Install WebDecoy on Squarespace

Squarespace has no WebDecoy extension. You install the same browser detection script that works on any website, using Squarespace’s Code Injection, and you can add a hidden decoy link the same way.

Applies to

Squarespace websites and Squarespace Commerce stores on a plan that includes Code Injection.

Before you begin

• A plan with Code Injection. Squarespace says: “Code injection is available in the Core, Plus, Advanced, and some legacy billing plans” (Squarespace: Using code injection). It is not on the Basic plan. If your plan does not include it, upgrade first; a Code Block on a single page is not a substitute, because the script needs to be on every page.
• A WebDecoy account with this site added. Create a free account and add the site using the address your visitors use (for example https://www.example.com).

1. Copy your site’s line from WebDecoy

In the WebDecoy dashboard setup checklist, open Install the detection script and choose Copy. If the checklist is closed, open Detection Scripts for the selected site and choose Copy snippet. The line looks like this, with your own IDs:

<script
  async
  src="https://cdn.webdecoy.com/bot-detection/v1/bot-detection.min.js"
  data-aid="your-property-uuid"
  data-sid="your-scanner-uuid">
</script>

Always paste the copied line. data-aid is the site (property) ID and data-sid is the detection script ID; a hand-built line with the wrong ID can load fine and file its reports somewhere you are not looking.

2. Add it with Code Injection

1. Open the Code Injection panel. In current Squarespace menus it is under Settings, then Developer Tools, then Code Injection. If your menus differ, the Using code injection article links straight to the panel.
2. Paste the WebDecoy line into Header. Squarespace injects Header code “into the <head> tag on every page”.
3. Save.

Squarespace does not run custom code on checkout pages (“You can’t add custom code to checkout pages”), so the script does not observe checkout.

3. Add a hidden decoy link (optional)

A decoy link is a URL that people never see and link-following crawlers do. When a client requests it, WebDecoy’s decoy server records the hit, whether or not that client runs JavaScript.

1. In WebDecoy, open Decoys, choose Create Decoy, keep Honeypot Link and the shared domain, and set the action to Log while you test.
2. From the decoy’s menu, choose Copy URL.
3. In Squarespace’s Code Injection panel, paste this line into Footer, using your decoy URL, and save. Footer code is injected “before the closing </body> tag on every page”.

<a href="https://abc12345.d.webdecoy.com/admin/backup.zip" style="display:none" aria-hidden="true" tabindex="-1" rel="nofollow">Admin</a>

To prove the decoy works, open its URL once yourself and find the record in Detections, as described in Decoy links. That is your own setup check, not an attack.

4. Verify the install

1. Open a published page of your site in a browser (log out, or use a private window, so you see the public site). In developer tools, open Network, reload, and find bot-detection.min.js. It must return 200.
2. In the WebDecoy dashboard setup checklist, enter the page address in the install verifier and choose Check my page. WebDecoy fetches the page from outside your browser and tells you whether this site’s tag is there. If the site is still password protected, the check cannot see the page.
3. Open Sensors. After a page loads in a browser, the Detection Script row moves to Running, nothing automated seen or Reporting.

A browser script does not run for curl, so the WebDecoy-Test/1.0 user agent cannot prove this install. To prove the detection pipeline end to end, use Send a test detection on the dashboard. See Verify your installation for what each status means.

What this covers, and what it does not

• Covered: visitors whose browsers run JavaScript, including headless browsers, browser automation, AI browser agents and AI browser extensions, plus LLM referrals.
• Not covered by the script: crawlers that fetch HTML without running JavaScript, such as Googlebot’s crawl pass, GPTBot, ClaudeBot, CCBot and curl. They only show up if they follow the hidden decoy link. To see every request you need an edge sensor such as the Cloudflare edge sensor, which requires your domain’s traffic to pass through Cloudflare. Check Squarespace’s own domain documentation before proxying a Squarespace domain.
• No order review. WebDecoy has no Squarespace extension, so it cannot read, tag or flag Squarespace Commerce orders, and it does not see or block checkout. Detections appear in the WebDecoy dashboard only.
• No blocking from the script. The browser script detects and reports; it does not refuse requests. See Response actions for what you can do with detections.

Read Detection coverage for the full comparison.

Remove

Delete the WebDecoy lines from Header and Footer in Code Injection and save. Reporting stops on the next page load.