NiceTryBot REAL HUMANS ONLY
Features How it works Marketplace Pricing Developers
Deploy now

Features

Everything a bot would rather you didn't have.

The free core does the heavy lifting. Free add-ons extend it, and premium add-ons take a licence key per installation. A quick tour first, then the whole list.

Jump to the full chart

The edge

A proxy that pays attention.

The edge is a Caddy build that sits in front of your sites. It issues certificates on demand, passes traffic to your origin, and writes down everything it sees.

  • TLS and HTTP fingerprints (JA3, JA4, JA4H) on every request
  • Client hints kept and checked against what the browser claims
  • Probe paths tagged as they land: .env, wp-admin, .git, phishing kits
  • Preview hostnames for every domain, so you can test before you switch DNS

Traffic views

Every request, every 404, every country.

Activity shows requests as they land. Analytics shows where they came from, where they went and what they were after.

  • Live activity with filters on any field
  • Not Found: the paths scanners keep asking for
  • Flows, maps and per-domain stats
  • Spoofed and outdated browsers spotted from their TLS and client hints

Rules

Decisions you can read out loud.

A rule is a few lines: which traffic, and what happens to it. Every verdict records the rule that made it.

  • Match on path, country, network, fingerprint, client traits and tags
  • Backtest a rule on past traffic before it goes live
  • Observe a domain first, enforce when you trust it
  • Bans that expire on their own

The gym

Somewhere for bots to burn off energy.

Instead of a block page, suspicious traffic gets a workout. Routines chain obstacles together, and every step is recorded.

  • Waiting rooms with ramped waits
  • Captcha obstacles (with the Captchas add-on)
  • Every step recorded, so you see who gave up where
  • Hand-offs back to your site for the people who pass

The whole list

Every feature, and where it lives.

The core comes first, then the add-ons. Open a group to see what's in it, or jump straight to one.

