Understand the AI traffic reaching your WordPress site. WebDecoy shows which known bots and AI crawlers visit, how often they appear, and whether a supported crawler’s identity is verified, claimed or failed. See local counts in your WordPress dashboard and the per-bot breakdown in Statistics, witho
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.1 and PHP 7.4.
SourceWordPress plugins · Nov 13, 2026
01 / Source details
Aboutthistool.
Understand the AI traffic reaching your WordPress site. WebDecoy shows which known bots and AI crawlers visit, how often they appear, and whether a supported crawler’s identity is verified, claimed or failed. See local counts in your WordPress dashboard and the per-bot breakdown in Statistics, without creating an account.
Use that visibility to choose what should be allowed. WebDecoy also protects against spam submissions, fake registrations, login abuse and WooCommerce card testing. Monitor mode is the default, so you can review activity before enabling blocking.
Free and local. No account or API key is needed for local detection and crawler counts. WebDecoy Cloud is optional. Local crawler counts include requests that reach WordPress PHP; cached pages served before PHP are outside that view.
Watch the local AI traffic test (24 seconds)
In this controlled localhost test, two requests claim GPTBot and one claims ClaudeBot. WebDecoy counts all three and keeps their identities marked as User-Agent claims, with zero verified identities. A normal-browser control adds no crawler count. These are synthetic requests, not visits from AI vendors.
See screenshot 8 for the actual dashboard. Local crawler counts are free, with no account or API key. Open Dashboard for 24 hours or Statistics for 7 days. Cached responses that never reach PHP are outside this view. Start in monitor mode while checking your normal site flows.
See which bots and AI crawlers read your site
Most site owners have no idea how much of their traffic is GPTBot, ClaudeBot, Bytespider, or something pretending to be Googlebot. WebDecoy tells you, with no account:
Dashboard widget : known bot visits in the last 24 hours, with AI crawlers and agents counted separately, and the busiest bots by name
Verified or just claimed : Googlebot, Bingbot, Applebot, DuckDuckBot, Yandex, Baidu and the major social crawlers are checked with reverse and forward DNS. A visitor that claims to be one of them from someone else’s address is flagged as an impersonator. Every other bot is labelled as identified by its User-Agent only, so you know how far to trust the name.
Statistics page : every known bot from the last 7 days, with its operator, its type (AI training crawler, AI search crawler, AI agent, search engine, SEO tool, scraper and more) and its verified, claimed and failed counts
Named from a shared registry of more than 180 crawlers, AI agents and bot tools, the same one the WebDecoy dashboard uses
One switch to refuse AI crawlers (Settings > Good Bots), with search engines unaffected
Only a count per bot per hour is kept: no IP addresses, no pages, and nothing about human visitors. Pages served from a page cache never reach WordPress, so the counts are minimums.
Stop WooCommerce card testing and fake orders
Card-testing bots run stolen card numbers through your checkout. You pay a gateway fee for every attempt, your decline rate climbs until the processor takes notice, and real orders drown in the noise. WebDecoy watches checkout the way a fraud analyst would:
Velocity limits per address (configurable attempts per time window)
Card-testing pattern detection: small amounts, rapid succession, repeated declines across more than one card
A hidden decoy coupon code that only bots ever find and apply
Works with both the classic checkout and WooCommerce Blocks
Checkout bot signals from the last 24 hours, right on your WordPress dashboard
Suspicious checkouts are refused and recorded, not silently allowed. And by default the whole plugin runs in monitor mode, so you can watch exactly what it would have done before you let it act.
Why WebDecoy?
Zero friction : humans never see CAPTCHAs or challenges
Zero configuration : install, activate, done
Zero dependencies : everything runs locally on your server
Deception, not just filtering : hidden tripwires and honeytokens that only bots can touch, so a catch is a certainty, not a guess
Free forever : full protection at no cost. Premium cloud features are optional.
Deception: the zero-false-positive layer
Most security plugins guess whether a visitor is a bot from signatures and scores. WebDecoy also sets traps that no legitimate visitor can trigger:
Tripwires : hidden honeypot paths that only crawlers and scanners request
Honeytoken links : invisible decoy links injected into your pages; following one is a deterministic bot signal
Deceptive responses : fake .env, wp-config, SQL dump, and phpinfo responses seeded with per-site canary credentials; anyone who uses those credentials is flagged as critical
WordPress-native traps : fake vulnerable-plugin paths, an optional XML-RPC trap, and an author-enumeration canary
WooCommerce honeytoken coupon : a hidden decoy coupon code; applying it at checkout is proof of a bot
A visitor that touches a trap was not browsing your site. That is what makes deception the highest-confidence signal in the plugin: it does not need to guess.
An invisible reCAPTCHA alternative
Every form WebDecoy protects works without a visible challenge. Instead of asking humans to prove themselves, it asks the browser: an invisible SHA-256 proof-of-work challenge solves itself in the background in under a second for a real visitor, while bots and automation frameworks stall or fail. If you came here looking for a CAPTCHA alternative or an invisible reCAPTCHA replacement for comments, login, or registration, that is what this is: the same protection with none of the traffic-light puzzles, and nothing about your visitors sent to a third party.
