Bot detection for Next.js
A middleware wrapper that runs before your routes. Tripwires and rate limits are evaluated locally at the edge, so a blocked request never reaches your handler and never costs you a function invocation downstream.
Install
npm install @webdecoy/nextjsQuick start
The whole integration. Local rules run in your process, so a blocked request never leaves your infrastructure.
// middleware.ts
import { withWebDecoy } from '@webdecoy/nextjs';
import { rateLimit } from '@webdecoy/node';
export default withWebDecoy({
rules: [rateLimit({ max: 100, window: 60 })],
skipPaths: ['/_next', '/favicon.ico'],
});
export const config = {
matcher: ['/api/:path*', '/protected/:path*'],
};Monitor before you enforce. Detection defaults to monitor mode, so nothing is turned away until you opt in. Watch what the rules would have done against your real traffic first, then switch to enforce. Installing a blocking rule blind is how a bot filter takes down a site on day one.
What it catches
Tripwires detect intent rather than appearance, so a stealthier browser does not help the scraper.
- Scrapers that follow a hidden honeytoken link into a path no human can reach
- Scanner bait requests: /.env, /.git/config, /wp-config.php
- Request floods, per-IP, before they hit your route handlers
- AI crawlers that ignore robots.txt but still walk your links
Questions
Does this work in the Edge runtime?
Yes. The middleware wrapper is designed for Next.js middleware, which runs in the Edge runtime. Local rules such as tripwires and rate limiting evaluate in-process with no outbound call, so they add no network latency to the request path.
Do I need an API key to use it?
No. Tripwires and rate limiting are local rules that run entirely inside your own deployment, with no account and no outbound request. An API key is only needed for the cloud features, such as IP reputation lookups and the shared actor identity that follows a bot across IP addresses.
Will it block Googlebot?
Not through a tripwire. Googlebot does not follow hidden, rel=nofollow links, which is the whole basis of the detection. If you add rate limiting, use skipPaths or a higher limit for paths you expect crawlers to walk.
Other runtimes
For the full picture, including the browser client and the server-side detection loop, see the SDK overview. Full API reference lives in the Next.js documentation Opens in a new tab .
Add bot detection to your Next.js app
Start with the local rules, no account required. Add cloud features when you need actor identity that survives IP rotation.
Contact Sales