Core, in every install Free add-on Composer package, no key Premium add-on One licence key per installation
Feature Included with
Certificates on demand Let's Encrypt, with ZeroSSL as the fallback, issued only for hostnames you've verified or your app vouches for.
HTTPS everywhere Plain HTTP gets a 301 to HTTPS. HTTP/1.1 and HTTP/2.
TLS fingerprints on every request JA3 and JA4, logged and forwarded to your origin as headers.
Header fingerprint and client hints A JA4H-style hash of the request headers, plus Sec-CH-UA, platform and Accept-Language.
The real visitor IP behind Cloudflare CF-Connecting-IP is trusted only from Cloudflare's published ranges.
Country, region, city and network Looked up at the edge from DB-IP, refreshed monthly.
Looks like nginx Server: nginx, nginx-style error pages, nothing a visitor sees names NiceTryBot.
Probe paths tagged as they land .env, .git, wp-login, phpmyadmin and the rest, marked before your origin answers.
PHP upload guard Multipart bodies carrying the PHP session-upload exploit get a 403, cut off as they stream.
Origin pass-through Routes polled every 30 seconds, and a new hostname is looked up on its first request, so sites go live without touching config.
WebSockets pass through
Single-request rules judged at the edge The verdict lands on the request that earns it. The app re-checks every one, so an edge slip costs a round trip, never a wrong verdict.
The gym served in place The workout appears at the URL the visitor asked for; the address bar never changes.
Fails open If the edge can't reach the app, visitors go to your origin. Polled lists are kept when the app is unreachable.
Live tail Requests to a hostname you're watching reach Activity within seconds.
Logs redacted on the node Query strings dropped, no cookies or auth headers, then shipped as gzipped NDJSON and imported every minute.
Lockdown served from memory Locked sites answer 503 for any method with nothing reaching the origin, and stay locked through a restart.
Request and response capture Only on routes you pick, redacted on the node before anything leaves it.
Watchwords matched on the node Only the email's domain, the password's length and which watchwords hit are reported, never the values.
Add a domain Hostname, origin URL, www or not, host-header mode, forwarded-host headers.
Verify ownership A TXT record at _nicetrybot.<host>, or your app vouches for the hostname when the edge asks.
Preview hostname before DNS moves <host-with-dashes>.web-preview.xyz serves the site through the edge, and the origin's redirects point back at the preview.
DNS guidance and check A CNAME or A record to the edge, and a live lookup of where your records point now.
Off, Observe, Enforce Proxy and log only; tag suspicious traffic but let it through; send tagged traffic to the gym.
Pause and resume protection Traffic still flows to the origin while paused.
Origin settings per domain Timeout from 5 to 120 seconds, host header passed or rewritten, up to 4 forwarded-host headers, HSTS, browser caching for assets, www as the same site.
Origin lock Every edge request carries a secret header your origin can require. Rotate it any time.
Server header disguise Choose what the Server header says, for example an old Apache, to make a honeypot more tempting.
Last 24 hours on the domain page A mini chart with links into Activity and 404s.
Sample traffic Fill an empty domain with 7 days of fictional requests to try the views.
Remove a domain with its history
Stand-in hostname for demos Each domain gets a made-up name to show instead, and a button to pick another.
Overview Requests, tagged, 404s and kept off your origin versus the previous period, the busiest domains, the latest catches and the top 404s.
Every request, every verdict Search in the rule language, GROUP BY and HAVING included, or paste an IP, CIDR or JA4 for an exact filter.
Quick filters Domain, status, edge action, spoofed or outdated client. Hide your own traffic, assets, probes or GET /.
Periods and zoom From 1 minute to 30 days, bars from a second to a week, drag on the chart to narrow to a stretch.
Requests, Clients and Paths views Clients are grouped by IP and TLS fingerprint.
Saved searches shared with the team
Live tail Ten minutes of requests streamed from the edge.
CSV export Up to 5,000 requests or paths.
From search to rule Turn the current search into a draft TAG rule.
Name a client Label an IP, fingerprint, user agent or client hints for the whole team, or mark it as your own traffic and hide it.
IP neighbourhood Requests from the /24, /16 and /8 around an IP over 24 hours.
Request evidence Decoded JA4, JA3, JA4H, client hints, language, timing, verdicts in force with Lift, and the gym outcome.
Re-categorise a path by hand
Spoofed and outdated clients iOS user agents on Chrome's TLS, Chrome without client hints, platforms that disagree, browsers years behind. Corporate proxies are exempt.
