Bot detection for Express
Standard Express middleware. Register it once and every downstream route is covered; a tripwire hit returns 403 before your handler runs, with no extra code in the handler itself.
Install
npm install @webdecoy/expressQuick start
The whole integration. Local rules run in your process, so a blocked request never leaves your infrastructure.
import express from 'express';
import { webdecoy } from '@webdecoy/express';
import { tripwire, rateLimit } from '@webdecoy/node';
const app = express();
app.use(
webdecoy({
// No apiKey means purely local rules.
rules: [
tripwire({ paths: ['/.env', '/wp-config.php'] }),
rateLimit({ max: 100, window: 60 }),
],
skipPaths: ['/health', '/public'],
})
);Monitor before you enforce. Detection defaults to monitor mode, so nothing is turned away until you opt in. Watch what the rules would have done against your real traffic first, then switch to enforce. Installing a blocking rule blind is how a bot filter takes down a site on day one.
What it catches
Tripwires detect intent rather than appearance, so a stealthier browser does not help the scraper.
- Vulnerability scanners probing /.env and /wp-config.php
- Link-following scrapers that walk into a honeytoken path
- Credential-stuffing bursts against login routes
- Anything requesting a path a real browser session never surfaces
Questions
Where should the middleware go in the stack?
Register it before your routes, so a blocked request is rejected before any handler or database call runs. Put it after any body parser you need it to see, and use skipPaths for health checks and static assets.
What does a blocked request receive?
A 403. The middleware enforces local rules itself, so you do not need to check a result object in every handler, though the detection is available on the request if you want to log or branch on it.
Is it safe to install on production traffic?
Detection starts in monitor mode. Nothing is blocked until you set mode to enforce, so you can watch what a rule would have done against real traffic before it can turn anyone away.
Other runtimes
For the full picture, including the browser client and the server-side detection loop, see the SDK overview. Full API reference lives in the Express documentation Opens in a new tab .
Add bot detection to your Express app
Start with the local rules, no account required. Add cloud features when you need actor identity that survives IP rotation.
Contact Sales