Threat Scoring
Every detection generates a single threat score from 0-100, combining multiple signals into one actionable risk assessment. Configure automated responses based on score thresholds.
Score Components
The unified score weighs seven factors to create a comprehensive risk assessment.
Threat Levels & Actions
Configure automated responses based on threat score thresholds.
MINIMAL
0-20
Allow requests
Legitimate visitors
LOW
21-40
Log for analysis
Monitor patterns
MEDIUM
41-60
Challenge with CAPTCHA
Review alerts
HIGH
61-80
Challenge or block
Notify security team
CRITICAL
81-100
Block immediately
Investigate source
Recommended thresholds: Financial sites: block at 60 · Standard sites: block at 75 · Public content: block at 85
Signature Scoring
Attack signatures detected in requests add points to the threat score. Multiple signatures can combine for high scores.
{
"total_score": 87,
"level": "CRITICAL",
"components": {
"attack_signatures": {
"weight": "25%",
"contribution": 35,
"signals": ["sql_injection"]
},
"honeypot_match": {
"weight": "20%",
"contribution": 25,
"signals": ["endpoint_triggered"]
},
"ip_reputation": {
"weight": "15%",
"contribution": 15,
"signals": ["datacenter_ip", "abuseipdb_score"]
}
},
"recommended_action": "block_immediately"
}Integrations
When WebDecoy detects a threat, automated actions execute across your security stack.
Cloudflare
WAF/Blocking
Composite signatures + graduated challenges
AWS WAF
WAF/Blocking
Composite signatures + graduated challenges
Fastly
WAF/Blocking
Access control lists
Vercel
Edge
Edge middleware + blocking
Slack
Notifications
Real-time alerts
CrowdStrike
SIEM
Falcon LogScale events
Datadog
SIEM
Event forwarding & metrics
Webhooks
Custom
POST to any endpoint
Recommended Setup
Start with these integration combinations for effective protection.
Basic Protection
For most websites and applications.
- Cloudflare or AWS WAF for blocking
- Slack for real-time alerts
- Block threshold at 75
Comprehensive Security
For high-security or financial applications.
- WAF integration (Cloudflare/AWS)
- SIEM (CrowdStrike or Datadog)
- Slack + custom webhooks
- Block threshold at 60
Why Automate Bot Blocking
Manual bot response is too slow. Automated rules block attackers in milliseconds.
Sub-Second Response
Automated rules trigger within 100ms of detection. By the time a human reviews an alert, the attacker has already moved on.
Edge-Level Blocking
WebDecoy pushes a composite actor signature to your WAF and defaults to a challenge—the safe, cheap layer that stops datacenter and scripted bots before they reach your origin. Browser-grade rotators are caught by session clearance instead, so real users who share a fingerprint pass invisibly.
Scales Automatically
Handle thousands of concurrent attacks without manual intervention. Rules scale with your traffic and threat volume.
Learn More About Threat Response
Guides on integrating WebDecoy with your security infrastructure.
SIEM Integration Guide
Forward bot detections to Splunk, Elastic, CrowdStrike, and Datadog.
WebDecoy & WAAP Integration
How honeypot intelligence integrates with Web Application and API Protection.
Bot Detection for Security Teams
How blue, red, and purple teams leverage bot detection intelligence.
See also: Decoy Links for honeypot traps, Endpoint Decoys for API honeypots, and Bot Scanner for client-side detection.
Frequently Asked Questions
Common questions about threat scoring and automated bot blocking.
How is the threat score calculated?
The threat score (0-100) combines seven weighted factors: attack signatures (25%), honeypot matches (20%), IP reputation (15%), user agent analysis (15%), header analysis (10%), composite fingerprint—JA4 TLS plus canvas/WebGL device signals (10%), and behavioral signals (5%). Multiple detections combine to push scores into critical ranges, and a single fingerprint seen rotating across many IPs escalates the score further.
What actions can be triggered based on threat scores?
You configure automated responses at each threshold: allow normal traffic (0-20), log for monitoring (21-40), challenge with CAPTCHA (41-60), challenge or block (61-80), and block immediately (81-100). Actions can include revoking the actor's session clearance, pushing a composite fingerprint rule to your WAF for datacenter bots, Slack alerts, SIEM forwarding, and custom webhooks.
How does the Cloudflare WAF integration work?
When WebDecoy confirms an actor worth acting on, it writes a composite signature into your Cloudflare WAF—the JA4 combined with the actor's network and path scope, never a bare fingerprint—and defaults to a Managed Challenge, reserving outright blocks for honeypot-grade evidence. Every rule starts in monitor mode, carries an automatic expiry, and is reversible in one click; verified bots like Googlebot are always allowlisted. The integration uses the Cloudflare API (Bot Management is required for the JA4 field) and is opt-in per route. This rule layer targets datacenter and scripted bots; browser-grade rotators are handled by session clearance, which a decoy hit revokes on every IP.
Can I customize the threat score thresholds?
Yes. You set your own thresholds for each action. Financial and high-security sites typically block at score 60, standard business sites at 75, and public content sites at 85. You can also configure different thresholds for different paths or endpoints.
How do I send bot detections to my SIEM?
WebDecoy supports native integrations with Splunk, Elastic Security, CrowdStrike Falcon LogScale, and Datadog. You can also use universal formats like Syslog and CEF. Detection events include full context: threat score, attack signatures, IP metadata, and user agent analysis.
Ready to automate bot blocking?
Configure threat scoring rules that integrate with Cloudflare, AWS WAF, and your SIEM.
Get Started Free