Detection Source Types

Reference table of all detection sources in WebDecoy.

---

Detection Sources Overview

A detection row carries one source value. Charts and source filters use a narrower vocabulary than the rows do: several row-level values bucket into a broader category rather than having a slice of their own.

Filter and chart vocabulary

These are the seven categories you can filter and chart by:

Source	Code	Icon	Description
Decoy Link	decoy_link	Link	Hidden honeypot link was accessed
Endpoint	endpoint	API	API honeypot received a request
Detection Script	bot_scanner	Robot	JavaScript scanner detected automation
SDK	sdk	Code	Server-side SDK submitted a detection
Agent	agent	Shield	A deployed honeypot agent captured an attacker
Edge Worker	edge_worker	Cloud	Cloudflare Worker saw an automated client in front of your origin
Unknown	unknown	Sensors	A source this build of the dashboard has not been taught yet

unknown is deliberately part of the vocabulary rather than a bug. If the server reports a source the UI does not recognise, it stays visible and obviously unlabelled instead of being quietly folded into a real category and inflating its count.

Row-level values that bucket into the above

Source	Code	Icon	Buckets into
WordPress	wordpress_plugin	Globe	SDK
Tripwire	sdk_tripwire	Flag	SDK
Honeypot Agent	honeypot_agent	Shield	Agent

Rows show the value above; charts show the bucket. A WordPress detection therefore appears as “WordPress” on the detection itself and inside the SDK slice on a chart.

LLM referrals are not a source

Earlier versions of this page listed llm_referral as a source code. It is not one. An LLM referral is a flag on a detection whose source is bot_scanner or decoy_link, carried in metadata as is_llm_referral alongside llm_platform. Filtering by source will not find them; the AI Referrals views will. See LLM Referral below.

---

Decoy Link (decoy_link)

Description

Detections from hidden honeypot URLs that legitimate users cannot see or access.

Typical Data

Field	Example
URL	/admin/backup.zip
Method	GET
Trigger Action	Log, Block, Poison, Redirect
Click Count	Incremented on each access

Common Scenarios

• Bot crawling hidden links
• Scanner probing common admin paths
• Attacker following disallowed robots.txt paths

MITRE Mapping

Usually mapped to:

• TA0043 (Reconnaissance)
• TA0001 (Initial Access)

---

Endpoint (endpoint)

Description

Detections from fake API endpoints that capture detailed request information including POST bodies.

Typical Data

Field	Example
URL	/api/v1/admin/users
Method	POST, PUT, DELETE, PATCH
Body	Captured request body
Content-Type	application/json
Attack Signatures	SQL injection, XSS, etc.

Endpoint-Specific Fields

Field	Description
request_body	Captured POST/PUT body content
body_size	Size in bytes
content_type	Content-Type header value
has_auth_header	Whether Authorization header present
attack_signatures	Array of detected attack patterns

Common Scenarios

• API vulnerability scanning
• SQL injection attempts
• Authentication bypass attempts
• Data exfiltration probing

MITRE Mapping

Usually mapped to:

• TA0001 (Initial Access) - for exploit attempts
• TA0006 (Credential Access) - for auth attacks
• TA0007 (Discovery) - for enumeration

---

Detection Script (bot_scanner)

Description

Detections from the JavaScript-based scanner running in visitors’ browsers.

Typical Data

Field	Example
Detection Type	Headless browser, WebDriver
Bot Score	0-100
Signals	Array of detected anomalies
Browser Fingerprint	Hash of browser characteristics

Scanner-Specific Fields

Field	Description
webdriver_detected	WebDriver API present
headless_detected	Running in headless mode
automation_markers	Puppeteer, Playwright traces
fingerprint_hash	Browser fingerprint
behavioral_score	Behavior analysis score

Detection Signals

Signal	Indicates
webdriver	Selenium/WebDriver automation
headless_chrome	Chrome running headless
puppeteer	Puppeteer automation
playwright	Playwright automation
phantom_js	PhantomJS browser
missing_plugins	No browser plugins (headless indicator)
canvas_anomaly	Unusual canvas fingerprint
webgl_anomaly	Graphics rendering inconsistency
chromedriver_cdc	ChromeDriver cdc_ properties detected
selenium_evaluate	Selenium evaluation artifacts
selenium_unwrapped	Selenium unwrapped objects
firefox_driver	Firefox WebDriver artifacts
puppeteer_eval	Puppeteer evaluation script markers
cdp_script_injection	CDP Runtime.evaluate injection
webdriver_getter_modified	Modified navigator.webdriver getter

Fingerprint Integrity Flags (Pro)

