Install WebDecoy on Ecwid

Ecwid has no WebDecoy app. You install the same browser detection script that works on any website. Where it goes depends on how your store is published:

• Ecwid Instant Site (the website Ecwid hosts for you): use Instant Site’s custom code settings, below.
• An Ecwid store embedded in another site (WordPress, Wix, Squarespace or your own HTML): install the script on that site, because that site serves the pages. Follow its guide: WordPress, Wix, Squarespace or any other website. One tag in the host site’s shared layout covers the pages your store widget appears on.

Before you begin

• An Ecwid plan that allows custom code. Ecwid lists custom code on Instant Site under “Plan availability: Venture, Business, Unlimited” (Ecwid: Adding custom code to Instant Site). It is not on the free plan.
• A WebDecoy account with this site added. Create a free account and add the site using the address your shoppers visit: your own domain if you connected one, otherwise the Instant Site address Ecwid gave you.

1. Copy your site’s line from WebDecoy

In the WebDecoy dashboard setup checklist, open Install the detection script and choose Copy. If the checklist is closed, open Detection Scripts for the selected site and choose Copy snippet. The line looks like this, with your own IDs:

<script
  async
  src="https://cdn.webdecoy.com/bot-detection/v1/bot-detection.min.js"
  data-aid="your-property-uuid"
  data-sid="your-scanner-uuid">
</script>

Always paste the copied line. data-aid is the site (property) ID and data-sid is the detection script ID; a hand-built line with the wrong ID can load fine and file its reports somewhere you are not looking.

2. Add it to Instant Site

Ecwid offers two site-wide places for code: the body and the header. It recommends the body for scripts: “implementing JavaScript to the site body is recommended as it’s better in terms of page speed”.

1. In your Ecwid admin, go to Website (or Overview, then Manage Instant Site).
2. Scroll to Advanced website settings and choose Add Code under Custom JavaScript code.
3. Paste the WebDecoy line. The field accepts up to 4000 characters, and Ecwid places its contents at the bottom of the page body.
4. Save, then refresh a page of your Instant Site.

Not confirmed: full tag or bare JavaScript

Ecwid’s article does not say whether Custom JavaScript code expects a full <script> tag or JavaScript without one. Paste the full line as copied. If the tag does not appear in the page source after you save, use the header field instead: under SEO settings, choose Add Code under Header meta tags and site verification, paste the same line and save.

3. Add a hidden decoy link (optional)

A decoy link is a URL that people never see and link-following crawlers do. When a client requests it, WebDecoy’s decoy server records the hit, whether or not that client runs JavaScript.

1. In WebDecoy, open Decoys, choose Create Decoy, keep Honeypot Link and the shared domain, and set the action to Log while you test.
2. From the decoy’s menu, choose Copy URL.
3. In Ecwid, go to Website, then Edit Site, choose Add Section, and under Advanced Solutions, in Embed & Custom Code, choose Add Custom Code Section. Ecwid documents this section as accepting HTML, CSS or JavaScript.
4. Paste this line, using your decoy URL, move the section to the bottom of the page, and choose Publish:

<a href="https://abc12345.d.webdecoy.com/admin/backup.zip" style="display:none" aria-hidden="true" tabindex="-1" rel="nofollow">Admin</a>

A custom code section belongs to one page, so add it to your homepage at least. Ecwid notes that custom code sections are “not supported on the legacy version of Instant Site”. On an embedded store, put the link in the host site’s footer instead.

To prove the decoy works, open its URL once yourself and find the record in Detections, as described in Decoy links. That is your own setup check, not an attack.

4. Verify the install

1. Open a page of your store in a browser. In developer tools, open Network, reload, and find bot-detection.min.js. It must return 200.
2. In the WebDecoy dashboard setup checklist, enter the page address in the install verifier and choose Check my page. WebDecoy fetches the page’s HTML from outside your browser and tells you whether this site’s tag is there. If Instant Site adds the code after the page loads, the check may not find it even though the script runs; Sensors (next step) is the deciding check.
3. Open Sensors. After a page loads in a browser, the Detection Script row moves to Running, nothing automated seen or Reporting.

A browser script does not run for curl, so the WebDecoy-Test/1.0 user agent cannot prove this install. To prove the detection pipeline end to end, use Send a test detection on the dashboard. See Verify your installation for what each status means.

What this covers, and what it does not

• Covered: shoppers and clients whose browsers run JavaScript on your store pages, including headless browsers, browser automation, AI browser agents and AI browser extensions, plus LLM referrals.
• Not covered by the script: crawlers that fetch HTML without running JavaScript, such as Googlebot’s crawl pass, GPTBot, ClaudeBot, CCBot and curl. They only show up if they follow the hidden decoy link. To see every request you need an edge sensor such as the Cloudflare edge sensor, which requires your domain’s traffic to pass through Cloudflare. Check Ecwid’s own domain documentation before proxying an Instant Site domain.
• No order review. WebDecoy has no Ecwid app, so it cannot read, tag or flag orders, and it does not block checkout. Detections appear in the WebDecoy dashboard only.
• No blocking from the script. The browser script detects and reports; it does not refuse requests. See Response actions for what you can do with detections.

Read Detection coverage for the full comparison.

Remove

In Ecwid, go to Website, delete the WebDecoy code from Custom JavaScript code (or the header field), remove any decoy section, and save. Reporting stops on the next page load.