Decoy Links
Hidden honeypot URLs that only bots and attackers will find. Legitimate users never see them.
WebDecoy Documentation
Deception-based threat detection for your web applications
What is WebDecoy?
Section titled “What is WebDecoy?”WebDecoy is a deception-based threat detection platform that helps you identify and respond to malicious actors targeting your web applications. By deploying honeypots, decoy links, and detection scripts, you can detect attackers before they reach your real assets.
API Honeypots
Fake API endpoints that capture attack attempts including SQL injection, XSS, and more.
Detection Script
JavaScript-based detection that identifies headless browsers, automation tools, and scrapers.
Edge Sensor
A Cloudflare Worker that reports the crawlers a page tag structurally cannot see: Googlebot’s crawl pass, GPTBot, ClaudeBot, curl.
MITRE ATT&CK
Automatic classification of detected threats using the industry-standard MITRE ATT&CK framework.
Quick Links
Section titled “Quick Links”Getting Started
New to WebDecoy? The dashboard’s setup checklist walks you through it. Start here for what to expect.
Protection Setup
Create decoys, set up detection scripts, and (optionally) host on your own domain.
Monitoring
View and analyze detections, understand threat scoring, and learn about MITRE tactics.
Integrations
Connect Cloudflare in one click, plus Slack, webhooks, and more for automated responses.
What You See in the App
Section titled “What You See in the App”The dashboard answers four questions in order, rather than showing a wall of charts:
| Question | Where |
|---|---|
| Where did detections come from? | A world map on a severity ramp, leading the page |
| Am I protected right now? | Protection status, with named coverage gaps and a link to each fix |
| Who is after me, and what needs my decision? | Adversaries and Decisions waiting |
| What did it do about them? | Enforcement outcomes, from your edge validator |
Two pages are worth knowing about early:
- Sensors lists everything reporting traffic for each of your sites (edge workers, the WordPress plugin, SDKs, detection scripts, decoy links, tripwires) with when each was last seen. It is the fastest way to tell an install that is silent from one that was never made.
- Analytics holds the six volume charts: geography, detection signals, AI scrapers, detections over time, signal radar, and threat category trends.
Platform Features
Section titled “Platform Features”Unified Threat Scoring
Section titled “Unified Threat Scoring”Every detection includes a 0-100 threat score calculated from multiple signals:
| Score Range | Level | Recommended Action |
|---|---|---|
| 0-20 | MINIMAL | Allow |
| 21-40 | LOW | Log |
| 41-60 | MEDIUM | Monitor/Challenge |
| 61-80 | HIGH | Challenge/Block |
| 81-100 | CRITICAL | Block |
Multi-Tenant Architecture
Section titled “Multi-Tenant Architecture”- Organizations - Top-level containers for billing and access control
- Properties - Logical groupings for different websites or environments
- API Keys - Scoped access for SDKs and integrations
SSL Certificate Automation
Section titled “SSL Certificate Automation”Every decoy is served over HTTPS (no setup required).
- Shared-domain decoys (
*.d.webdecoy.com) use a WebDecoy-managed wildcard certificate. - Custom domains get their own Let’s Encrypt certificates auto-provisioned and auto-renewed.
SDK & Plugins
Section titled “SDK & Plugins”WordPress Plugin
Comprehensive bot protection for WordPress sites without writing any code.
Node.js SDK
Server-side bot detection for Express, Next.js, and Fastify applications.
Reference
Section titled “Reference”Looking for specific information?
- Troubleshooting Guide - Common issues and solutions
- Best Practices - Deployment recommendations
- Glossary - Term definitions
- API Reference - REST API endpoints
- Attack Signatures - Detected attack patterns
- Good Bot List - Legitimate bots recognized by WebDecoy