Scrapefighter
Round 1 · Early access
Scrapefighter detects scrapers and bots by looking at how they behave rather than at what their software says it is. Every visit gets a score for how likely it is to be a person, calculated at the edge in a millisecond. You then decide what the visitor gets: the normal page, a slower response, a gated page, or a decoy.
It uses no CAPTCHAs, no cookies and no keylogging. Verified search engine and AI crawlers are always recognised.
Detect
A user agent can be faked and a residential proxy can hide where a request comes from, but the way a person's hand moves a mouse or a finger cannot be faked in the same way. Scrapefighter looks at pointer paths, touch drags, scroll rhythm, key presses and their timing, together with the network context, and produces a score along with the features that led to it, so every score can be explained.
Decide
You decide what to do with the score. Every product comes with sensible default actions, and you can change each of them for the whole site or for each page type.
Learn
Every request is logged with its score and the action taken, along with the network, the organisation, whether the visitor was a verified crawler, and the behaviour features. You can see who came for your content and what they were given. We use the same data to improve the detection.
For engineers
The API has one endpoint. You send a behaviour sample and the request context, and you get back a score for how likely the visitor is to be a person, together with the reasons. You can use it in your paywall, comment form, signup flow, rate limiter or firewall rules.
For sites on a hosting provider
The edge package runs at your hosting provider's edge, in front of your site. It scores every visit, reports it to your dashboard, and turns confirmed scrapers away before the page reaches them, once you switch that on. You paste one file and add two keys, and you do not need to change your CMS.
Supported today: Cloudflare. More providers will follow.
isAccessibleForFree markup for search enginesFor everyone else
The plugin gives you the same detection and installs from the WordPress plugin directory in a few minutes. You choose an action for each post type, follow the results on a dashboard and can export the data. It works with any theme.
A small script in the page collects coalesced pointer samples, touch positions, scroll rhythm and key presses for a few seconds. For key presses it records only the kind of key, such as an arrow key, a page key or the space bar, and never which character was typed.
From the curvature of the movements, the variation in speed, the timing of the samples, the scroll rhythm, how long keys are held down and the network context, it calculates a rating and the reasons behind it. The rules are kept on the server and are not part of the page.
Each rating is linked to an action: serve the page as normal, load it progressively, slow the response down, gate the rest of the page behind a card, or send decoy content. Default actions are in place from the start, and you can change all of them.
Every visit, score and action is logged. Addresses are stored as hashes and no personal text is kept. What we learn from the logs goes into the next version of the rules.
There are no puzzles to solve, no checkboxes to tick and no cookie banner. A visitor passes simply by reading the page the way a person does.
Addresses are stored only as keyed hashes. Key presses are recorded only by their type, never as the text that was typed. The behaviour traces hold coordinates and timings and nothing else.
Verified crawlers are identified by their published address ranges and by who owns the network, never by the user agent alone, and they always receive the full page.
We built the detection to defend a health publisher, with more than 1,500 pages in ten languages, against fleets of AI scrapers. It still runs there today on every page, and every visit is recorded. Scrapefighter is that same detection, packaged so that other sites can use it. It is in early access, which means the approach has been proven in practice but we are still shaping the products together with the first users.