These advanced signals detect stealth plugins and anti-fingerprinting tools:

Signal	Indicates
lie_tampering	Stealth plugin detected (native functions modified)
lie_modified_*	Specific function with modified toString()
lie_webdriver_getter_tampered	WebDriver getter property descriptor modified
lie_webdriver_getter_modified	WebDriver getter toString is not native
lie_toString_tampered	Function.prototype.toString modified
lie_bind_tampered	Function.prototype.bind modified
lie_plugins_spoofed	navigator.plugins object type mismatch
lie_getOwnPropertyDescriptor_tampered	Core Object method modified
lie_defineProperty_tampered	Core Object method modified
lie_chrome_runtime_spoofed	Fake chrome.runtime in non-Chrome browser
worker_mismatch	Main thread/Web Worker navigator mismatch
worker_mismatch_platform	Platform differs between main/worker
worker_mismatch_userAgent	User agent differs between main/worker
worker_mismatch_hardwareConcurrency	CPU cores differ between main/worker
worker_mismatch_language	Language differs between main/worker
canvas_pixel_noise	Anti-fingerprinting noise in canvas output
canvas_text_metrics_anomaly	Text metrics inconsistent across fonts

Common Scenarios

• Headless browser scraping
• Automated testing tools on production
• Bot networks using browser automation

MITRE Mapping

Usually mapped to:

• TA0043 (Reconnaissance) - for scraping
• TA0009 (Collection) - for data theft

---

WordPress Plugin (wordpress_plugin)

Description

Detections from the WebDecoy WordPress plugin’s server-side analysis.

Typical Data

Field	Example
Detection Type	Rate limit, honeypot field, user agent
WordPress Hook	comment_form, login, registration
Plugin Version	2.4.x

Plugin-Specific Fields

Field	Description
hook_triggered	Which WordPress hook caught this
honeypot_filled	Hidden form field was filled
rate_limited	Request exceeded rate limit
form_type	comment, login, registration
woocommerce_context	Cart, checkout, etc.

Detection Contexts

Context	Description
comment_form	Comment submission
login	Login attempt
registration	User registration
checkout	WooCommerce checkout
general	General request analysis

Common Scenarios

• Comment spam bots
• Login brute force attacks
• Registration spam
• Card testing on WooCommerce

These rows are recorded whether or not anything was blocked

From plugin version 2.3.2 onward, monitor mode is the default: the plugin detects, logs and reports everything and blocks nothing until an admin turns blocking on. A full stream of wordpress_plugin detections next to an empty block list is the expected state on a fresh install.

MITRE Mapping

Usually mapped to:

• TA0006 (Credential Access) - for login attacks
• TA0001 (Initial Access) - for form exploits

---

SDK (sdk)

Description

Detections submitted programmatically via the Node.js or PHP SDK.

Typical Data

Field	Example
SDK Version	1.0.0
Framework	Express, Next.js, etc.
Custom Fields	Developer-defined metadata

SDK-Specific Fields

Field	Description
sdk_version	Version of SDK used
framework	Web framework (if applicable)
custom_metadata	Developer-added fields
submission_timestamp	When SDK submitted

Common Scenarios

• Custom server-side bot detection
• Middleware-based protection
• API gateway integration
• Custom threat analysis

MITRE Mapping

Depends on detection context. Typically:

• TA0043 (Reconnaissance)
• TA0001 (Initial Access)

---

Tripwire (sdk_tripwire)

Description

A hidden honeypot path was requested: scanner-bait such as /.env, /.git/config or /wp-config.php, planted by the WordPress plugin or an SDK. These paths exist nowhere on your site, so a request for one is a deterministic signal of automated intent rather than a heuristic guess. The SDK reports it with confidence 100.

Charts bucket these into SDK; the detection row says Tripwire.

Typical Data

Field	Example
Path	/.env
Rule	tripwire
Action	DENY, THROTTLE, CHALLENGE, LOG
Dry run	Whether the rule was in dry-run / monitor mode

Scoring

A tripwire hit contributes a flat +40 to the threat score under the signal tripwire_triggered, at confidence 0.95. It is scored on the same footing as a decoy or endpoint hit: proof rather than inference.

Why it matters for enforcement

A tripwire hit is the one signal that can durably lock out a device. When the hit is live (not dry run), the action is DENY, and the request carries a wd_clearance cookie, the actor’s clearance fingerprint is added to the deny list, with the path recorded as the reason (tripwire:/.env). Heuristic rules such as filter and rate-limit rules never do this, so the deny list is fed by the deception signal alone.

MITRE Mapping

Usually mapped to TA0043 (Reconnaissance) and TA0007 (Discovery).

