of the log stream. All you need is a Datadog API key.

Key Capabilities

One Log per Detection
Structured attributes (score, IP, user agent, enforcement result) sent to the logs intake for your Datadog site: US1, US3, US5, EU or AP1
Your Service, Source and Tags
Set the service, ddsource and extra tags attached to every log
Build Your Own Monitors and Dashboards
Use Datadog log monitors and Log Analytics widgets, for example an alert on detections with a score of 80 or more

Setup steps and example monitor queries are in the Datadog integration docs.

Datadog log entry (illustrative example)

{
  "ddsource": "webdecoy",
  "ddtags": "env:production,event_type:detection,team:security",
  "service": "webdecoy",
  "status": "warn",
  "message": "WebDecoy detection",
  "attributes": {
    "detection_id": "det_abc123",
    "decoy_id": "decoy_uuid",
    "event_type": "detection",
    "rules_enforced": true,
    "timestamp": "2026-07-15T10:30:00Z",
    "organization_id": "org_xyz789",
    "property_id": "prop_def456",
    "ip_address": "192.168.1.100",
    "user_agent": "Mozilla/5.0...",
    "bot_score": 92,
    "rule_enforcement_error": null
  }
}

What WebDecoy manages in your Web ACL

Integrations → AWS WAF
  Web ACL ARN, name, region
  Scope   REGIONAL (ALB, API Gateway) or CLOUDFRONT
  Action  Block | Count (Monitor Only) | Allow

WebDecoy maintains:
  1 managed fingerprint rule   -> Block actor at WAF
                                  (confirmed rotating actors, JA4)
  1 managed IP set             -> Block IP
                                  (entries expire, default 24h)

Cloud WAF Integration

AWS WAF Integration

Enforce WebDecoy decisions in the AWS WAF Web ACL you already run in front of CloudFront, API Gateway, or ALB. WebDecoy maintains one rule in your Web ACL, matching the JA4 fingerprints of confirmed rotating actors, plus a managed IP set for time-boxed IP blocks. Pushed rules block, count, or allow, per the action you choose.

Key Capabilities

Managed Rule and IP Set
WebDecoy creates and updates the fingerprint rule and IP set through the AWS API, so you don't hand-maintain rules. IP blocks expire after the duration you set (1 to 8760 hours).
Start in Count Mode
Set the action to Count (Monitor Only) to see what pushed rules would have blocked in AWS WAF metrics before switching to Block
CloudFront, API Gateway, ALB
Use the CLOUDFRONT scope for distributions and REGIONAL for ALB and API Gateway
Lambda@Edge Clearance Validator
For CloudFront sites, a Lambda@Edge function can check WebDecoy clearance tokens on protected paths. It fails open.

IAM permissions and setup steps are in the AWS WAF integration docs.

vcl_recv snippet

# Your VCL decides where the ACL is consulted.
# WebDecoy adds and removes the entries.
if (client.ip ~ webdecoy_blocklist) {
  error 403 "Forbidden";
}

Detection needs no VCL at all: an HTTPS logging endpoint streams each request to WebDecoy.

Detection and protection

Fastly Integration

See the automated traffic your Fastly service answers, including crawlers that never run JavaScript, and block addresses in a Fastly ACL. No code in your application.

Key Capabilities

Detection from log streaming
Fastly's HTTPS logging endpoint sends WebDecoy each request with its JA4 TLS fingerprint. Automated requests are reported; ordinary visitors are dropped, never stored.
ACL blocking
Block an address from WebDecoy. It lands in your Fastly ACL at once, is read back to confirm Fastly holds it, and is removed when it expires.
Set up by ACL name
Enter the ACL name Fastly shows you. WebDecoy looks up its ID and checks that your token can read it.
Provable install
Send a request with the WebDecoy-Test user agent and a labeled test detection appears once Fastly delivers the log.

Read the announcement or follow the Fastly setup guide.

Custom Integration

Custom Webhooks

Build your own integrations with WebDecoy's webhook system. HMAC-signed JSON payloads and trigger filtering let you route detection events into whatever tooling you already run, including SIEMs we don't integrate with directly.

Key Capabilities

HMAC-Signed Payloads
SHA-256 signatures verify webhook authenticity and prevent tampering
Delivery Stats
Each event is delivered once, with no automatic retries. A non-2xx response or a timeout after 10 seconds is recorded as a failed delivery on the webhook's stats.
Multiple Endpoint Support
Send events to multiple destinations simultaneously
Event Filtering
Trigger on every detection, only high-risk detections (score 80+), or when a response action enforces

Signature verification examples for Node.js and Python are in the webhook docs.