Hosting networks named Two dozen providers' networks, AWS to Hetzner, marked on every row.
Verified crawler ranges GPTBot's published ranges, refreshed daily, shown as a Verified badge.
Path categories Fifteen: credential, source, config, admin, CMS, SaaS, phishing, AI-agent, exploit, API and shell probes, plus the kinds of asset.
Breakdowns By network, country, user agent, TLS fingerprint or path category, each row linking into Activity.
Flows Sankey diagrams: network to fingerprint to user agent, country to network to outcome, and visitor journeys.
Stats Requests per second and per minute with peaks, 15 minutes to 7 days, auto-refreshing.
Live map A world map of requests flying to the edge, with the kind of path each one asked for.
404s Scanner probes, browser assets and missing pages, with the most-requested paths and who asked.
Tags & bans Every tag and ban, searchable by IP, CIDR, fingerprint or the name you gave. Lift one, some or all.
"It's you" warning A badge when one of your rules holds the IP you're browsing from, with Lift mine.
Devices beside each client What was seen behind an IP and TLS fingerprint, linked to the Fingerprints page.
Captured responses in request details A "response captured" mark with the response itself, and "Capture this route" on the rest.
Threat strip on key pages The green-to-red grades, on the pages you look at most.
Redacted view for screen sharing
Plain English to filters Type a question and get the search, period, client filter and view back, ready to tweak.
Ban or tag BAN or TAG an IP, a TLS fingerprint or both, for seconds to weeks or forever.
Client fields ip (with CIDR), ja4, ja4.alpn, ja3, ua, ja4h, hints, client (spoofed, outdated, corporate), lang.
Request fields host, path, category, status, method, duration, action, tag.
Network and place fields asn, network, network.kind (hosting), country, region, city.
Operators =, <>, <, >, LIKE, IN, IS NULL, and AND, OR, NOT with parentheses.
Patterns over time WITHIN a window of up to 24 hours, HAVING COUNT(*) or COUNT(DISTINCT …), with FILTER.
UNTIL Lift a verdict early the moment the client does something that proves it, like signing in.
Live parse and plain English Errors by line and column, and a "Reads as" sentence of what the rule does.
Starter templates Probe scanners, multi-host 404 sweep, a browser name on script TLS, datacenter burst.
Backtest on 7 days Who it would have matched, how many are outside hosting networks, with a shared-IP warning.
Stale verdicts after an edit Verdicts the new version wouldn't reach are found and offered for lifting.
Runs every minute Over newly imported requests, and live at the edge for single-request rules.
Never retroactive A new rule doesn't ban anyone for what they did before it existed.
Active verdicts Subject, requests, last matched, expiry, and Lift.
Observe mode records without blocking
Send a rule's clients to the gym Pick a routine or make one; refused if it would change who else enters.
Response fields response and response.type, so a rule can read what your origin answered.
Failed-logins starter rule Tags a client that gets the same login error 3 times in 10 minutes.
Rule packs Curated, versioned rules and routines installed in one click, in observe mode: rules only tag, routines start off.
Scanners and 404 probes pack Secret hunters, admin probes that miss, wordlist sweeps, 404s across your sites. Scanners solve a proof-of-work puzzle before each page.
PHP exploit attempts pack Eval-stdin, PHP-CGI, Ignition, ThinkPHP, web shells and server-file reads. One request is enough; tagged clients get a 403 everywhere.
AI crawlers pack Training crawlers and answer engines by name, and the impostors probing under those names. Tags only.
Spoofed and outdated browsers pack Clients whose user agent, TLS and client hints disagree, headless Chrome, browsers years out of date. Waiting rooms and a thorough browser check.
Scripts on sign-in and forms pack curl, python-requests, Go and friends posting to forms, sign-in hammering, and repeated failed sign-ins with Request Monitor.
Pack updates keep your edits Update to a new version, or uninstall, and anything you changed stays yours.
Plain English to a rule Describe the traffic and get a rule, a name and a routine back with its backtest. Never saved on its own.
Proof of work A SHA-256 puzzle solved in a worker, 12 to 26 bits. Solves faster than any browser can hash are flagged.
Waiting room Back-to-back rounds for 10 to 300 seconds, light to heavy, with an optional countdown and your own headline. The server keeps the clock.
Type the code A noisy image code of 4 to 8 characters, no look-alikes. Too-fast answers and repeated misses are flagged.
Browser check Silent: the webdriver flag, headless hints, a missing Chrome runtime, no languages, a small window on a large screen. It flags, never blocks.
Captchas Bigfoot at Dusk, Firefly in the Field, Kinetic Word and Odd Walker Out. None can be solved from a screenshot.
