WebDecoy
Catch AI scrapers and bots with deception, not friction
Start new thread

WebDecoy for Vercel - Know which crawlers hit your Vercel app, and which are fake

by
•
Connect a project and WebDecoy reads your Vercel log drain. No code changes. It identifies crawler traffic per request, verifies real crawlers against published IP ranges, and flags forged user agents. Monitoring only: it never blocks, never reports humans.

Add a comment

Replies

Best
Maker
📌
Hi PH, Chris here. WebDecoy is now on the Vercel Marketplace. Anyone can put "Googlebot" or "GPTBot" in a User-Agent header. WebDecoy checks each request against the crawler's published IP ranges and tells you which ones were real and which were forged. Setup is one click: connect a project and we configure a log drain. No code, no deploy. On Hobby, where drains are not available, one line of /next middleware does the same job. It is deliberately monitoring only. It never blocks or challenges a request, and human visitors are never reported. You get the answer to "who is actually crawling me?" with zero risk to production. Curious what you find. The share of forged crawler traffic tends to surprise people.
Vercel
Vercel Day
Which Vercel product did you use? What new capability did it give your team, and how did that shape the product you launched?
Maker
We built on Vercel Log Drains and the Vercel Marketplace (Native Integration). Log drains are what made the product possible on Vercel: they give us every request a project answered, including the user agent, path, status and client IP, without the customer changing a line of code or redeploying. That is the only way to see crawlers like GPTBot and Googlebot, which never run JavaScript and are invisible to a page tag. The Marketplace turned install into a single click: connect a project and we provision the drain and set the env vars. For Hobby teams without drains, the /next middleware runs on Vercel Functions instead. The result is a monitoring integration that reads what Vercel already knows, never blocks a request, and never reports a human visitor.