Vercel integration
WebDecoy’s Vercel integration sets up a log drain for the projects you connect. Vercel then sends WebDecoy the requests your site answered, and you change nothing: no package to install, no middleware to add, no redeploy.
It sees what a script tag cannot. Crawlers that never run JavaScript, requests served straight from the cache, and requests that never invoke a function at all.
Monitoring only. WebDecoy never blocks, redirects or challenges a request. When you decide to act, the policy runs at your own edge, under your control.
Install
Section titled “Install”- Install the WebDecoy integration from its Vercel listing. Choose the team, and either all projects or specific ones.
- Vercel sends you back to WebDecoy. If you do not have an account yet, it walks you through creating one and picks the install back up where you left off.
- Choose which WebDecoy site each project is, and press Connect.
That is the whole install. WebDecoy provisions the drain, and the next request your site answers is reported.
What WebDecoy can reach
Section titled “What WebDecoy can reach”Three permissions, and nothing else:
| Permission | Why |
|---|---|
| Projects, read | To list the projects you choose between |
| Project environment variables, read and write | To remove the three variables older installs wrote |
| Drains, read and write | To create its own drain and delete it when you disconnect |
It cannot read your source, your deployments, your domains or your logs beyond the drain it created.
The environment variables it used to write
Section titled “The environment variables it used to write”Connecting used to set three variables on the project: WEBDECOY_SITE_KEY,
WEBDECOY_SCANNER_ID and WEBDECOY_SENSOR_KEY. It no longer does.
They came from an earlier plan, where the SDK would take its identity from the
environment. The drain replaced that plan and the SDK was never wired to read
them, so the writes were putting a real secret into your project for nothing.
@webdecoy/nextjs takes an apiKey you pass it, usually from
WEBDECOY_API_KEY, and has never looked at these three.
If your project was connected before this changed, the variables are still there. Disconnecting the project removes them, or you can delete them yourself from your Vercel project settings. They do nothing either way.
The permission to write project environment variables is still requested, because removing the ones already written needs it.
What is reported, and what is not
Section titled “What is reported, and what is not”Reported: requests whose user agent names a known crawler or tool, requests with no user agent at all, and requests for crawler-only paths such as /robots.txt, sitemaps, ads.txt and security.txt.
Also reported: page requests from a browser user agent whose visit never rendered the page. A real browser fetches your /_next/static/ scripts and styles (or ?_rsc= payloads) within seconds of the page. A scraper that copies a browser’s user agent takes the HTML and leaves. These rows carry the browser_ua_never_rendered signal, and browser_ua_fetched_crawler_files if the same visit also read robots.txt or a sitemap. See how they are scored.
Never reported: ordinary human visitors. A drain carries every request your site answers, including your customers browsing it, and WebDecoy does not store those. A visit that rendered your page is dropped the same way it always was.
The drain also counts AI referrals: visits whose referrer is an AI product, and, kept apart as an estimate, likely referrals that arrived with no referrer just after an assistant fetched the same page. Only counts are kept.
Query strings are dropped before anything is stored. The path is what identifies what was asked for.
Limited coverage to know about
Section titled “Limited coverage to know about”Vercel has a team-wide setting under Settings → Security & Privacy → IP Address Visibility. With it off, drains arrive with the client IP removed. WebDecoy cannot attribute those to an actor, so it counts them and says coverage is limited rather than showing you a quiet site.
Sampling rules on the drain also apply. If you sample at 10%, WebDecoy sees 10%.
What it costs
Section titled “What it costs”Drain delivery is billed by Vercel as part of your plan’s usage. WebDecoy asks for logs only, never traces, analytics, speed insights or audit logs.
Removing it
Section titled “Removing it”Disconnect a project in WebDecoy and it narrows the drain to the projects that remain, and deletes exactly the three variables it created, by the ids Vercel gave them. A variable of the same name you set yourself is left alone.
Disconnect the integration and it deletes the drain, removes the variables, and uninstalls itself from your Vercel account.