Detection Coverage

Every WebDecoy install method places a sensor somewhere. Where that sensor sits determines what it is physically able to observe. This page states the limits plainly so you can choose an install that sees what you care about.

The single most important distinction:

JavaScript sensors cannot see clients that don’t run JavaScript

Detection scripts run inside the visitor’s browser. A crawler that fetches your HTML over plain HTTP and never executes JavaScript is invisible to them — not partially detected, not low-confidence. Invisible.

That includes Googlebot’s crawl pass, GPTBot, ClaudeBot, CCBot, PerplexityBot, curl, and every HTTP library.

Coverage by install method

	Detection Script	WordPress	Node SDK	Shopify	Edge / Worker
Where the sensor runs	Browser	Your PHP server	Your Node server	Shopify pixel + /api/detect	CDN edge
Requires JavaScript	Yes	No	No	Partly	No
Search crawlers (Googlebot, Bingbot)	✗	✓	✓	✗	✓
AI crawlers (GPTBot, ClaudeBot, CCBot)	✗	✓	✓	✗	✓
HTTP tooling (curl, requests, Scrapy)	✗	✓	✓	✗	✓
UA impersonators	✗	✓	✓	✗	✓
Headless browsers (Puppeteer, Playwright)	✓	Partial	Partial	✓	Partial
AI browser agents (Computer Use, Stagehand)	✓	✗	✗	✓	✗
AI browser extensions	✓	✗	✗	✓	✗
Behavioral signals (mouse, scroll, timing)	✓	✗	✗	✓	✗
LLM referrals	✓	✓	✓	✓	✓
Decoy links / honeypot endpoints	n/a	✓	✓	n/a	✓

Partial means the method catches the case only when it produces a distinguishing HTTP signal — a headless browser with a default user agent is caught server-side; one configured to look like Chrome is not.

Why Googlebot is invisible to a detection script

Googlebot crawls in two passes:

1. Crawl — a plain HTTP fetch of your HTML. No DOM, no navigator, no script execution. This is the overwhelming majority of Googlebot’s requests to your site.
2. Render — a separate, queued pass in a headless browser. It is deferred, heavily cached, and runs on a fraction of crawled URLs.

A detection script can only ever fire during the render pass, if it happens at all. The crawl pass — the one that actually indexes you — never runs your JavaScript.

Other AI crawlers skip rendering entirely. GPTBot, ClaudeBot, CCBot and PerplexityBot fetch HTML and leave.

What this means for the Citation Monitor

The Citation Monitor reports which AI crawlers visited which pages. It reads from your detections.

On a JavaScript-only install it will be empty, or will show only AI browser extensions and LLM referral traffic. That is not a sign that AI crawlers are ignoring your site — it means your sensor cannot see them.

To populate the Citation Monitor you need a server-side sensor on the property.

Choosing an install

• WordPress site → install the WordPress plugin. It sees raw requests server-side and covers crawlers.
• Node / Next.js / Express / Fastify → install the Node SDK or the framework middleware.
• Static site, or an origin you can’t add middleware to → an edge sensor is the only option that sees raw requests.
• Any of the above, plus you want behavioral and AI-agent detection → add a detection script as well. The two are complements, and most sites should run both.

Verifying what a UA claims

A server-side sensor sees the real client IP alongside the claimed user agent, which makes verification possible:

• Reverse DNS — a request claiming Googlebot should resolve to googlebot.com or google.com
• Published IP ranges — Google, OpenAI and others publish their crawler ranges; WebDecoy fetches and matches against them
• Web Bot Auth signatures — cryptographic proof of identity, stronger than either

A client-side script cannot perform any of these checks against an impersonator, because an impersonator does not run the script. See Verified Agents.