Request-level crawler visibility
Shows automated traffic at the request level, including crawlers and tools that do not execute JavaScript and therefore may not appear in standard analytics.
WebDecoy
WebDecoy is a third-party Vercel Marketplace tool that identifies crawlers, AI bots, tools, and requests without a user agent at the request level. It helps Vercel site and app teams verify some crawler identities and spot apparent user-agent spoofing without blocking traffic.
WebDecoy overview
WebDecoy is a third-party Vercel Marketplace security tool for identifying automated traffic reaching a Vercel site or app. It works at the request level, which lets it observe crawlers that never run JavaScript and may be absent from analytics. It distinguishes between crawlers with published IP ranges or signed requests and requests that appear to impersonate a well-known user agent.
When a project is connected, WebDecoy configures a Vercel log drain so the site can report crawler-related requests without a code change or redeploy. The service is designed for observation rather than enforcement: it reports crawlers, tools, and requests without a user agent, while excluding human visitors from reporting and never blocking or challenging requests.
Key features
Crawler identity verification
Checks crawlers that publish their IP ranges or sign their requests, providing more context than a user-agent string alone.
Spoofing flags
Identifies requests that appear to use a well-known user agent without matching the expected identity signals.
Vercel log-drain setup
A connected project receives a Vercel log drain, allowing WebDecoy to receive the user agent, path, status, client IP, and TLS fingerprint for answered requests without a code change or redeploy.
Hobby middleware option
On Hobby teams, the documented alternative is a one-line @webdecoy/next middleware package. The connected-project workflow also creates the environment variables that this middleware reads.
Monitoring-only operation
Reports traffic without taking enforcement action; it does not block or challenge requests.
Use cases
Audit traffic beyond analytics
Use request-level reporting to identify automated visitors that do not execute JavaScript and are therefore absent from analytics dashboards.
Investigate crawler identity
Compare a crawler's claimed identity with published IP ranges or request signatures when determining whether automated traffic is authentic.
Examine suspected spoofing
Review requests that present a familiar crawler user agent but are flagged as potentially forged, helping teams separate known crawlers from impersonators.
Add passive monitoring to a Vercel project
Connect a production or preview project through the Vercel Marketplace when the team has the required plan and wants setup without modifying application code.
Monitor from a Hobby deployment
Use the documented @webdecoy/next middleware route when a Hobby team cannot create the required Vercel log drain.
Pros and Cons
Pros
- Captures request-level automated traffic that JavaScript-based analytics can miss.
- Uses published IP ranges and signed requests to verify some crawler identities.
- Flags requests that appear to forge a well-known user agent.
- The connected-project setup requires no code change or redeploy.
Cons
- The log-drain connection requires a Vercel Pro or Enterprise team; Hobby users need to use the middleware alternative.
- It is a monitoring-only tool and does not block or challenge automated requests.
- Coverage is limited when client IPs are hidden in Vercel Drains.
FAQ
What happens when I connect a Vercel project?
Connecting a project sets up a Vercel log drain for that project. WebDecoy also creates WEBDECOY_SITE_KEY, WEBDECOY_SCANNER_ID, and WEBDECOY_SENSOR_KEY; the sensor key is stored as a Vercel sensitive variable for production and preview environments.
Can WebDecoy be used with a Hobby team?
The log-drain setup requires a Pro or Enterprise team. On Hobby, WebDecoy points you to a one-line @webdecoy/next middleware alternative.
What traffic does WebDecoy report?
WebDecoy reports crawlers, tools, and requests without a user agent. Human visitors are not reported. The site states that it verifies crawlers that publish their IP ranges or sign their requests and flags requests that forge a well-known user agent.
Does WebDecoy block bots or crawlers?
No. WebDecoy is for monitoring only; it does not block or challenge requests.
What can limit WebDecoy's coverage?
If a team hides client IPs in Vercel Drains, WebDecoy reports that coverage is limited rather than treating the site as having no crawler traffic.
Quick Facts
- Category
- Security and monitoring
- Platform
- Vercel
- Product type
- Third-party Marketplace integration
- Primary scope
- Crawlers, tools, and requests without a user agent
- Connection method
- Vercel log drain, or @webdecoy/next middleware on Hobby
- Marketplace installs
- Fewer than 500
WebDecoy Alternativen
PromptScout
PromptScout tracks how ChatGPT, Gemini, Google AI Overviews, and Perplexity mention your brand or competitors, then pairs those results with source analysis and website audits. It helps teams decide what to fix in content, positioning, or site readiness next.
Sleek Analytics
Sleek Analytics is a privacy-friendly web analytics tool with real-time visitor tracking, Core Web Vitals, and revenue attribution. It helps site owners understand traffic and conversions without cookie banners or a heavy setup.
MacSpoof
MacSpoof ist ein MAC-Adressenwechsler für macOS: WLAN-MAC ändern oder randomisieren, um Verbindungen zu erneuern und die Protokollierung auf öffentlichem WLAN zu reduzieren.
ClawTick
ClawTick is an AI agent automation platform for scheduling jobs from the CLI, dashboard, or REST API. It is aimed at developers and teams running LangChain, CrewAI, webhook, or custom agent workflows that need monitoring, alerts, and logs.
OpenFlags
OpenFlags is an open-source, self-hosted feature flag platform for modern JavaScript teams. It supports local evaluation, targeted rollouts, and controlled launches while keeping flag data in your own infrastructure.
SecAIQ Watch
SecAIQ Watch is a local, read-only dashboard for monitoring AI assistants, coding agents, local models, and MCP servers on macOS, Linux, and Windows. It shows network activity, permissions, findings, file access, and token usage without sending observations to a cloud service.