WebDecoy

Catch AI scrapers and bots with deception, not friction

3 followers

Catch AI scrapers and bots with deception, not friction

3 followers

Visit website

Website analytics

•

Authentication & identity tools

•

Observability tools

WebDecoy is deception-based bot detection for the AI crawler era. Honeypot decoys catch what bots touch and humans never see. An edge sensor on Cloudflare catches crawlers that never run JavaScript. Behavioral and TLS fingerprinting gives every visitor one persistent actor identity across IPs. Verified crawlers (Web Bot Auth) get through, impersonators get flagged. You approve enforcement. SDKs for Node, PHP, WordPress, Shopify. Open source FCaptcha included.

This is the 2nd launch from WebDecoy. View more

FCaptcha

Launched this week

Open source invisible CAPTCHA that catches AI agents

FCaptcha is a self-hosted, MIT-licensed CAPTCHA with no puzzle. One click or fully invisible. It catches headless browsers, Puppeteer, Playwright, Selenium, and the new wave of AI agents driving real browsers (vision click bots, computer-use agents). Verifies Web Bot Auth signed crawlers so polite agents get through. Drop-in for Turnstile, reCAPTCHA and hCaptcha: same siteverify contract. No cookies, no third-party data. WCAG 2.2 AA, false-positive budget enforced in CI. Go, Node or Python.

Launch tags:Open Source•Developer Tools•Security

Launch Team

Hunter

📌

Hi Product Hunt! I'm Chris, founder of WebDecoy. We built FCaptcha because every CAPTCHA we tried had the same two problems. Real people got stuck clicking traffic lights, and AI agents driving a real Chrome window sailed straight through. Puzzles test vision. Vision models are now better at that than most humans. So FCaptcha does not ask a question. It watches how the browser was driven: pointer micro-tremor, velocity curves, typing cadence, coalesced input events, CDP attach signals, TLS fingerprints, and the tell-tale think-time gaps of an LLM deciding what to click next. Humans pass without noticing. Screenshot-and-click agents, computer-use agents and headless frameworks do not. A few things we are proud of: - Drop-in replacement. Same siteverify contract as Turnstile, reCAPTCHA and hCaptcha, so migrating is a base-URL change. - Accessible by design. No visual or audio puzzle to fail. WCAG 2.2 AA is verified in CI, and a benchmark of 14 human personas (screen reader, keyboard-only, tremor, elderly, touch) fails the build if false positives creep up. - Privacy first. Self-hosted, no cookies, no third-party data sharing, nothing written to disk. Every retention window is documented. - Polite agents welcome. Web Bot Auth (RFC 9421) signed requests are cryptographically verified and surfaced as their own category, so you can allow verified agents and block impersonators. - Runs anywhere. Go, Node or Python servers kept in lockstep, one docker run to start, Helm chart and Redis for multi-replica. It is MIT licensed and the scoring algorithm is fully open. Try the live demo, read the code, and tell us what gets past it. We want to know.

Report

8d ago

Previous WebDecoy Launches

WebDecoyThe bot detection layer your stack is missing.

Launched on December 22nd, 2025