Bot detection, protection and AI traffic visibility for websites, apps and stores.
Install on Shopify · Install on WordPress · Developer docs · Website
| Your site | What you can do | Start here |
|---|---|---|
| Shopify | Inspect bot signals and decoy interactions, review correlated order evidence, and investigate observed AI crawlers and referrals inside Shopify admin. | Install the app · Watch the setup walkthrough |
| WordPress / WooCommerce | Run local bot detection and protection in wp-admin. The standalone plugin needs no account or API key; cloud connection is optional. | Install the free plugin · Watch a canary test |
| Node.js apps | Add middleware with local tripwires, rate limits and IP rules. Connect platform checks when your application needs them. | SDK and examples · Express example |
| Sites behind an edge platform | Collect request evidence where a browser tag cannot see it, then apply the response supported by your integration. | Choose an integration |
- Install WebDecoy from the Shopify App Store.
- In the theme editor, enable WebDecoy Bot Detection under App embeds and save.
- Open Setup & health, create a labeled test, visit its storefront link, and confirm delivery.
Follow the full setup guide or watch the walkthrough. If the store is password protected, unlock it in your own browser and reopen the test link. Check storefront and checkout-pixel delivery separately.
Order review needs a matching session and detection. Features vary by plan and settings; cancellation requires a Shopify Flow workflow you configure and enable.
| Project | Use it for |
|---|---|
| FCaptcha | Self-hosted CAPTCHA for detecting browser automation, including AI agents. Inspect the code, try the demo, and run your own verifier. |
| Node SDK | Bot-detection middleware, runnable integration examples and application response controls. |
| WordPress plugin | Local WordPress and WooCommerce detection and protection, with an optional WebDecoy Cloud connection. |
| GEOMCP | GEO and SEO audits from an MCP client, with evidence for findings and before/after verification. |
FCaptcha and GEOMCP are separate tools. You can use them independently of WebDecoy Cloud.
- Shopify setup and order review: development-store walkthrough with labeled test activity and seeded example orders.
- WordPress detection test: a controlled canary request and the resulting wp-admin detection log.
- AI crawlers versus AI referrals: distinguish observed crawling from identifiable visits sent by AI assistants.
These demonstrations show specific workflows, not production detection accuracy. Coverage depends on the sensor: a browser tag cannot observe every crawler that skips JavaScript, and missing referral information remains unattributed.
Explore the project READMEs for installation, examples, licenses and contribution guides. Reproducible issues, integration feedback and pull requests are welcome.