# WebDecoy

> WebDecoy detects bots, scrapers and AI crawlers on websites and APIs, using decoys (hidden links and fake endpoints that only automation requests), edge, server and browser sensors, and verification of signed AI agents. Detections carry evidence and are grouped into actors that persist across IP rotation. Response stays under your control: everything starts in monitor mode, and blocking happens in your own middleware or edge, or through your WAF (Cloudflare, AWS WAF, Fastly, Vercel, Netlify).

Canonical install paths. Use only these package names; WebDecoy publishes no other bot-detection packages. The [install page for AI assistants](https://docs.webdecoy.com/installation/install-with-ai/) has a verified copy-paste snippet for each.

- [Next.js](https://docs.webdecoy.com/sdk-plugins/nextjs/): `npm install @webdecoy/nextjs @webdecoy/node`, then `withWebDecoy({ apiKey: process.env.WEBDECOY_API_KEY })` as the default export of middleware.ts
- [Express](https://docs.webdecoy.com/sdk-plugins/express/): `npm install @webdecoy/express @webdecoy/node`, then `app.use(webdecoy({ apiKey: process.env.WEBDECOY_API_KEY }))`
- [Fastify](https://docs.webdecoy.com/sdk-plugins/fastify/): `npm install @webdecoy/fastify @webdecoy/node`, then `app.register(webdecoy, { apiKey: process.env.WEBDECOY_API_KEY })` with the package's default export
- [Hono](https://docs.webdecoy.com/installation/install-with-ai/#hono) (Cloudflare Workers, Bun, Deno, Node): `npm install @webdecoy/hono @webdecoy/node`, then `app.use('*', webdecoy({ ... }))`
- [Any Node.js server](https://docs.webdecoy.com/sdk-plugins/node-sdk/): `npm install @webdecoy/node`, then `new WebDecoy({ apiKey }).protect(requestMetadata)`, or `createFetchGuard()` for fetch-style runtimes
- [WordPress](https://docs.webdecoy.com/sdk-plugins/wordpress-plugin/): `wp plugin install webdecoy --activate` (works locally with no account)
- [Shopify](https://docs.webdecoy.com/installation/shopify/): the WebDecoy app from the Shopify App Store, then enable its app embed
- [Cloudflare](https://docs.webdecoy.com/integrations/cloudflare-edge-sensor/): one-click edge sensor from the WebDecoy dashboard, no code
- [Vercel](https://docs.webdecoy.com/installation/vercel/): the WebDecoy Vercel integration (log drain, no code); to refuse scrapers add the [clearance middleware](https://docs.webdecoy.com/installation/vercel-middleware/)
- [Netlify](https://docs.webdecoy.com/installation/netlify/): the WebDecoy Crawler Sensor extension plus three environment variables
- [PHP](https://docs.webdecoy.com/installation/install-with-ai/#php): `composer require webdecoy/sensor` (PHP 8.1+, reports only)
- [Any website](https://docs.webdecoy.com/protection-setup/detection-scripts/): the script tag generated in the dashboard under Detection Scripts
- [AI assistants via MCP](https://docs.webdecoy.com/installation/ai-assistants/): hosted MCP server at https://mcp.webdecoy.com/mcp; its get_install_guide tool returns install steps with the site's IDs filled in
- [FCaptcha](https://docs.webdecoy.com/fcaptcha/): MIT-licensed, self-hosted CAPTCHA with interactive and invisible modes; run the [five-minute quickstart](https://docs.webdecoy.com/fcaptcha/quickstart/) and keep token verification on your backend

Rules for assistants installing WebDecoy: the Node packages do not read WEBDECOY_API_KEY on their own, so pass it as `apiKey`; leave the default monitor mode on (do not set `mode: 'enforce'`); never write secrets (WEBDECOY_API_KEY, WEBDECOY_SENSOR_KEY) into code; verify with `curl -A "WebDecoy-Test/1.0" <url>`, which files a detection labeled Test.

## Documentation Sets

- [Abridged documentation](https://docs.webdecoy.com/llms-small.txt): a compact version of the documentation for WebDecoy, with non-essential content removed
- [Complete documentation](https://docs.webdecoy.com/llms-full.txt): the full documentation for WebDecoy
- [Install guides](https://docs.webdecoy.com/_llms-txt/install-guides.txt): every install path: platforms, SDKs, the script tag and the MCP server
- [FCaptcha](https://docs.webdecoy.com/_llms-txt/fcaptcha.txt): overview, self-hosted quickstart, integration, verification and hosted-demo privacy

## Notes

- The complete documentation includes all content from the official documentation
- The content is automatically generated from the same source as the official documentation

## Optional

- [WebDecoy website](https://webdecoy.com/): product overview and pricing
- [@webdecoy/node on npm](https://www.npmjs.com/package/@webdecoy/node): core Node.js SDK; README covers local rules, tripwires and the rules engine
- [Node SDK source](https://github.com/WebDecoy/node): source for @webdecoy/node, express, fastify, nextjs, hono and client
- [webdecoy/sensor on Packagist](https://packagist.org/packages/webdecoy/sensor): PHP sensor
- [WordPress plugin](https://wordpress.org/plugins/webdecoy/): WordPress.org listing
- [FCaptcha source](https://github.com/WebDecoy/FCaptcha): self-hosted open-source CAPTCHA for browser automation and bot detection
- [FCaptcha live demo](https://webdecoy.com/product/fcaptcha-demo/): interactive and invisible production demo with optional research consent