Glossary
Complete definitions of terms used throughout the WebDecoy documentation.
A Record
Section titled “A Record”A DNS record type that maps a domain name directly to an IPv4 address. In WebDecoy, A records point to the static IP 3.130.2.51.
WebDecoy’s persistent identity for an automated client, keyed by a composite fingerprint (JA4 TLS plus device signals) rather than an IP address. Detections are correlated into actors so an adversary rotating through many IPs appears as one entity with one history. See Actors.
Actor Signature
Section titled “Actor Signature”The unit of WAF enforcement: a composite, TTL’d signature combining at least two independent dimensions (currently the actor’s JA4 fingerprint AND its network/ASN anchor) — never a bare fingerprint, so shared browser fingerprints on other networks are unaffected.
Automated Certificate Management Environment. The protocol used by Let’s Encrypt to issue and renew SSL/TLS certificates automatically.
API Key
Section titled “API Key”A secret token used to authenticate programmatic access to the WebDecoy API. Format: sk_live_xxxxx.
Attack Signature
Section titled “Attack Signature”A pattern in request data that indicates a known attack type, such as SQL injection or XSS.
The third-party authentication service WebDecoy uses for user login and identity management.
Any automated software that accesses websites or APIs. Can be legitimate (search engines) or malicious (scrapers, attackers).
Bot Score
Section titled “Bot Score”A 0-100 score indicating the likelihood that a visitor is automated rather than human. One component of the headline Threat Score.
Challenge
Section titled “Challenge”An interactive test (like CAPTCHA) presented to visitors suspected of being bots.
CNAME Record
Section titled “CNAME Record”A DNS record type that creates an alias from one domain name to another. Used as an alternative to A records for custom domains.
Confidence Level
Section titled “Confidence Level”How certain WebDecoy is about a detection or classification. Values: High, Medium, Low.
Crawler
Section titled “Crawler”A bot that systematically browses websites, typically to index content (like search engines).
Custom Domain
Section titled “Custom Domain”A domain you own and configure to serve WebDecoy decoy content, making honeypots appear as part of your infrastructure.
Dashboard
Section titled “Dashboard”The main WebDecoy web interface where you view detections, manage resources, and configure settings.
Detection Script
Section titled “Detection Script”A JavaScript-based detection system that runs in visitors’ browsers to identify automation and bots. (The detection source value is bot_scanner for historical reasons.)
A honeypot resource (link, endpoint, or form field) designed to catch attackers and bots. Legitimate users never access decoys.
Decoy Link
Section titled “Decoy Link”A hidden URL that triggers a detection when accessed. Also called a honeypot link.
Deny-at-Mint
Section titled “Deny-at-Mint”The durable session-clearance lockout: a decoy hit places the actor’s device fingerprint on the clearance deny-list, so the clearance endpoint refuses to mint a wd_clearance token for it on any IP address.
Detection
Section titled “Detection”A recorded event when someone interacts with a decoy or triggers bot detection. Contains full request details and threat assessment.
Domain Name System. The internet’s system for translating domain names to IP addresses.
Edge Validator
Section titled “Edge Validator”A small function deployed at your CDN (Cloudflare Worker or AWS Lambda@Edge) that checks the wd_clearance token, allow paths, and machine credentials on enforced routes before requests reach your origin. Fails open.
Endpoint Decoy
Section titled “Endpoint Decoy”A fake API endpoint that captures detailed request information including POST bodies and attack patterns.
False Positive
Section titled “False Positive”When legitimate traffic is incorrectly flagged as malicious.
Fingerprint Tiers
Section titled “Fingerprint Tiers”The three identity tiers an actor can be keyed by, strongest first: crypto (verified cryptographic identity), device (browser/device characteristics), network (JA4 TLS + request shape).
Fingerprinting
Section titled “Fingerprinting”Collecting browser characteristics (canvas, WebGL, fonts) to create a unique identifier for tracking and anomaly detection.
The process of determining geographic location from an IP address.
Good Bot
Section titled “Good Bot”A legitimate automated crawler like Googlebot or social media preview fetchers.
Headless Browser
Section titled “Headless Browser”A web browser running without a graphical interface, commonly used for automation and by attackers.
Honeypot
Section titled “Honeypot”A security resource designed to detect, deflect, or study unauthorized access attempts. Decoys are a type of honeypot.
Ingest Service
Section titled “Ingest Service”The WebDecoy backend component that receives decoy interactions and processes detections in real-time.
