Add this script tag to your website's <head> section to enable bot protection:
<script src="http://localhost:8080/protect.js?key=YOUR_API_KEY"></script>
Copy the code above
Paste in your <head> tag
You're protected!
Detailed Analytics
Time Series Data
Attack Types Distribution
Decision Distribution
🌍 Geographic Distribution
Hourly Attack Patterns
Blocked / Suspicious / Allowed — Daily
Risk Score Distribution
Top Attacking IPs
| # | IP | Country | Attacks | % |
|---|---|---|---|---|
| Loading... | ||||
Top User Agents
| User Agent | Risk | Attacks |
|---|---|---|
| Loading... | ||
Top Detection Signals
What triggered each block/challengeRepeat Offenders
| IP | Country | Attacks | Last Seen |
|---|---|---|---|
| Loading... | |||
New vs Returning Attackers
Top Cities
Traffic by API Key
| Key Name | Total | Blocked | Challenged | Allowed | Block % | Last Seen |
|---|---|---|---|---|---|---|
| Loading... | ||||||
Attack Log
Training History
Trained Models
Label Sessions
Your API Keys
Manage authentication keys for your applications
How to Use API Keys
?key=YOUR_API_KEY
X-API-Key: YOUR_API_KEY
/api/protect/check
curl -X POST http://localhost:8080/api/protect/check?key=YOUR_API_KEY \
-H "Content-Type: application/json" \
-d '{"user_agent": "Mozilla/5.0", "ip_address": "8.8.8.8"}'
Rule Types
Block specific IP addresses or CIDR ranges (e.g., 192.168.1.0/24)
Block requests with specific user agent strings or patterns
Block traffic from specific countries using ISO codes (e.g., CN, RU)
Block traffic from specific hosting providers or ISPs by name (e.g., DigitalOcean, Hetzner)
Block requests to specific URL paths or patterns (e.g., /admin, .php)
Block requests from specific referring domains (e.g., spam-site.com)
Block by arbitrary HTTP header value (format: Header-Name:value)
Trigger action when an IP exceeds N requests in a time window (e.g., 10/60)
Rule Actions
Show block page. Request is rejected and logged.
Show proof-of-work JS challenge. Humans pass, bots fail.
Show CAPTCHA widget using your configured provider.
Skip ALL protection checks. Use to whitelist your own IPs, trusted crawlers, or internal services.
Custom Rules
Create and manage custom protection rules
Add Trusted IP
Choose Your Perfect Plan
All plans include full bot protection - upgrade for higher request limits
Payment Methods
Secure payment options for your subscription
Payment History
All your past transactions
| Date | Amount | Provider | Status |
|---|---|---|---|
| Loading… | |||
EMAIL NOTIFICATIONS
Recent Alerts
Latest security notifications
No alerts yet
You'll see notifications here when suspicious activity is detected on your protected websites
PROFILE INFORMATION
SECURITY
DANGER ZONE
Quick Start (30 seconds)
Add protection to your website in one line
Add this single line to your website's HTML, right before the closing </body> tag:
<script src="http://localhost:8080/protect.js?key=YOUR_API_KEY" async></script>- Tracks user behavior (mouse movements, clicks, typing patterns)
- Generates browser fingerprints
- Detects headless browsers and automation tools
- Validates all form submissions
- Monitors AJAX requests
Integration Examples
Framework-specific implementation guides
HTML / Static Sites
<!DOCTYPE html>
<html>
<head>
<title>My Protected Website</title>
</head>
<body>
<h1>Welcome</h1>
<p>This site is protected from bots.</p>
<!-- Anti-Bot Protection -->
<script src="http://localhost:8080/protect.js?key=YOUR_API_KEY" async></script>
</body>
</html>React / Next.js
// In your pages/_document.js or app layout
import Script from 'next/script';
export default function MyApp({ Component, pageProps }) {
return (
<>
<Component {...pageProps} />
<Script
src="http://localhost:8080/protect.js?key=YOUR_API_KEY"
strategy="afterInteractive"
/>
</>
);
}Vue.js
