Bot detection and remediation for the AI era.
Passive honeypots, behavioral analysis, and vision AI CAPTCHA to stop scrapers and sophisticated bots.
Website · Live Demo · npm · WordPress
| Project | What it does | |
|---|---|---|
| FCaptcha | Self-hosted CAPTCHA | Detects bots, vision AI agents, and headless browsers through 40+ behavioral signals and SHA-256 proof of work. Go, Python, and Node.js servers. Privacy-first, no external dependencies. |
| Node SDK | Bot detection middleware | TLS fingerprinting (JA3/JA4), rate limiting, and rules engine for Express, Fastify, and Next.js. Two-tier analysis with fail-open design. |
| WordPress Plugin | WordPress bot protection | Zero-config bot detection for WordPress and WooCommerce. SHA-256 proof-of-work challenges, behavioral scoring, rate limiting, and carding defense. Works on activation with no external dependencies. |
Web Decoy is a platform for detecting and responding to automated threats — from basic scrapers to AI-powered agents that use vision models to navigate sites like humans do.
- Decoy links — invisible honeypot traps that catch bots ignoring
robots.txt, including GPTBot, ClaudeBot, and 20+ AI crawlers - Endpoint decoys — API honeypots that catch credential stuffing, injection attacks, and path enumeration with zero false positives
- Behavioral analysis — TLS fingerprinting, mouse entropy, keystroke cadence, and timezone consistency checks
- Vision AI detection — purpose-built to detect screenshot-and-click automation (Claude Computer Use, OpenAI Operator, and similar)
- Response automation — integrates with Cloudflare, AWS WAF, and custom webhooks for real-time blocking
FCaptcha — one command:
docker run -d -p 3000:3000 -e FCAPTCHA_SECRET=my-secret ghcr.io/webdecoy/fcaptchaNode SDK — add to any Express app:
npm install @webdecoy/expressimport { webdecoy } from '@webdecoy/express';
app.use(webdecoy({
apiKey: process.env.WEBDECOY_API_KEY,
threatScoreThreshold: 70,
}));WordPress — install and activate:
- Download from GitHub Releases
- WordPress Admin → Plugins → Add New → Upload Plugin
- Activate — protection starts immediately, zero configuration needed
FCaptcha and the Node SDK are MIT-licensed. The WordPress plugin is GPLv2+. Issues and PRs welcome.