---

LLM Referral

Not a source of its own. An LLM referral is a detection with is_llm_referral set in its metadata; its source stays bot_scanner or decoy_link, whichever recorded it.

Description

Recorded when a visitor arrives from an AI platform. These represent human visitors who clicked a link shared by an AI chatbot (e.g., ChatGPT, Perplexity, Claude).

Typical Data

Field	Example
Score	0 (always)
is_llm_referral	"true"
llm_platform	chatgpt, perplexity, claude, etc.
Referrer	https://chatgpt.com/c/abc123
Page URL	The landing page URL

Tracked Platforms

Platform	Domains
ChatGPT	chat.openai.com, chatgpt.com
Perplexity	perplexity.ai, www.perplexity.ai
Google Gemini	gemini.google.com
Claude	claude.ai
DeepSeek	deepseek.com, www.deepseek.com, chat.deepseek.com
Microsoft Copilot	copilot.microsoft.com
You.com	you.com, www.you.com
Phind	phind.com, www.phind.com
Kagi	kagi.com, www.kagi.com
Meta AI	meta.ai, www.meta.ai
Grok	grok.com, www.grok.com

Common Scenarios

• User asks ChatGPT a question, ChatGPT links to your site, user clicks the link
• Perplexity search results include your page as a source
• AI assistant recommends your product/service with a link

Key Difference from Other Sources

LLM referral detections are not threats. They have a score of 0 and are used for analytics purposes: understanding how AI platforms drive traffic to your site.

---

Edge Worker (edge_worker)

Description

A Cloudflare Worker running in front of your origin reported an automated client. This is the only source that can see a client which never executes JavaScript: Googlebot’s crawl pass, GPTBot, ClaudeBot, CCBot, curl, most scrapers.

bot_scanner runs in the visitor’s browser, so it structurally cannot observe these clients. The two sources see different populations and neither replaces the other. See the Cloudflare Edge Sensor guide to install it.

Typical Data

• User agent, path, and IP as seen at the edge, before your origin
• Request-shape signals a browser would normally satisfy: missing Accept-Language, absent fetch metadata, header ordering
• Cloudflare’s own verifiedBotCategory where available
• Whether the client presented a valid Web Bot Auth signature

Edge-Specific Behaviour

Reporting is gated on configuration. The Worker only reports when it is served an enabled config carrying a scanner id. A deployed Worker with reporting off classifies every request and sends none of them. Check Reporting: On on the integration card.

Volume is bounded deliberately. Repeated reports for the same client and path are capped at the edge, so counts are a floor rather than an exact total. The cap is per Worker isolate, and Cloudflare creates isolates freely under concurrency, so the effective limit is higher than the configured number.

Weak signals are sampled. Strong signals (a known crawler, a valid signature, a crawler path) are never sampled away.

Common Scenarios

• An AI training crawler indexing your content, invisible to every other source
• A search engine’s crawl pass, with timestamps you can reconcile against Search Console
• A client claiming to be Googlebot from an address Google does not own

MITRE Mapping

Reconnaissance: Active Scanning, and Gather Victim Web Information.

---

Source Comparison Table

Source	Server-Side	Client-Side	Body Capture	Attack Signatures
decoy_link	Yes	No	No	Basic
endpoint	Yes	No	Yes	Full
bot_scanner	No	Yes	No	Automation
wordpress_plugin	Yes	Yes	Limited	Full
sdk	Yes	No	Custom	Custom
sdk_tripwire	Yes	No	No	Path only, deterministic
honeypot_agent	Yes	No	Yes	SSH command captures
edge_worker	Yes (edge)	No	No	Crawler and tool identification

---

Which sources are reporting for you

Every source in this reference is a sensor, and the Sensors page (sidebar, under Countermeasures) lists the ones actually reporting for each of your sites: edge workers, the WordPress plugin, the SDKs, detection scripts, decoy links, and tripwires. Per sensor it shows the last time it was seen and its detection counts over 24h and 7d.

That page is the right place to answer “why do I have no edge_worker rows”, because it distinguishes a sensor that is installed and silent from one that was never installed. See Cloudflare Edge Sensor.

---

Filtering by Source

In the Dashboard

1. Go to Detections
2. Click Filters
3. Select Source filter
4. Check desired sources

Remember that the filter uses the seven-category vocabulary above. Selecting SDK includes WordPress and Tripwire rows; selecting Agent includes Honeypot Agent rows.

Via API

GET /api/organizations/{org_id}/detections?source=endpoint

Multiple sources:

GET /api/organizations/{org_id}/detections?source=endpoint,bot_scanner