// In your main App.vue or index.html
<template>
<div id="app">
<router-view />
</div>
</template>
<script>
export default {
mounted() {
const script = document.createElement('script');
script.src = 'http://localhost:8080/protect.js?key=YOUR_API_KEY';
script.async = true;
document.body.appendChild(script);
}
}
</script>WordPress
// Add to your theme's functions.php
function add_antibot_protection() {
wp_enqueue_script(
'antibot-protection',
'http://localhost:8080/protect.js?key=YOUR_API_KEY',
array(),
null,
true
);
}
add_action('wp_enqueue_scripts', 'add_antibot_protection');Direct API Usage (Advanced)
For custom integrations, you can call our API directly from your backend:
Endpoint
POST http://localhost:8080/api/protect/checkRequest Headers
Content-Type: application/json
X-API-Key: YOUR_API_KEYRequest Body
{
"ip_address": "192.168.1.100",
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
"fingerprint": "abc123xyz789",
"behavioral_data": {
"mouse_movements": 150,
"click_count": 5,
"time_on_page": 12.5,
"keystroke_dynamics": [120, 85, 95, 110]
}
}Response
{
"decision": "allow", // "allow", "block", or "challenge"
"score": 0.87, // 0.0 (bot) to 1.0 (human)
"reasons": [],
"challenge_token": null
}Python Example
import requests
response = requests.post(
'http://localhost:8080/api/protect/check',
headers={
'Content-Type': 'application/json',
'X-API-Key': 'YOUR_API_KEY'
},
json={
'ip_address': request.remote_addr,
'user_agent': request.headers.get('User-Agent'),
'fingerprint': 'generated_fingerprint',
'behavioral_data': {
'mouse_movements': 100,
'click_count': 3,
'time_on_page': 8.2
}
}
)
result = response.json()
if result['decision'] == 'block':
return abort(403, 'Access denied')Yandex OAuth Token — Setup Guide
To connect Yandex.Metrica and push bad sessions automatically, you need an OAuth token with edit access to your counter.
Go to the Yandex OAuth authorization page and create a new token. You can do this directly from the link below.
Open Yandex OAuth Docs →The fastest way to get a token is via the Yandex OAuth debug page. Open the link below, log in with your Yandex account that owns the Metrica counter, and click Allow:
https://oauth.yandex.ru/authorize?response_type=token&client_id=05974b6d476b4de7b2d6a9a5b32ed223
After redirect, copy the access_token value from the URL and paste it into the OAuth-token field. The token starts with y0_ or AgAA.
The token must have access to Yandex.Metrica with edit rights (metrika:read + metrika:write). Without edit rights the system cannot push isBadSession=1 to visitor segments.
Tokens obtained via the debug method expire after 1 year. The system checks token validity daily and will email you when it expires. You can always re-enter a fresh token via Edit → Check Token in the YA/GOOGLE section.
Best Practices
✓ Do's
- Place the script tag at the end of your
<body>for best performance - Use the
asyncattribute to prevent blocking page load - Create separate API keys for development, staging, and production
- Monitor your Analytics dashboard regularly for attack patterns
- Set up email alerts for high-volume attacks
- Test your integration with our provided attack simulation tools
- Whitelist your office IP if you're testing from the same network
✗ Don'ts
- Don't hardcode API keys in public repositories
- Don't use the same API key across multiple unrelated websites
- Don't disable the script on forms - it's automatic and seamless
- Don't block based on IP alone - use our multi-factor scoring
- Don't set rate limits too aggressively - this can block real users
Your Referral Link
Share this link to earn commissions
Your Balance
Available to use or withdraw
Min. withdrawal: $5.00
Program Terms
How commissions work
How It Works
Commission History
Chat
Knowledge base chatbot widget for your website