Scrapefighter
Round 1 · Early access
Scrapefighter detects scrapers and bots by how they behave, not by what they claim to be. Every visit gets a human-likelihood score at the edge, in a millisecond. What happens next is your call: serve, slow down, gate, or send a decoy.
No CAPTCHAs. No cookies. No keylogging. Verified search and AI crawlers are always recognised.
Detect
User agents lie and residential proxies hide the network. Hands do not. Pointer paths, touch drags, scroll rhythm, key presses and their timing, combined with the network context, produce a score and the features behind it. Explainable by design.
Decide
The score is yours to act on. Sensible defaults ship with every product; every one of them can be changed, per site or per page type.
Learn
Every request, score and action is logged: network, organisation, verified-crawler status, behaviour features. See who came for your content and what they got. The same data improves the detection.
For engineers
One endpoint. Send a behaviour sample and the request context, get back a human-likelihood score with the reasons. Drop it into your paywall, comment form, signup flow, rate limiter or firewall rules.
For sites on a hosting provider
Runs at your hosting provider's edge, in front of your site: it scores every visit and applies the actions you choose before the page reaches the client. Deploy from a template, configure in one policy file, no changes to your CMS.
Supported today: Cloudflare. More providers to follow.
isAccessibleForFree markup for search enginesFor everyone else
The same detection, installed from the plugin directory in minutes. Pick actions per post type, watch the dashboard, export the data. Works with any theme.
A small sampler collects coalesced pointer samples, touch positions, scroll cadence and key classes for a few seconds. Key classes only: arrow, page, space. Never the character.
Curvature, speed variation, sample timing, scroll rhythm, press durations and the network context produce a score, a verdict and the reasons. The rules live on the server, not in the page.
Each verdict maps to an action: serve, load progressively, slow the response, gate the rest behind a card, or send decoys. Defaults are ready on day one; all of them are yours to change.
Every visit, score and action is logged, with hashed addresses and no personal text. What we learn there feeds the next version of the rules.
No puzzles, no checkboxes, no cookie banner. Behaving like a reader is the test.
Addresses are stored only as keyed hashes. Keys are recorded as classes, never as text. Traces hold coordinates and timings, nothing else.
Verified crawlers are identified by published ranges and network ownership, never by user agent alone, and always get the full page.
The detection was built defending a ten-language health publisher with more than 1,500 pages against AI scraping fleets. It runs there today on every page, with every visit recorded. Scrapefighter is that detection, packaged for everyone else, and it is in early access: the principle is proven, the products are being shaped with the first users.