Connect a project and WebDecoy reads your Vercel log drain. No code changes. It identifies crawler traffic per request, verifies real crawlers against published IP ranges, and flags forged user agents. Monitoring only: it never blocks, never reports humans.

GPTBot, ClaudeBot and Googlebot's crawl pass never run JavaScript, so page tags miss them. One click deploys a Worker to your zone that sees them at the edge, flags browsers that lie about being Chrome, and stops denied clients before your origin. Works on the Free plan. One click to remove.

A Netlify extension that watches automated traffic at the edge: AI crawlers, CLI tools, scrapers. It verifies real crawlers with reverse DNS and Web Bot Auth, then protects paths like /account/* with signed clearance. Opt-in, monitor first, fails open.

WebDecoy stops WooCommerce card testing, fake registrations, comment spam, login brute force and AI scrapers without showing humans a single CAPTCHA. Runs 100% locally: no account, no API key, no external calls. Deception does the heavy lifting: hidden tripwires, honeytoken links, a decoy coupon code, and fake .env and wp-config responses seeded with canary credentials only bots ever touch. Plus invisible proof-of-work on forms and good-bot verification. Monitor mode by default. Free forever.

FCaptcha is a self-hosted, MIT-licensed CAPTCHA with no puzzle. One click or fully invisible. It catches headless browsers, Puppeteer, Playwright, Selenium, and the new wave of AI agents driving real browsers (vision click bots, computer-use agents). Verifies Web Bot Auth signed crawlers so polite agents get through. Drop-in for Turnstile, reCAPTCHA and hCaptcha: same siteverify contract. No cookies, no third-party data. WCAG 2.2 AA, false-positive budget enforced in CI. Go, Node or Python.

WebDecoy: Multi-Layer Bot Detection & Response Single-layer detection is broken. WebDecoy combines multiple layers so bypassing one triggers another. Client-side fingerprinting catches headless browsers. Server-side SDKs verify tokens and analyze TLS fingerprints. Honeypot traps catch what bots touch and humans don't. Every request gets scored. You decide: log, block, challenge, or redirect with integrations for WAFs, SIEMs, and webhooks. Try it now.