Connect a project and WebDecoy reads your Vercel log drain. No code changes. It identifies crawler traffic per request, verifies real crawlers against published IP ranges, and flags forged user agents. Monitoring only: it never blocks, never reports humans.
FCaptcha is a self-hosted, MIT-licensed CAPTCHA with no puzzle. One click or fully invisible. It catches headless browsers, Puppeteer, Playwright, Selenium, and the new wave of AI agents driving real browsers (vision click bots, computer-use agents). Verifies Web Bot Auth signed crawlers so polite agents get through. Drop-in for Turnstile, reCAPTCHA and hCaptcha: same siteverify contract. No cookies, no third-party data. WCAG 2.2 AA, false-positive budget enforced in CI. Go, Node or Python.
WebDecoy: Multi-Layer Bot Detection & Response
Single-layer detection is broken. WebDecoy combines multiple layers so bypassing one triggers another.
Client-side fingerprinting catches headless browsers. Server-side SDKs verify tokens and analyze TLS fingerprints. Honeypot traps catch what bots touch and humans don't.
Every request gets scored. You decide: log, block, challenge, or redirect with integrations for WAFs, SIEMs, and webhooks.
Try it now.
WebDecoyCatch AI scrapers and bots with deception, not friction
WebDecoy