Protect your Netlify site at the edge.
See the crawlers that never run JavaScript. Then require verification on the paths you choose, with an edge function injected by the WebDecoy extension during your build.
Set up WebDecoy on Netlify
Install on your Netlify team
Open the WebDecoy Crawler Sensor using the direct extension link. It is public and unlisted. Installing on a team changes no site until you configure that site and deploy.
Copy your site’s sensor values
Select your site in WebDecoy, open Setup, and choose Netlify. Add WEBDECOY_SITE_KEY, WEBDECOY_SCANNER_ID, and WEBDECOY_SENSOR_KEY in Netlify’s environment settings with Functions scope. Keep the sensor key secret.
Deploy and verify monitoring
Trigger a deploy, then request your site with the user agent WebDecoy-Test/1.0. Confirm the sensor report in Setup. This is a labeled test, not a bot finding. The three-variable install only monitors.
Enable the validator when ready
Add WEBDECOY_ENFORCEMENT=on with Functions scope and redeploy. Complete browser verification and verify the validator in Enforcement → Setup. Configure protected paths and exceptions in Policy, review activity in Monitor, then use Overview to enable Enforce after the readiness checks pass.
After deployment, send a labeled test request to your own hostname:
curl -A 'WebDecoy-Test/1.0' https://YOUR-SITE.netlify.app/One function, two deliberate choices
Monitoring reports automated traffic while leaving responses alone. Adding the fourth variable installs clearance validation; the Monitor or Enforce setting in WebDecoy determines whether it can refuse a request.
On a protected path in Enforce mode, requests must satisfy your access policy. Browsers can earn a signed clearance cookie; clients without the required proof face verification or a 403 for non-HTML requests. Unscoped paths remain available.
Verify crawlers before granting exceptions
The Netlify validator checks supported search engines through forward-confirmed reverse DNS and can verify Web Bot Auth signatures. It does not receive Cloudflare’s verified-bot signal.
A category the validator cannot verify through DNS is allowed through its crawler exception only when the request is signed. Otherwise, it must meet the path’s verification requirement. Review the dashboard’s capability notices before protecting content needed by crawlers.
Check your Next.js middleware
Next.js middleware runs before the injected function. A response returned there bypasses the validator, and a rewrite changes the path the validator evaluates. Your site’s edge functions, Netlify redirects, and origin run after the gate.
Test middleware responses and rewritten routes as part of verification. Keep public pages unscoped where open indexing is the intended behavior.
Check outcomes and keep a way back
Request reports identify the hostname and validator build. Use those reports to confirm what actually ran, and keep simulated Monitor outcomes distinct from actual refusals.
Remove WEBDECOY_ENFORCEMENT and redeploy to return to sensor-only monitoring. Remove the three sensor variables and redeploy to stop injecting the function. Netlify usage limits and charges apply; WebDecoy does not manage Netlify Firewall Traffic Rules.
Questions about Netlify
Does the extension change my source code?
No. It injects an edge function into the build. Environment changes require a new deploy to change what that build contains.
Is enforcement turned on for existing installs?
No. The validator requires WEBDECOY_ENFORCEMENT=on and a redeploy. WebDecoy’s policy then determines which paths are protected and whether requests are monitored or refused.
Do I need Netlify Enterprise?
The WebDecoy validator works on every Netlify plan, subject to your plan’s usage limits. It does not depend on Enterprise Firewall Traffic Rules.
Choose your platform
Start with the setup that matches where your site runs. Monitoring, request verification, and provider firewall actions are separate choices.
| Platform and setup guide | Detection | Protection |
|---|---|---|
| Netlify | Extension injects a crawler sensor at build time. | Opt-in clearance checks on protected paths; Monitor first, then Enforce. |
| Cloudflare | Managed Worker observes requests before your origin. | Worker clearance validation and separately configured WAF response actions. |
| Vercel | Log drain on Pro or Enterprise; Next.js SDK alternative. | Configure Firewall actions or SDK policy separately from the monitoring install. |
| AWS CloudFront | Browser script or SDK for detection. | Lambda@Edge clearance validator; optional AWS WAF integration. |
| WordPress | Plugin adds browser detection and decoy surfaces. | WordPress rules and form protection; an edge validator extends coverage before PHP. |
| Shopify | App embed and Web Pixel cover storefront and checkout activity. | Order tagging and risk assessments support merchant decisions; no edge validator installed by the app. |