The Captcha obstacle Pick one captcha or any at random, set a time limit; out of tries means turned away.
Who enters Match all or any of: network, country, browser, user agent, IP or CIDR, TLS fingerprint, domain, path category, path, rule verdict, edge tag.
Obstacle pipeline Drag to order, settings per obstacle, and an escalation when a step looks automated.
Exits Continue to their page with a pass, show a 404, or turn them away with a 403.
Passes From 1 minute to 1 week, or a one-try pass that allows a single form submission.
Backtest who would have entered Over the last 7 days.
Preview and Try it See each obstacle on desktop or phone, and walk the draft yourself.
Routines stack Each obstacle type runs once, the strictest exit wins, the shortest pass. Edits reach visitors at their next step.
Routine templates Not a mainstream browser, datacenter waiting room, probe scanners, flagged by your rules.
Test a visitor Type an IP, path, country, network and user agent, or pick a recent request, and see the pipeline it would get.
Hand-off back to your site Cleared visitors reload the URL they asked for with a signed pass. Background requests are told to reload the page.
Resume mid-workout A reload resumes the session, with a 15-minute idle limit.
Every step recorded Attempts, timings, flags, hashes, and which IPs and fingerprints took part. A change of IP marks a hand-off.
Seven-day stats Visitors trained, cleared, gave up or turned away, and bot CPU burned.
A contact and reference code for visitors "Having trouble? Contact … and quote reference …"
A JavaScript fingerprint per routine A quick, silent script on the first gym page, once per session.
Your own obstacles Implement the Obstacle contract, or ship one as an add-on.
Teams A personal team at sign-up. Create, switch, leave and delete teams.
Roles Owner, Admin, and read-only Member who can still save searches.
Invitations by email With a role, expiring after 3 days.
Sign-in security Email verification, password reset, two-factor codes with recovery codes, and passkeys.
Strong passwords in production 12 characters or more, mixed, checked against known breaches.
Light, dark or system theme
Your own Anthropic key Checked with Anthropic before saving and encrypted at rest. Only the question, the current search or rule and your hostnames are sent, never request records.
Retention per kind of data 1 to 730 days per team. Request log and gym visits 90 days, ended verdicts 30, by default.
Captchas Answers, with gym visits
Fingerprints 90 days by default
Request Monitor Flagged 30 days, others 1
Pruned every hour
Find a visitor By gym reference, IP or JA4: verdicts in force, with Lift, and gym visits.
Erase a visitor Requests, gym sessions, verdicts and labels. A JA4 erasure warns that a JA4 is shared by everyone on the same browser build.
Captchas Their answers too
Fingerprints Their fingerprints too
Request Monitor Their captures too
Erasure log Only a keyed hash, who asked, when, and how many records.
What's stored per request Path without its query string, method, status, timing, IP, user agent, JA3, JA4, JA4H, client hints, language, network, place, edge tag.
Cookies Only the gym's own two. No analytics or advertising cookies.
Data documents A data inventory, a DPA, lawful basis, a privacy notice and the subprocessor list ship with the code.
Seven daily reports Bot Weather, Fraud Desk, Most Wanted, The AI Key Heist, Cloud Landlords, Costume Party and Speedrun.
Aggregates only No customer hostnames, and IPs cut to their first half.
Past editions and trends Every edition by date, "vs the day before", new records, and 30-edition trend bars.
Animated covers and a JSON feed A GIF and a still for X, and a feed other sites can republish.
Failed logins on the Fraud Desk
Source available Elastic License 2.0. Run it on your own servers and read every line.
Add-ons are Composer packages They can add pages, nav, settings, gym obstacles, rule fields, templates, edge feeds, report metrics and their own retention.
Free add-ons
Premium add-ons
Install from Composer Free add-ons from Packagist; premium ones from our private repository with a token from your account.
Free add-ons
Premium add-ons
Licence keys Ed25519-signed and proven offline, one per installation covering every team, with a year of updates. A 14-day trial from first sight, and a daily check for revocation that fails open.
Premium add-ons
Switchboard An administrator turns an add-on off on every server without a deploy. Its data is still pruned and erased.
Admin section Add-ons and administrators, installation-wide.
Health check at /up
Engage and lift Every request to a locked site, GET or POST, gets the maintenance page from the edge.
Lock everything, a pool, or one site Release sites one at a time; a per-site choice wins over its origin's.
The maintenance page A stock page with no branding, or your own HTML up to 256 KB with a live preview. Changes reach the edge in about 10 seconds.