Block fake registrations and comment spam
Registration spam and comment spam are the same disease: automation pointed at your forms. WebDecoy puts invisible honeypot fields on comment, login, and registration forms, scores each submission’s behavior, and adds login brute force protection with rate limiting on top. Real visitors notice nothing; the fake accounts and spam comments stop arriving.
Free Features (No API Key Needed)
Deception & Traps * Tripwires on hidden honeypot paths (on by default) * Auto-injected honeytoken decoy links * Deceptive fake-file responses with canary credentials * WordPress-native traps and author-enumeration canary * WooCommerce decoy coupon
Invisible Proof-of-Work Challenges * SHA-256 challenges solved in background (no user interaction) * Challenge mode for suspicious requests (checkbox widget, auto-solves) * Difficulty scales based on threat signals * No external CAPTCHA service needed
Form Protection * Comment spam protection * Login brute force protection * Registration spam prevention * Invisible honeypot fields on comment, login, and registration forms
Local Dashboard & Analytics * Detection log with threat scores and MITRE tactic mapping * Statistics page with 30-day trend charts * Blocked IPs management * Dashboard widget: bots seen in the last 24 hours, checkout bot signals, threat overview * CSV export * Automatic data cleanup (30 days)
Smart Bot Recognition * More than 130 known good bots recognized and allowed * Search engines, AI crawlers, social media, monitoring services, SEO tools, feed readers * Local counts of every known bot visit, verified, claimed or failed * Optional AI crawler blocking * Custom allowlist support
Private by design: 100% local, GDPR-friendly
Until you deliberately connect a WebDecoy Cloud account, the plugin makes zero external connections :
No visitor IP addresses sent to external servers
No US data transfers and no third-party data processor to disclose
No third-party cookies and no external CAPTCHA service
No CDN-loaded scripts (even Chart.js for the admin charts is bundled locally)
Detection data lives in your own WordPress database and is cleaned up automatically after 30 days (configurable). If you build privacy-conscious or GDPR-focused sites, this is the architecture you have been filtering for: cloud CAPTCHAs and cloud WAFs make your visitors someone else’s data; WebDecoy keeps them yours.
Built for agencies: configure everything in code
Agencies do not click through wp-admin on 80 client sites. WebDecoy is fully controllable from a deploy script:
wp plugin install webdecoy --activate wp webdecoy config set mode monitor wp webdecoy allowlist add 203.0.113.7 wp webdecoy status
The wp webdecoy command covers status, every safe setting ( config list ), the IP allowlist (whitelist your agency VPN across every client site in one loop), and log flushing.
Settings you never want a client to change live in wp-config.php:
WEBDECOY_DEFAULT_MODE (‘monitor’ or ‘block’): forces the mode and locks the admin toggle
WEBDECOY_HIDE_ADMIN_UI (true): hides the WebDecoy menu, dashboard widget, and notices from the client’s view
And because monitor mode is the default , baking WebDecoy into your boilerplate cannot break a client site on day one: it detects, logs, and reports everything but blocks nothing until you decide otherwise.
Premium Features (Optional WebDecoy Cloud)
Connect an API key to unlock cloud-powered intelligence:
WAF Integrations : arm your existing edge. From your WebDeco
See it in action
Screenshots & previews.
Protection settings: configure detection and blockingStatistics page: 30-day detection trends and threat distributionDetections log: view threats with scores and MITRE tacticsBlocked IPs: manage blocked addresses with expirationDashboard widget: threat overview at a glanceWebDecoy Cloud: optional premium featuresWooCommerce checkout protection settingsLocal AI traffic dashboard: controlled test with 3 synthetic crawler claims, 0 verified identities and no cloud account. GPTBot 2; ClaudeBot 1. Counts cover requests reaching PHP.
02 / Source details
Gettingstarted.
01Upload the webdecoy folder to the /wp-content/plugins/ directory, or install directly from the WordPress plugin repository
02Activate the plugin through the ‘Plugins’ menu in WordPress
03That’s it! Protection is active immediately with sensible defaults
Optional: Connect to WebDecoy Cloud
04Go to WebDecoy > Settings > WebDecoy Cloud tab
05Click Connect to WebDecoy Cloud . You approve the connection on app.webdecoy.com and are returned automatically; your API keys are provisioned for you
06Prefer manual setup? Expand Advanced: manual configuration and enter an API key from your WebDecoy dashboard
07Cloud features (threat intel, VPN detection, etc.) activate automatically
03 / Source details
Frequently asked questions.
Who builds WebDecoy?
A team of security engineers who do bot detection full time, across more than WordPress. The detection engine in this plugin is the same one that runs in our Node.js SDK, our Cloudflare edge validator, and the WebDecoy cloud platform; the WordPress rules engine is kept byte-for-byte compatible with the Node implementation by a shared test suite. The plugin is free and fully functional because detection is the half of the problem we give away: the paid product is the network response built on top of it.
