WebDecoy for Vercel

Product Introduction

1. Definition: WebDecoy for Vercel is a third-party security and observability integration designed for the Vercel platform. It functions as a specialized log analysis and bot detection service.
2. Core Value Proposition: It exists to provide Vercel users with unparalleled visibility into non-human, automated traffic—including web crawlers, AI bots, and scraping tools—without requiring any code modifications or application redeployments. Its primary value is in crawler identification, bot verification, and traffic monitoring for security and SEO insights.

Main Features

1. Vercel Log Drain Integration: WebDecoy connects directly to your Vercel project to set up a Vercel log drain. This allows it to ingest request-level data—including user agent, path, HTTP status, client IP, and TLS fingerprint—directly from Vercel's infrastructure. The setup is zero-code for Pro and Enterprise teams.
2. Crawler & Bot Fingerprinting: The service analyzes incoming traffic to identify automated agents. It goes beyond simple user-agent string parsing by verifying legitimate crawlers (like Googlebot) against their officially published IP ranges and detecting forged user agents used by malicious bots.
3. Passive Monitoring-Only Architecture: A key technical feature is its non-invasive approach. WebDecoy is a monitoring-only tool; it never blocks, challenges, or alters requests. It provides analytics and security intelligence without impacting site performance or user experience.
4. Middleware for Hobby Plans: For Vercel Hobby plan users who cannot use log drains, WebDecoy provides an @webdecoy/next npm package. Adding this middleware enables the same monitoring capabilities with a minimal code change.

Problems Solved

1. Pain Point: Invisible Automated Traffic. Traditional analytics tools (like Google Analytics) that rely on JavaScript execution fail to track crawlers and bots that do not run JavaScript, creating a blind spot in traffic analysis.
2. Target Audience: Vercel-based Developers, Site Reliability Engineers (SREs), and Marketing/SEO Managers. Specifically, teams building with Next.js on Vercel who need to audit bot traffic for security, understand crawl budget consumption, or monitor for content scraping.
3. Use Cases:
   • SEO Audit: Verify that search engine crawlers are properly accessing and indexing your site and identify crawl budget waste from spam bots.
   • Security Reconnaissance: Detect and log suspicious scraping bots or vulnerability scanners probing your application.
   • Traffic Analysis: Gain a complete picture of all server-side traffic, differentiating between human users and automated systems for accurate analytics.
   • Compliance & Logging: Maintain detailed logs of all access attempts for auditing purposes without implementing custom logging infrastructure.

Unique Advantages

1. Differentiation: Unlike traditional Web Application Firewalls (WAFs) or bot management services that focus on blocking, WebDecoy specializes in granular identification and reporting. It differs from analytics platforms by working at the infrastructure/log level, capturing all requests, not just JavaScript-enabled ones.
2. Key Innovation: Its zero-code deployment via Vercel Log Drains for Pro/Enterprise teams is a significant workflow advantage. The ability to deploy sophisticated bot detection by simply connecting an integration, without touching application code, reduces friction and operational overhead dramatically.

Frequently Asked Questions (FAQ)

1. Does WebDecoy for Vercel block bots or affect my site's performance? No, WebDecoy is a monitoring-only solution. It analyzes traffic from your Vercel log drain passively and does not intercept, block, or slow down any requests to your application, ensuring zero performance impact.
2. Can I use WebDecoy on a Vercel Hobby plan? Yes, but not via the log drain method (which requires Pro/Enterprise). Hobby plan users can install the @webdecoy/next middleware package to achieve the same bot detection and monitoring functionality.
3. What data does WebDecoy collect from my Vercel site? It receives request logs sent via the Vercel log drain, which typically include URL path, HTTP method, status code, client IP address, user-agent string, and TLS fingerprint. It does not collect personal user data or application payloads.
4. How does WebDecoy verify if a crawler like Googlebot is real? It performs reverse DNS lookups and cross-references the client IP address against the official crawler IP ranges published by companies like Google, Bing, and others. This confirms the legitimacy of the crawler and detects impersonation.
5. How do I remove WebDecoy from my Vercel project? Disconnecting the project within the WebDecoy integration interface will automatically delete the associated Vercel log drain and the three environment variables (WEBDECOY_SITE_KEY, WEBDECOY_SCANNER_ID, WEBDECOY_SENSOR_KEY) it created, ensuring a clean removal.