Integration
Section titled “Integration”A connection to a third-party service like Cloudflare, Slack, or Datadog for automated actions or notifications.
IP Reputation
Section titled “IP Reputation”A score indicating whether an IP address has been associated with malicious activity.
JA4 (Enforcement Key)
Section titled “JA4 (Enforcement Key)”In WebDecoy, an actor’s JA4 TLS fingerprint is the anchor of its composite enforcement signature — the value pushed to your WAF (always paired with a network anchor, never alone).
JA3/JA4
Section titled “JA3/JA4”TLS fingerprinting methods that create a hash from the TLS handshake, useful for identifying automated tools.
Let’s Encrypt
Section titled “Let’s Encrypt”A free, automated certificate authority that provides SSL/TLS certificates. WebDecoy uses Let’s Encrypt for custom domain HTTPS.
Machine Service Token
Section titled “Machine Service Token”A per-client Ed25519 credential minted on the Enforcement page for your own non-browser clients (partners, monitors, jobs). The client sends its token in a header to pass the clearance gate; revoking a credential cuts off that client only.
MITRE ATT&CK
Section titled “MITRE ATT&CK”A globally recognized framework of adversary tactics and techniques, used to classify detected behaviors.
Monitor / Enforce Mode
Section titled “Monitor / Enforce Mode”The per-organization enforcement switch. Monitor (the default) records would-enforce signals without touching your WAF; Enforce arms the pipeline for real. Flipped in the final step of the Enforcement page.
Multi-tenancy
Section titled “Multi-tenancy”An architecture where a single instance serves multiple customers (organizations) with data isolation.
Organization
Section titled “Organization”The top-level container in WebDecoy. All resources belong to an organization, which is also the billing unit.
Poison
Section titled “Poison”A decoy action that returns fake or misleading data to waste attacker time.
Property
Section titled “Property”A logical grouping within an organization for organizing related resources (e.g., different websites or environments).
A server that acts as an intermediary for requests. Detected as a risk indicator when used for anonymization.
Rate Limiting
Section titled “Rate Limiting”Restricting the number of requests a client can make within a time period.
Rotating Actor
Section titled “Rotating Actor”An actor confirmed evading IP blocking: seen from 5 or more distinct IP addresses with aggregate threat 60 or higher. The qualifying population for actor-level WAF enforcement.
Reconnaissance
Section titled “Reconnaissance”The first phase of an attack where adversaries gather information about the target. MITRE ATT&CK tactic TA0043.
Scanner
Section titled “Scanner”Automated tools that probe systems for vulnerabilities.
The permissions assigned to an API key, limiting what actions it can perform.
Scraper
Section titled “Scraper”A bot that extracts content from websites, often without permission.
Sensitivity
Section titled “Sensitivity”A configuration setting that determines how strictly the detection system scores visitors.
Session Clearance
Section titled “Session Clearance”WebDecoy’s token-gated enforcement for browser traffic. Real sessions earn a signed clearance token (the wd_clearance cookie) by passing a browser check; token-enforced routes require it; a decoy hit puts the client on a deny-list so it can’t obtain a new token on any IP. See Session Clearance.
Server Name Indication. A TLS extension that allows multiple SSL certificates on a single IP address.
SSL/TLS
Section titled “SSL/TLS”Protocols for encrypting communication between browsers and servers. “SSL” often refers to both SSL and its successor TLS.
Stripe
Section titled “Stripe”The payment processing service WebDecoy uses for subscription billing.
Threat Level
Section titled “Threat Level”A classification based on threat score: MINIMAL (0-19), LOW (20-39), MEDIUM (40-59), HIGH (60-79), or CRITICAL (80-100).
Threat Score
Section titled “Threat Score”A unified 0-100 score combining multiple signals into a single risk assessment.
The Onion Router. An anonymity network that can be used to hide the source of web traffic.
Trigger Action
Section titled “Trigger Action”What happens when a decoy is accessed: Log, Block, Poison, or Redirect.
Unified Score
Section titled “Unified Score”See “Threat Score.”
User Agent
Section titled “User Agent”An HTTP header identifying the client software making a request.
Virtual Private Network. Can be detected as a risk indicator when used for anonymization.
Web Application Firewall. A security system that filters HTTP traffic to protect web applications.
Webhook
Section titled “Webhook”A mechanism for one system to notify another of events via HTTP requests.
WebDriver
Section titled “WebDriver”A browser automation interface used by tools like Selenium. Detected as an automation indicator.