WebDecoy for Vercel

WebDecoy is trying to catch bots by tricking them, not by slowing everyone else down. The product is aimed at the current crawler mess: AI scrapers, fake user agents, and automated visitors that act like they belong on your site until they don’t.

Its basic play is deception. Honeypot decoys are placed where bots will touch them and humans won’t. For traffic that never runs JavaScript, WebDecoy leans on an edge sensor on Cloudflare. It also uses behavioral and TLS fingerprinting so the same actor can be recognized across different IPs.

There’s a trust layer too. Verified crawlers using Web Bot Auth are allowed through, while impersonators are flagged. And the company says the user stays in control of enforcement, which matters because this is not a blunt blocking tool. It is monitoring first.

For Vercel users, the setup is simple enough: connect a project and WebDecoy reads the Vercel log drain. No code changes. It identifies crawler traffic per request, checks real crawlers against published IP ranges, and flags forged user agents. It says it never blocks and never reports humans.

The product also comes with SDKs for Node, PHP, WordPress, and Shopify, plus open source FCaptcha included. This is the third launch from WebDecoy, and the pitch is pretty clear: if the bots are getting smarter, the defense should stop pretending they’ll all behave like honest browsers.