See every bot and AI agent. Then decide who gets in.
Every request sorted: humans, search crawlers, scrapers, scanners, AI agents, and bots posing as Googlebot. Observe first: nothing is blocked until you say so.
100K events a month. No card. A script tag, a plugin, DNS, or the PHP agent.
This is your visit on this page, not a mock-up.
Check your robots.txt
A plain GET against your domain. No account, no script. Every line of the answer is checkable.
Shows which AI crawlers your robots.txt allows, blocks, or never mentions.
Two traffic problems. Both invisible to GA4.
Traditional analytics only show you human traffic. The rest is quietly consuming your resources.
Bots are corrupting your data
Scrapers, headless browsers, and botnets inflate your sessions, poison your SEO signals, and eat your ad budget. GA4 cannot tell you they're there.
- Scrapers copying your content
- Headless browsers posing as visitors
AI agents are your next traffic source
GPTBot, ClaudeBot, Gemini: they're crawling your pages right now. When they cite you, you get traffic. But you can't optimize what you can't see.
- Which pages ChatGPT and Claude fetch
- Which AI-cited pages readers land on
- Which AI operators send you real visitors
This is the screen you open on Monday
This is what it produces: one week of a mid-size storefront, every request classified, every verdict explained. Numbers below are from our own demo workspace — no customer is named and nothing here is presented as somebody else's result.
Which assistants fetched your pages, and how many readers each one sent back. No DNS migration. Readers, not a request counter.
Demo workspace data. Your own numbers appear within a day of connecting, in observe mode, before anything is ever blocked.
Four gates, in the order a request meets them
With DNS or the Agent, every request is checked before your application is reached — no redirect, no round trip, nothing for a real visitor to wait on.
-
Is this who it says it is?
Network & crawlers. IP reputation and threat feeds, verified crawler bypass, and fake-crawler detection by rDNS mismatch.
In the demo googlebot rDNS verified Allow -
Is this the same visitor as before?
Session validation. An HMAC-signed session cookie, TLS / JA4 fingerprint continuity (with DNS or Cloudflare), and a silent re-vouch on IP change within a 150 ms budget.
Stops Copied session tokens and replayed sessions -
Can it run a real browser?
Challenge barrier. Invisible proof-of-work, with difficulty set by a 0–100 risk score, and your own rules to block, challenge or observe.
In the demo headless-chrome No JS telemetry Challenge -
Does it act like a scraper?
Behavioural traps. Invisible honeypot links, a stateless pixel that tracks asset loading, and detection of token copiers and HTML-only scrapers.
In the demo 203.0.113.44 Honeypot hit Block
A plugin
-
WordPress
The PHP agent
-
Laravel
-
PHP
-
Drupal
A script tag or DNS
-
Shopify
-
Next.js
-
Django
-
Node.js
-
React
-
Vue
Already on Cloudflare? Botscope runs alongside it.
A WAF decides whether a request is dangerous. Botscope decides who the client is and what it is doing with your content — including the AI assistants that are now a traffic source rather than a threat. The two run side by side.
Cloudflare is better at stopping floods, and we do not replace it. Behind its proxy, Botscope connects as a Worker and sees less: only whoever terminates TLS sees the client's JA4 fingerprint. For the full stack, put Botscope on the edge and keep Cloudflare for DNS.
Read the full comparison with Cloudflare →Everything is free. You pay for volume.
Every feature, up to 100K events a month. Past that, add 100K blocks — or drop back to free any month.
No card. Start on the free 100K and add blocks when you outgrow it.
Per 100K block
Included free, and at every size
Each band is charged at its own rate. Increases apply immediately; decreases at your next renewal, nothing refunded or owed. One billable event = one telemetry record stored (typically one protected HTTP request).
See what's really on your site. Free, in minutes
No credit card, and no expiry. Every feature on every account, free up to 100K events a month. Connect with a script tag, a plugin, DNS, or the PHP agent — you pay only if you outgrow it.