What WebDecoy does

WebDecoy turns bot traffic into three things an operator can use: a detection with evidence, an actor that persists across IP rotation, and a response you control.

Start free → · Follow the 5-minute quickstart · Choose an install method

What is WebDecoy?

WebDecoy is a deception-based threat detection platform that helps you identify and respond to malicious actors targeting your web applications. Unlike traditional security tools that try to block known threats, WebDecoy uses honeypots and decoy resources to detect attackers through their behavior.

The Deception Approach

When attackers probe your systems, they don’t know which resources are real and which are traps. WebDecoy creates convincing decoy links, fake API endpoints, and hidden honeypot elements that legitimate users never interact with. When someone does interact with these decoys, you know immediately that they’re either:

• Automated bots scanning your site
• Malicious actors looking for vulnerabilities
• Scrapers stealing your content
• Reconnaissance tools mapping your infrastructure

Key Capabilities

Feature	Description
Decoy Links	Hidden honeypot links that detect scanners and crawlers
API Honeypots	Fake API endpoints that catch attackers probing for vulnerabilities
Detection Scripts	JavaScript-based detection of automated browsers and bots
Edge Sensor	A Cloudflare Worker that sees the crawlers which never run JavaScript
Threat Intelligence	IP reputation, geolocation, and abuse history for every detection
MITRE ATT&CK Mapping	Industry-standard threat classification for detected behaviors
Automated Response	Integration with Cloudflare, AWS WAF, and other services for automatic blocking

---

How WebDecoy Protects Your Applications

WebDecoy provides multiple layers of detection that work together to identify threats:

Detection Layers

┌─────────────────────────────────────────────────────────────┐
│                    Your Web Application                      │
├─────────────────────────────────────────────────────────────┤
│  Layer 1: Decoy Links                                        │
│  Hidden links that only automated tools discover             │
├─────────────────────────────────────────────────────────────┤
│  Layer 2: API Honeypots                                      │
│  Fake endpoints that catch vulnerability scanners            │
├─────────────────────────────────────────────────────────────┤
│  Layer 3: Detection Script (JavaScript)                           │
│  Client-side detection of headless browsers and automation   │
├─────────────────────────────────────────────────────────────┤
│  Layer 4: Form Honeypots                                     │
│  Invisible form fields that catch spam bots                  │
└─────────────────────────────────────────────────────────────┘

Detection Flow

1. Visitor arrives at your website or application
2. Detection Script (if enabled) analyzes the browser for automation signatures
3. Decoy interactions are monitored for any access to honeypot resources
4. Detection is created when suspicious activity is detected
5. Threat scoring calculates a unified risk score (0-100)
6. MITRE mapping classifies the behavior using industry standards
7. Actor correlation ties detections to a persistent actor that survives IP rotation
8. Response actions can automatically block the actor or IP at your WAF

What Gets Detected

WebDecoy catches a wide range of malicious activities:

• Web Scrapers - Tools that steal your content
• Vulnerability Scanners - Tools probing for security weaknesses
• Credential Stuffers - Automated login attempts with stolen passwords
• API Abusers - Bots exploiting your API endpoints
• Reconnaissance - Attackers mapping your infrastructure
• AI Crawlers - Unauthorized AI training data collection

---

Your First Run

The first thing a new customer sees on the dashboard is a checklist, Get started with Web Decoy, with a 2/4 complete style progress count. It stays at the top of the page until every required step is done, and then it disappears on its own. There is no dismiss button, because the steps are the shortest path to a working install rather than a tour.

The steps, in order:

Step	What it is
Create your organization	Your workspace. Done for you when you sign up
Install the detection script	Paste one line into your site, just before </head>
See your first detection	Fire a test hit at your decoy and watch it land
Decide what happens next	Choose what WebDecoy does about what it caught
Add a custom domain (optional)	Only if you want decoys under your own brand

The install step contains the line itself, with a Copy button, rather than sending you off to find it. Under it, the checklist names the site it is installing on: “It reports as soon as a page with this line loads.”

The detection step does not require you to wait for a real bot. It has a Send a test detection button that fires a real request at your decoy, with no setup needed, and then links you straight to what landed.

The last required step is enforcement, and it deliberately comes after your first detection rather than during setup. You decide what happens to traffic once you have seen what WebDecoy actually catches on your site, not before. It is complete once you have made any enforcement change at all: scoping a route, setting a mode, or registering a credential. Choosing to stay in monitor mode counts.

---

What the Dashboard Shows You

Once onboarding is complete, the dashboard is organised around four questions rather than around chart types:

1. Where detections came from. A world map leads the page, coloured on a severity ramp (Critical 80+, High 60-79, Medium 40-59, Low 20-39, Minimal 0-19) rather than an arbitrary palette, so intensity reads as severity.
2. Am I protected right now? Protection status shows sensor coverage across every site (“3 of 4 sites reporting”) and, under Coverage gaps, names the specific problem and links to the fix: a site with no sensor, a sensor that has stopped reporting, an edge validator that is not responding.
3. Who is after me, and what needs my decision? Decisions waiting is the queue of clients caught by your decoys and tripwires, each with Deny clearance or Dismiss. Adversaries lists identities that persist across IP rotation, ordered by what needs a decision rather than by threat score. Actors that went looking for credentials sort to the top, because that finding cannot be confounded by a shared address.
4. What did it do about them? Enforcement outcomes charts what your edge validator actually did over the last 14 days: cleared, denied, refused at mint, and (in monitor mode) what it would have done.

