Request-level crawler visibility
Shows automated traffic at the request level, including crawlers and tools that do not execute JavaScript and therefore may not appear in standard analytics.
WebDecoy
WebDecoy identifies crawlers, AI bots, tools, and requests without user agents at the request level, helping Vercel teams verify identities and spot spoofing.
WebDecoy overview
WebDecoy is a third-party Vercel Marketplace security tool for identifying automated traffic reaching a Vercel site or app. It works at the request level, which lets it observe crawlers that never run JavaScript and may be absent from analytics. It distinguishes between crawlers with published IP ranges or signed requests and requests that appear to impersonate a well-known user agent.
When a project is connected, WebDecoy configures a Vercel log drain so the site can report crawler-related requests without a code change or redeploy. The service is designed for observation rather than enforcement: it reports crawlers, tools, and requests without a user agent, while excluding human visitors from reporting and never blocking or challenging requests.
Key features
Crawler identity verification
Checks crawlers that publish their IP ranges or sign their requests, providing more context than a user-agent string alone.
Spoofing flags
Identifies requests that appear to use a well-known user agent without matching the expected identity signals.
Vercel log-drain setup
A connected project receives a Vercel log drain, allowing WebDecoy to receive the user agent, path, status, client IP, and TLS fingerprint for answered requests without a code change or redeploy.
Hobby middleware option
On Hobby teams, the documented alternative is a one-line @webdecoy/next middleware package. The connected-project workflow also creates the environment variables that this middleware reads.
Monitoring-only operation
Reports traffic without taking enforcement action; it does not block or challenge requests.
Use cases
Audit traffic beyond analytics
Use request-level reporting to identify automated visitors that do not execute JavaScript and are therefore absent from analytics dashboards.
Investigate crawler identity
Compare a crawler's claimed identity with published IP ranges or request signatures when determining whether automated traffic is authentic.
Examine suspected spoofing
Review requests that present a familiar crawler user agent but are flagged as potentially forged, helping teams separate known crawlers from impersonators.
Add passive monitoring to a Vercel project
Connect a production or preview project through the Vercel Marketplace when the team has the required plan and wants setup without modifying application code.
Monitor from a Hobby deployment
Use the documented @webdecoy/next middleware route when a Hobby team cannot create the required Vercel log drain.
Pros and Cons
Pros
- Captures request-level automated traffic that JavaScript-based analytics can miss.
- Uses published IP ranges and signed requests to verify some crawler identities.
- Flags requests that appear to forge a well-known user agent.
- The connected-project setup requires no code change or redeploy.
Cons
- The log-drain connection requires a Vercel Pro or Enterprise team; Hobby users need to use the middleware alternative.
- It is a monitoring-only tool and does not block or challenge automated requests.
- Coverage is limited when client IPs are hidden in Vercel Drains.
FAQ
What happens when I connect a Vercel project?
Connecting a project sets up a Vercel log drain for that project. WebDecoy also creates WEBDECOY_SITE_KEY, WEBDECOY_SCANNER_ID, and WEBDECOY_SENSOR_KEY; the sensor key is stored as a Vercel sensitive variable for production and preview environments.
Can WebDecoy be used with a Hobby team?
The log-drain setup requires a Pro or Enterprise team. On Hobby, WebDecoy points you to a one-line @webdecoy/next middleware alternative.
What traffic does WebDecoy report?
WebDecoy reports crawlers, tools, and requests without a user agent. Human visitors are not reported. The site states that it verifies crawlers that publish their IP ranges or sign their requests and flags requests that forge a well-known user agent.
Does WebDecoy block bots or crawlers?
No. WebDecoy is for monitoring only; it does not block or challenge requests.
What can limit WebDecoy's coverage?
If a team hides client IPs in Vercel Drains, WebDecoy reports that coverage is limited rather than treating the site as having no crawler traffic.
Quick Facts
- Category
- Security and monitoring
- Platform
- Vercel
- Product type
- Third-party Marketplace integration
- Primary scope
- Crawlers, tools, and requests without a user agent
- Connection method
- Vercel log drain, or @webdecoy/next middleware on Hobby
- Marketplace installs
- Fewer than 500
WebDecoy Alternatives
PromptScout
PromptScout tracks how ChatGPT, Gemini, Google AI Overviews, and Perplexity mention your brand or competitors, with source analysis and website audits.
Sleek Analytics
Sleek Analytics is a privacy-friendly web analytics tool with real-time visitor tracking, Core Web Vitals, and revenue attribution.
MacSpoof
MacSpoof is a macOS MAC address changer that lets you change or randomize your Wi‑Fi MAC to reconnect and limit device logging on public Wi‑Fi.
ClawTick
ClawTick is an AI agent automation platform for scheduling jobs from the CLI, dashboard, or REST API. Built for developers and teams using LangChain, CrewAI, webhooks, or custom workflows with monitoring, alerts, and logs.
OpenFlags
OpenFlags is an open-source, self-hosted feature flag platform for JavaScript teams, with local evaluation, targeted rollouts, and controlled launches.
SecAIQ Watch
SecAIQ Watch is a local, read-only dashboard for monitoring AI assistants, coding agents, local models, and MCP servers on macOS, Linux, and Windows without cloud services.