Is WebDecoy an invisible reCAPTCHA alternative?
For most sites, yes. WebDecoy protects comment, login, and registration forms with invisible honeypot fields, behavioral scoring, and a background proof-of-work challenge, so real visitors never solve a puzzle, pick out traffic lights, or click a checkbox. If a request looks suspicious, the challenge runs silently in the browser instead of interrupting the person. And unlike reCAPTCHA, nothing about your visitors is sent to a third party.
Does it stop comment spam and fake user registrations?
Yes. Comment, login, and registration forms get invisible honeypot fields and behavioral scoring out of the box, all on by default. The plugin starts in monitor mode, recording what it would have done; switch blocking on and spam that scores above your threshold is challenged or blocked before it reaches your moderation queue.
Do I need Cloudflare or a WAF in front of my site?
No. WebDecoy runs entirely inside WordPress, so it protects sites on any host with no DNS changes, no proxy, and no subscription. If you were weighing WAF options, it works as a WAF alternative at the application layer, and it sees things a network WAF cannot: which form was submitted, which coupon was applied, which hidden trap was touched. It also works fine behind Cloudflare or another proxy if you already have one. On paid plans the relationship inverts: WebDecoy can push confirmed attackers to your Cloudflare or AWS WAF so they are blocked at the edge before reaching WordPress at all.
How is WebDecoy different from a firewall or malware scanner?
Firewalls match requests against known-bad signatures, and scanners look for infections after the fact. WebDecoy adds a third approach: deception. It plants traps (hidden paths, invisible links, decoy files, a decoy coupon) that no legitimate visitor can touch, so when a trap fires there is no doubt. It works alongside your existing firewall or scanner, and on paid plans it can push confirmed attackers to Cloudflare or AWS WAF.
Do I need an API key?
No. WebDecoy works 100% locally without any API key or account. All detection, blocking, rate limiting, form protection, and WooCommerce protection works out of the box. The API key is only needed for optional cloud features like IP reputation and VPN detection.
What does WebDecoy Cloud add?
WebDecoy Cloud adds threat intelligence feeds (AbuseIPDB, VPNAPI, MaxMind), centralized monitoring across multiple sites, a monthly email report, webhook automation, and WAF integrations: from your dashboard, confirmed attackers can be pushed to Cloudflare or AWS WAF so they’re blocked at the edge, before ever reaching your server. Compare plans .
Does WebDecoy slow down my site?
No. WebDecoy adds less than 5ms of latency to requests. Server-side detection runs in milliseconds. The client-side scanner loads asynchronously with the defer attribute and doesn’t block page rendering.
Will it block legitimate visitors?
WebDecoy is designed to minimize false positives. You can adjust the sensitivity and blocking threshold. Start with “Log only” mode to monitor before enabling blocking. Good bots (Googlebot, Bingbot, etc.) are automatically recognized.
Does it work with caching plugins?
Yes. WebDecoy works alongside popular caching plugins. The client-side scanner runs after page load, and server-side checks happen before caching.
What about search engine bots?
WebDecoy automatically recognizes and allows more than 130 legitimate bots including Googlebot, Bingbot, and other search engine crawlers. Good bot verification uses reverse DNS lookup. Your SEO won’t be affected.
Can I see which AI crawlers visit my site without an account?
Yes. The WebDecoy widget on your WordPress dashboard shows known bot visits from the last 24 hours, with AI crawlers and agents counted separately, and the Statistics page lists every known bot from the last 7 days. Search engine crawlers are checked with reverse DNS, so you can tell a real Googlebot from an impersonator. It is counted on your own server; no account is needed and nothing is sent anywhere.
Can I block AI training crawlers like GPTBot and ClaudeBot?
Yes. WebDecoy identifies AI training crawlers and AI agents (GPTBot, ClaudeBot, Bytespider, CCBot, and others) and lets you block them with one setting, without touching robots.txt and without affecting search engine crawlers. AI search crawlers such as PerplexityBot and OAI-SearchBot are treated like search engines and stay allowed. Enable this in Settings > Good Bots.
Does it work with WooCommerce?
Yes. WebDecoy includes specialized carding protection for WooCommerce including checkout velocity limiting, card testing detection, and automatic fraud blocking. Compatible with both classic checkout and WooCommerce Blocks.
Is my data secure?
Without an API key, the plugin makes zero external connections : visitors’ browsers never contact third-party servers, and neither does your server. Chart.js (admin charts) is bundled with the plugin. All detection data stays on your server, and detection logs are automatically cleaned up after 30 days. When you optionally connect WebDecoy Cloud, all communication is encrypted over HTTPS (see External Services below).
How does the proof-of-work challenge work?
When a suspicious visitor is detected and your block action is set to “Challenge”, they see a checkbox widget. Clicking it starts a SHA-256 puzzle that solves in the background (typically under 1 second for humans). Bots and automation tools take much longer or fail entirely. No external CAPTCHA service is involved.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
