Bot detection for Fastify
A standard Fastify plugin registered with app.register(). It can also inject the hidden honeytoken link into your HTML responses for you, which removes the step almost everybody skips.
Install
npm install @webdecoy/fastifyQuick start
The whole integration. Local rules run in your process, so a blocked request never leaves your infrastructure.
import Fastify from 'fastify';
import webdecoyPlugin from '@webdecoy/fastify';
import { tripwire, rateLimit } from '@webdecoy/node';
const app = Fastify();
await app.register(webdecoyPlugin, {
rules: [
tripwire({ paths: ['/.env', '/wp-config.php'] }),
rateLimit({ max: 100, window: 60 }),
],
skipPaths: ['/health'],
// mode defaults to 'monitor'. Watch first, then:
// mode: 'enforce',
});Monitor before you enforce. Detection defaults to monitor mode, so nothing is turned away until you opt in. Watch what the rules would have done against your real traffic first, then switch to enforce. Installing a blocking rule blind is how a bot filter takes down a site on day one.
What it catches
Tripwires detect intent rather than appearance, so a stealthier browser does not help the scraper.
- Scrapers that follow the auto-injected honeytoken link
- Scanner bait paths, without you registering each one
- Request floods against expensive routes
- Automation walking paths that never appear in a real session
Questions
What is honeytoken injection?
The plugin can insert a hidden, rel=nofollow decoy link into buffered HTML responses and arm the tripwire that link points at. A real visitor never sees or follows it, so any request for that path is automated by construction. It is on by default when an API key is present.
Does it block by default?
Detection starts in monitor mode. Nothing is blocked until you set mode to enforce, so you can watch what a rule would have done against real traffic before it can turn anyone away.
Does it work with @fastify/view and template engines?
Yes, for buffered responses, which covers reply.send(html) and @fastify/view. Streamed HTML responses are passed through untouched rather than buffered in memory.
Other runtimes
For the full picture, including the browser client and the server-side detection loop, see the SDK overview. Full API reference lives in the Fastify documentation Opens in a new tab .
Add bot detection to your Fastify app
Start with the local rules, no account required. Add cloud features when you need actor identity that survives IP rotation.
Contact Sales