Bot Management
The node cuts off fast bots with a request limit and bans. You can also turn on a browser check per site. By default visitors do not notice it.
What we block.
Credential Stuffing
Automated login attempts using leaked username/password pairs. A fast brute force from one IP is cut off by the request limit. A slow one spread over many IPs stays under it.
Scraper Bots
Systematic content extraction. Fast ones are cut off by the request limit. Simple scrapers without a browser engine fail the browser check. Headless browsers pass it.
Fake Account Creation
Mass signups consuming free trials and polluting your user database. Caught during the registration flow, before account creation completes.
Scalpers & Price Scrapers
Bots that clean out limited stock in seconds. Price scrapers that undercut your catalog within minutes. Fast ones from one address hit the request limit; simple ones without a browser fail the check. There is no behavioral analysis of the cart.
Browser check.
The node checks the visitor before the WAF. With the check cookie, the request goes on. Without it, the visitor gets a check. You pick the level per site, on every plan.
Blocks nothing. The node logs who it would check, so you see the effect before turning it on.
A silent redirect that sets a cookie, no JS needed. Stops curl, python-requests and simple flood tools.
A check page: the browser solves a small computation by itself. Stops scrapers and HTTP bots without a JS engine.
A harder task, and the cookie is tied to the network and User-Agent, so bots cannot trade ready cookies. A visitor who changes network solves it again.
A page on our node with a Continue button and a computational task. It is not a check that the visitor is human: a headless browser passes it.
What the check does not do.
- It does not stop headless browsers (Playwright, Puppeteer) or paid bot farms.
- It does not stop volumetric L3/L4 attacks: the node still accepts every connection.
- It does not tell a human from a bot: it checks that the client keeps a cookie and can compute.
- Auto-escalation is off by default and still experimental. If you turn it on, the level rises one step when the site often blocks requests by rate limit, WAF or CrowdSec. This is not an attack detector: it will not see a flow where every address stays under the limit.
- Visitors without JS and Tor users fail js and above. redirect stays available for them.
Signals that are planned.
Humans don't request pages at exactly 200ms intervals.
Bots rarely send the full browser header set.
Planned: the TLS handshake itself reveals automation tools.
Planned: mouse movement, scroll, interaction timing on protected pages.
What we don't block.
- Google and Bing crawlers pass by their IP lists, not by User-Agent, if you turn this on for the site (off by default). We add other search engines to the list after checking their sources. Until a crawler is excluded, do not set js or higher on public pages
- Webhooks, APIs and apps: their paths are excluded from the check
- Grey list: for chosen IPs you can set a stricter check than the site level
The goal they can't find.
Defense in the dark. No credit card. No footprint.