Connect a project and WebDecoy reads your Vercel log drain. No code changes. It identifies crawler traffic per request, verifies real crawlers against published IP ranges, and flags forged user agents. Monitoring only: it never blocks, never reports humans.

FCaptcha is a self-hosted, MIT-licensed CAPTCHA with no puzzle. One click or fully invisible. It catches headless browsers, Puppeteer, Playwright, Selenium, and the new wave of AI agents driving real browsers (vision click bots, computer-use agents). Verifies Web Bot Auth signed crawlers so polite agents get through. Drop-in for Turnstile, reCAPTCHA and hCaptcha: same siteverify contract. No cookies, no third-party data. WCAG 2.2 AA, false-positive budget enforced in CI. Go, Node or Python.