BotDetect
Server-side bot detection for modern websites

Score every request before it reaches your application.

BotDetect helps websites identify fake crawlers, bad bots, AI scrapers and abusive traffic using a real-time request scoring API and simple integrations.

View pricing See how it works
/v1/check
{
  "request_id": "req_7H2K",
  "score": 9,
  "reason": "fakecrawler",
  "action": "block",
  "signals": [
    "googlebot_asn_mismatch",
    "browser_headers_missing",
    "ip_reputation"
  ]
}
DecisionBlock
9/10
Real-time request scoringWordPress protectionEdge checks for CloudflareServer-side integrationIP reputation feed
Product

Bot detection that runs before your app does the expensive work.

Send request metadata to BotDetect and receive a simple score, reason and recommended action. Keep your application in control: monitor, challenge or block.

01

Request scoring API

Classify HTTP requests with a 0–10 score and a compact reason your application can act on immediately.

02

Fake crawler verification

Detect clients pretending to be Googlebot, Bingbot or other crawlers using ASN, DNS and behavior checks.

03

IP reputation memory

Use short-lived behavioral reputation to recognize repeat abuse without storing every request forever.

04

Safe rollout modes

Start in monitor-only mode, then move selected surfaces to challenge or block when you are confident.

1Collect

Plugin, worker or server-side SDK sends request metadata.

2Score

BotDetect evaluates headers, crawler identity, ASN, reputation and behavior.

3Act

Your site allows, monitors, challenges or blocks the request.

Solutions

Use the integration that fits your stack.

BotDetect is designed for practical adoption: install a plugin, paste a Worker, include a PHP client or protect traffic at the server layer.

WordPress protection

Protect frontend pages, wp-login.php, XML-RPC, REST API and admin-ajax with monitor, challenge and block modes.

Start with WordPress

Cloudflare edge

Run a Worker before traffic reaches your origin. Useful when full-page cache would bypass PHP.

Edge protection

Server-side apps

Use the REST API or SDK from PHP, Laravel, Symfony or custom backend applications.

API workflow

Infrastructure teams

Deploy an nginx/Apache integration, local agent or reputation feed for higher-volume environments.

Architecture
Why it matters

Bad bot traffic is not one problem.

Some bots scrape content. Some pretend to be search engines. Some probe WordPress endpoints. Some arrive slowly across many IPs. BotDetect combines request-level checks and reputation signals so you can respond proportionally.

  • Fake Googlebot and Bingbot detection
  • AI scraper and crawler visibility
  • WordPress login, XML-RPC and REST protection
  • IP reputation and behavioral signals
  • Monitor-first deployment to reduce false positives
Pricing

Simple plans for websites, agencies and high-volume teams.

Start with a free website, then scale request volume and support level as your traffic grows.

Free

€0/month

For testing BotDetect on one website.

  • 1 website
  • API access
  • WordPress plugin
  • Basic dashboard
  • 1,000 requests/hour
Start free
Popular

Standard

€35/month

For production websites with steady traffic.

  • Up to 5 websites
  • API access
  • WordPress plugin
  • Standard dashboard
  • 10,800 requests/hour total
Choose Standard

Standard Plus

€100/month

For the same Standard features with higher hourly volume.

  • Up to 5 websites
  • API access
  • WordPress plugin
  • Standard dashboard
  • 40,000 requests/hour total
Choose Plus

Premium

Custom

For high-volume environments and reputation data use cases.

  • Custom traffic volume
  • API access
  • WordPress plugin
  • Standard dashboard
  • Reputation feed
  • Priority support
Contact sales
About

Built for server-side control, not black-box blocking.

BotDetect is built around a simple principle: your application should receive a clear score and reason, then decide what to do. That makes rollout safer and easier to audit.

Start with visibility, measure what would be blocked, then enable enforcement only where it makes sense.

Design principles

  • API-first and integration-friendly
  • Monitor-first deployment
  • Privacy-aware request metadata
  • Short-lived reputation, not permanent punishment
  • Clear reasons instead of opaque decisions
Ready to test?

Start by monitoring your traffic.

Connect your first site, collect decisions in monitor mode and switch to blocking when the data looks right.

Login to panelContact us