WebDecoy

Catch AI scrapers and bots with deception, not friction

29 followers

Catch AI scrapers and bots with deception, not friction

29 followers

Visit website

Website analytics

•

Authentication & identity tools

•

Observability tools

WebDecoy is deception-based bot detection for the AI crawler era. Honeypot decoys catch what bots touch and humans never see. An edge sensor on Cloudflare catches crawlers that never run JavaScript. Behavioral and TLS fingerprinting gives every visitor one persistent actor identity across IPs. Verified crawlers (Web Bot Auth) get through, impersonators get flagged. You approve enforcement. SDKs for Node, PHP, WordPress, Shopify. Open source FCaptcha included.

This is the 5th launch from WebDecoy. View more

WebDecoy for Cloudflare

Launching today

See the AI crawlers your JavaScript tag never will

GPTBot, ClaudeBot and Googlebot's crawl pass never run JavaScript, so page tags miss them. One click deploys a Worker to your zone that sees them at the edge, flags browsers that lie about being Chrome, and stops denied clients before your origin. Works on the Free plan. One click to remove.

Launch tags:Developer Tools•Artificial Intelligence•Security

Launch Team

WebDecoy

Hunter

📌

Hi PH, Chris here, maker of WebDecoy. Here is the problem that pushed us to the edge: GPTBot, ClaudeBot, CCBot and PerplexityBot never execute JavaScript. Neither does Googlebot's crawl pass, or curl. Any bot tool that lives in a page tag is running in the one place these clients never visit. So the sensor is now a button. Open Integrations, pick a Cloudflare zone, click deploy. We upload a Worker, bind the route, and add negating routes so it stays off your static assets. No wrangler, no YAML, and one click removes it again. My favorite check is one that cannot exist in JavaScript at all: Chrome always sends sec-ch-ua on a navigation, so a request claiming to be Chrome without it is lying. The impersonator never runs a tag, so the edge is the only place to catch it. Things we were careful about: detection never blocks or changes a response, the beacon runs off the response path so it cannot slow your site, and the installer refuses to take a route from a Worker you already run. It works on the Cloudflare Free plan because we do not depend on the paid bot score. Enforcement is opt-in: you review pending denies with the evidence attached before anything is stopped. What would you want to see before you let a button deploy code to your zone?

Report