Install WebDecoy on Wix

Wix has no WebDecoy app. You install the same browser detection script that works on any website, using Wix’s Custom Code setting, and you can add a hidden decoy link the same way.

Applies to

Wix sites built with the Wix Editor, Wix Studio or Wix Harmony, including Wix Stores. Wix’s developer docs say custom code “can be used in all Wix editors” and is added from the site dashboard.

Before you begin

• A published site with a connected domain. Wix requires both before you can add custom code: “Make sure that your site is published and has a connected domain” (Wix: Embedding custom code on your site).
• A Premium plan. Connecting your own domain is a Premium feature, so in practice custom code needs a paid Wix plan. A site on a free wixsite.com address cannot add it (Wix: Connecting a domain to your site).
• A WebDecoy account with this site added. Create a free account and add the site using the address your shoppers visit (for example https://www.example.com).

Changing your domain removes the code

Wix notes that custom code snippets can be removed if you change or disconnect the site’s domain. If you move domains, check that the WebDecoy snippet is still listed afterwards.

1. Copy your site’s line from WebDecoy

In the WebDecoy dashboard setup checklist, open Install the detection script and choose Copy. If the checklist is closed, open Detection Scripts for the selected site and choose Copy snippet. The line looks like this, with your own IDs:

<script
  async
  src="https://cdn.webdecoy.com/bot-detection/v1/bot-detection.min.js"
  data-aid="your-property-uuid"
  data-sid="your-scanner-uuid">
</script>

Always paste the copied line. data-aid is the site (property) ID and data-sid is the detection script ID; a hand-built line with the wrong ID can load fine and file its reports somewhere you are not looking.

2. Add it with Custom Code

1. In your Wix site dashboard, open Settings, then Custom Code (in the Development & integrations section).
2. Select + Add Custom Code.
3. Paste the WebDecoy line into the code box and give it a name you will recognize, such as WebDecoy.
4. For the pages, choose All pages, and choose to load the code on every page a visitor opens rather than once per visit.
5. Under Place Code in, choose Head.
6. Select Apply.

Custom code only runs on the published site, never in the editor or its preview.

Wix recommends categorizing custom code for privacy compliance. If your site uses a cookie consent banner, a snippet in a category that needs consent may not load for visitors who decline it, and WebDecoy cannot observe those visitors. Pick the category that matches your own privacy policy.

3. Add a hidden decoy link (optional)

A decoy link is a URL that people never see and link-following crawlers do. When a client requests it, WebDecoy’s decoy server records the hit, whether or not that client runs JavaScript.

1. In WebDecoy, open Decoys, choose Create Decoy, keep Honeypot Link and the shared domain, and set the action to Log while you test.
2. From the decoy’s menu, choose Copy URL.
3. Back in Wix, add a second custom code snippet with this line, using your decoy URL. Choose All pages and Body - end:

<a href="https://abc12345.d.webdecoy.com/admin/backup.zip" style="display:none" aria-hidden="true" tabindex="-1" rel="nofollow">Admin</a>

To prove the decoy works, open its URL once yourself and find the record in Detections, as described in Decoy links. That is your own setup check, not an attack.

4. Verify the install

1. Open a published page of your site in a browser. In developer tools, open Network, reload, and find bot-detection.min.js. It must return 200.
2. In the WebDecoy dashboard setup checklist, enter the page address in the install verifier and choose Check my page. WebDecoy fetches the page from outside your browser and tells you whether this site’s tag is there.
3. Open Sensors. After a page loads in a browser, the Detection Script row moves to Running, nothing automated seen or Reporting.

A browser script does not run for curl, so the WebDecoy-Test/1.0 user agent cannot prove this install. To prove the detection pipeline end to end, use Send a test detection on the dashboard. See Verify your installation for what each status means.

What this covers, and what it does not

• Covered: visitors whose browsers run JavaScript, including headless browsers, browser automation, AI browser agents and AI browser extensions, plus LLM referrals.
• Not covered by the script: crawlers that fetch HTML without running JavaScript, such as Googlebot’s crawl pass, GPTBot, ClaudeBot, CCBot and curl. They only show up if they follow the hidden decoy link. To see every request you need an edge sensor such as the Cloudflare edge sensor, which requires your domain’s traffic to pass through Cloudflare. Check Wix’s own domain documentation before proxying a Wix domain.
• No order review. WebDecoy has no Wix app, so it cannot read, tag or flag Wix Stores orders, and it does not block checkout. Detections appear in the WebDecoy dashboard only.
• No blocking from the script. The browser script detects and reports; it does not refuse requests. See Response actions for what you can do with detections.

Read Detection coverage for the full comparison.

Remove

In Wix, open Settings, then Custom Code, and delete the WebDecoy snippets. Reporting stops on the next page load.