WebDecoy
Catch AI scrapers and bots with deception, not friction
Start new thread

WebDecoy for WordPress - Free WordPress and WooCommerce bot protection, no CAPTCHA

by
•
WebDecoy stops WooCommerce card testing, fake registrations, comment spam, login brute force and AI scrapers without showing humans a single CAPTCHA. Runs 100% locally: no account, no API key, no external calls. Deception does the heavy lifting: hidden tripwires, honeytoken links, a decoy coupon code, and fake .env and wp-config responses seeded with canary credentials only bots ever touch. Plus invisible proof-of-work on forms and good-bot verification. Monitor mode by default. Free forever.

Add a comment

Replies

Best
Hunter
📌
Hi Product Hunt! Chris here, founder of WebDecoy. Most WordPress security plugins guess. They look at a User-Agent or a score and decide whether a visitor is a bot. Guess wrong one way and you block a customer. Guess wrong the other way and a card-testing bot runs a thousand stolen numbers through your WooCommerce checkout while you pay the gateway fee for every attempt. WebDecoy for WordPress takes a different approach: it sets traps that no real visitor can trigger. - Tripwires on hidden honeypot paths that only crawlers and scanners request. - Honeytoken links injected invisibly into your pages. Following one is proof of a bot. - Fake .env, wp-config, SQL dump and phpinfo responses seeded with per-site canary credentials. Anyone who uses those credentials is flagged as critical. - A hidden WooCommerce decoy coupon. Applying it at checkout is a certainty, not a score. On top of that: velocity limits and card-testing pattern detection on checkout (classic and Blocks), invisible SHA-256 proof-of-work on comment, login and registration forms so humans never see a challenge, reverse-DNS verification for Googlebot and friends, AI crawler detection, and rate limiting with IP and CIDR blocking. A few things that matter to us: - Works the moment you activate it. No account, no API key, nothing leaves your server unless you opt in to WebDecoy Cloud. - Monitor mode is the default, so you can watch what it would have done before you let it act. - The free tier is the full detection engine, not a teaser. Paid cloud features are optional. It is GPL and on wordpress.org. If you run a WooCommerce store that has ever seen a wave of $1 declined orders at 3 AM, this is for you. Tell us what it catches.