Webhook Payload

// Request headers
Content-Type: application/json
X-WebDecoy-Signature: sha256=abc123def456...
X-WebDecoy-Event: detection
X-WebDecoy-Delivery: <unique delivery ID>
User-Agent: WebDecoy-Webhook/1.0

// Payload
{
  "event": "detection",
  "timestamp": "2026-07-15T10:30:00Z",
  "detection": {
    "id": "det_abc123",
    "decoy_id": "decoy_uuid",
    "organization_id": "org_xyz789",
    "ip_address": "192.168.1.100",
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
    "bot_score": 92,
    "timestamp": "2026-07-15T10:30:00Z",
    "rules_enforced": true,
    "source": "decoy_link"
  },
  "metadata": {}
}

Security Operations

SIEM & SOC Integrations

Forward detection events to your SIEM. WebDecoy sends each detection as a structured event; searches, dashboards and alerts are built in your SIEM from those events. Each detection is also mapped to a MITRE ATT&CK tactic, visible on the detection in the WebDecoy dashboard and API.

Splunk

Forwards detection events to your Splunk HTTP Event Collector (HEC) as JSON, into the index and source you choose. Splunk Cloud and Splunk Enterprise.

HEC event forwarding
All detections or high risk only
Your index and source

CrowdStrike LogScale

Forwards detection events to Falcon LogScale (formerly Humio) with an ingest token, for search and correlation in your repository.

LogScale event forwarding
Trigger on detection, high risk, or rule enforced
Minimum score and decoy filters

Datadog Logs

Submits each detection to the Datadog HTTP logs intake as one log entry. Build log monitors and dashboards on the stream.

Datadog logs intake
Custom service, source and tags
All Datadog sites

Using a different SIEM, such as Elastic? Point a webhook at an endpoint you control and forward from there.

What a Splunk Event Carries

Threat Score

0-100 unified score and threat level

Threat Category

Scraper, scanner, attacker

Geo-IP Data

Country, city, coordinates

Network Flags

VPN, proxy, Tor, relay

Abuse Score

AbuseIPDB confidence score

Cryptographic Identity

Signature and token verification

Enforcement Result

Whether a response action enforced

Resource IDs

Detection, property and decoy IDs

Field lists differ per destination; see the Splunk, CrowdStrike and Datadog docs. Full enriched detail is available from the API by detection ID.

Read the SIEM Integration Guide

Integration Comparison

Choose the integrations that match your infrastructure. Webhooks, integrations and enforcement come with every paid plan, starting with Starter. See pricing.

Integration	Type	Can Block	Edge Deploy	Sends Events	You Provide
Cloudflare WAF	CDN/WAF				OAuth consent or API token
Vercel	Drain / Firewall	Separate Firewall setup	SDK option	Drain delivery	See setup guide
Datadog	Observability				Datadog API key
AWS WAF	Cloud WAF				IAM access key and Web ACL
Fastly	Edge CDN				API token and ACL name
Custom Webhooks	Custom				HTTPS endpoint URL
Splunk	SIEM				HEC URL and token
CrowdStrike LogScale	SIEM				LogScale URL and ingest token

Why WebDecoy as Your Security Hub?

Stop managing bot protection in silos. WebDecoy becomes the intelligence layer that unifies your entire security stack.

Single Source of Truth

All bot intelligence flows through WebDecoy. One dashboard, one API, one place to manage your entire bot defense strategy.

Zero-Code Automation

Integrations activate with API keys, not code changes. Your DevOps team will thank you.

Defense in Depth

Layer multiple integrations for redundant protection. Edge blocking + observability + WAF = complete coverage.

Credentials, Not Projects

Most integrations need a token or key and a few fields. No agents to install on your servers.

Monitor Before You Enforce

Enforcement integrations let you review what would have been blocked before anything is refused.

Integration Support

Stuck on setup? Contact us and we will help you get connected.

Connect Your Security Stack Today

Start with our free plan and add integrations as you grow. No credit card required. Full API access from day one.

Start Free Integration Talk to Sales

Need a destination we don't list? Webhooks can forward detection events anywhere you can receive HTTPS.