The six volume charts that used to sit on the dashboard now live on their own page, Analytics, in the sidebar under Threats at /detections/analytics: the geographic map, Detection Signals, AI Scraper Detections, Detections over time, Signal Radar, and Threat Category Trends.

---

Key Terminology

Understanding these terms will help you use WebDecoy effectively:

Core Concepts

Term	Definition
Organization	Your account container. All resources (domains, decoys, detections) belong to an organization. Organizations are also the billing unit.
Property	A logical grouping within your organization. Use properties to separate different websites, applications, or environments (e.g., “Production Website”, “Staging API”).
Decoy	A honeypot resource that legitimate users never access. Can be a link, API endpoint, or form field.
Detection	A recorded event when someone interacts with a decoy or triggers bot detection. Contains full details about the request and threat assessment.
Sensor	Anything reporting traffic to WebDecoy for a site: an edge worker, the WordPress plugin, an SDK, a detection script, a decoy link, or a tripwire. The Sensors page lists them per site with when each was last seen.

Detection Terms

Term	Definition
Threat Score	A unified risk score from 0-100 that combines multiple signals into a single assessment. Higher scores indicate greater risk.
Bot Score	A 0-100 score specifically measuring the likelihood that a visitor is automated (bot) vs. human.
MITRE ATT&CK Tactic	A standardized classification of attacker behavior from the MITRE ATT&CK framework (e.g., “Reconnaissance”, “Initial Access”).
Confidence Level	How certain WebDecoy is about a detection (High, Medium, Low).

Resource Types

Term	Definition
Decoy Link	A hidden honeypot URL on your website that legitimate users cannot see or access.
Endpoint Decoy	A fake API endpoint (supports POST, PUT, DELETE) that captures attack attempts.
Detection Script	A JavaScript snippet that runs in visitors’ browsers to detect automation.
Shared Domain	The default WebDecoy-managed domain (*.d.webdecoy.com) that hosts decoys without any DNS setup. Every new org gets a working example decoy here automatically.
Custom Domain	Your own domain configured to serve decoy content via WebDecoy. Optional: used when you want decoys under your own brand.

Threat Categories

Term	Definition
Bot	Automated software visiting your site (may be good or bad).
Attacker	Someone actively attempting to exploit vulnerabilities.
Scanner	Automated tools probing for security weaknesses.
Crawler	Bots indexing content (search engines are good crawlers).
Scraper	Tools copying your content without permission.

---

Platform Architecture Overview

WebDecoy consists of three main components that work together:

System Components

┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
│                  │     │                  │     │                  │
│    Dashboard     │────▶│    Backend API   │────▶│  Ingest Service  │
│    (Frontend)    │     │                  │     │                  │
│                  │     │                  │     │                  │
└──────────────────┘     └──────────────────┘     └──────────────────┘
        │                         │                        │
        │                         │                        │
        ▼                         ▼                        ▼
   You manage:              Stores:                  Handles:
   - Decoys                 - Organizations          - Decoy requests
   - Domains                - Properties             - Bot detections
   - Integrations           - Detections             - SSL certificates
   - Settings               - Subscriptions          - Custom domains

Dashboard (Frontend)

The web-based interface where you:

• View and analyze detections
• Create and manage decoys
• Configure detection scripts
• Set up integrations
• Manage billing and settings

Backend API

The central service that:

• Stores all your data securely
• Manages authentication via Auth0
• Processes subscription billing via Stripe
• Coordinates integrations with third-party services

Ingest Service

The detection engine that:

• Receives decoy interactions in real-time
• Enriches detections with threat intelligence
• Calculates threat and bot scores
• Triggers automated response actions
• Manages SSL certificates for custom domains

Data Flow Example

Here’s what happens when an attacker triggers a decoy:

1. Attacker visits your decoy URL (e.g., https://abc12345.d.webdecoy.com/admin-backup.zip on the shared domain, or https://yourdomain.com/admin-backup.zip if you’ve added a custom domain)
2. Ingest service receives the request and routes it to the right decoy
3. Threat enrichment adds IP reputation, geolocation, and fingerprinting
4. Scoring engine calculates unified threat score
5. MITRE mapping classifies the behavior (e.g., “Reconnaissance”)
6. Detection created and stored in the database
7. Integrations triggered (e.g., Cloudflare blocks the IP)
8. Dashboard updated with the new detection for your review

---

Email You’ll Receive

WebDecoy sends very little email. Account email is transactional: a welcome message, team invitations, and time-sensitive plan notices.

The one recurring email is a weekly digest, “Your decoys caught N things this week”, which goes to organization owners and admins. It summarises the week’s detections, names the most persistent adversary, and says what enforcement refused (or, in monitor mode, what it would have refused). A week with no detections sends nothing at all. The digest is off by default and is being enabled gradually, so you may not have seen one yet.

Every digest carries an unsubscribe link, and mail clients with a native unsubscribe button work too. Unsubscribing is per person and covers every organization you belong to. It stops only the digest: plan notices and invitations still reach you, because those do not repeat. There is no in-app email preferences screen yet, so to start receiving it again after unsubscribing, reply to any WebDecoy email.

---

Next Steps

Now that you understand what WebDecoy does, let’s get you set up:

• Account Setup and Login - Create your account and log in
• Setting Up Your Organization - Configure your first organization
• Detection Scripts - Install the line from the checklist’s install step
• Cloudflare Edge Sensor - See the crawlers a page tag cannot