Retry-After an hour So visitors and crawlers come back later.
IP allowlist IPs or CIDR ranges, IPv4 or IPv6, with Add my IP.
Signed passes A 12-hour pass to the real site from a link that expires in 5 minutes. Revoke every pass in one click.
Edge status Each node shows whether it has the latest.
One toggle, or Cmd+/ Stays on across pages.
Every hostname swapped Domains, preview hostnames and origin hosts become made-up names.
Hidden words Words you list are masked anywhere, even inside URLs, as dots or a replacement you choose.
No flash of real names The page stays hidden until the first pass has run, and keeps up with live updates and navigation.
One origin, any number of hostnames Shared settings copied to every site, and each site can override its protection mode.
Your app vouches for new domains An unknown hostname reaches the edge, your app says it's yours, and the site is live with its certificate.
www folded into the bare name Including its history, by hand or every hour.
Site groups by parent domain Turn www off per group; refused names never get a certificate.
Wildcard DNS guidance
Lock a whole pool at once Every site of an origin, including sites that join it later.
Bigfoot at Dusk A runner crosses a meadow and leaves no trail. Draw the route from memory so they reach the fence before Bigfoot does.
Firefly in the Field The same idea at night. Trace the firefly's path so the net can find it.
Kinetic Word A word written in motion. No single frame has any letters in it; type what you see.
Odd Walker Out Four clouds of dots, each hiding a walking figure. Point an arrow the way each one faces; a blind guess is 1 in 64.
Answers checked on the server The puzzle sent to the browser never contains the answer, and answers that come too fast are rejected.
How the hand moved Bigfoot and Firefly check the drawn shape and whether it was drawn like a hand draws.
How the word was typed Kinetic Word tells typed from pasted or filled in at once, and never reveals the word.
Mouse, touch or keyboard Kinetic Word adds an on-screen keypad.
Captcha collection page Every installed captcha, which routines use it, and Try it with answers checked for real.
Answers over time Passed, failed, spoofed, outdated and pass rate by captcha and period. Click a bar to see who answered then.
Drop-in modules A folder with a captcha.json is a captcha. Write your own and ship it as an add-on.
What it measures Canvas, WebGL, audio, font and maths hashes, GPU, screen, cores, memory, touch, time zone, languages, the webdriver flag and more.
Per-visit traits Window size, pixel ratio, user agent and the browser's own userAgentData, kept per sighting.
One fingerprint per device Changing traits are stored per sighting, so one device doesn't split into many.
Sealed and signed per session Field names renamed, payload scrambled and signed. Forged, edited or replayed payloads are refused, and the endpoint answers the same either way.
Browser claims cross-checked User-Agent and client hints against what the script saw. Disagreements are kept as mismatches.
Tied to its client IP plus TLS fingerprint, so one client showing several devices stands out.
Feeds the spoofed and outdated traits Sightings feed the same client traits your rules and Activity filters already use.
Fingerprints page Filter by hash, GPU, platform, time zone, IP, JA4, window and screen width, automation, mismatch. Group by TLS fingerprint, IP or client.
Open a fingerprint All its traits, its sightings, and the routines its visitors were in.
Ask in plain English With your own Anthropic key. Nothing it writes runs as SQL.
Captures on routes you pick One domain or all, a method, a path glob, optionally one Livewire component. 1 hour to 7 days, 100 to 2,000 responses, and every capture stops on its own.
What's kept Content type, a redacted excerpt and the size of the body. The edge masks passwords, tokens, CSRF values and emails first.
Also record what was sent Request bodies up to 64 KB, never uploads, redacted on the edge. Off by default.
Watchwords Email or username contains, password contains, and password is exactly, which is kept only as a hash.
Latest responses per capture
Feeds Threats Failed logins, watchword hits and leaked-password attempts.
Watch a page A name, method, path glob, optional Livewire component, one domain or all, and what a normal hour looks like.
Green to red Calm, Noticed, Elevated, High and Severe at 1×, 3×, 10× and 30× normal. One visit never colours a slot.
Any period from a minute to a month Slot length scales with the period.
What each slot counts Requests, distinct clients, failed logins, watchword hits and leaked passwords.
Now and Peak badges per monitor
Floors A watchword hit floors a slot at Elevated; a leaked-password attempt makes it Severe.
Threats With Request Monitor
Works alone Without Request Monitor, pages are graded on volume.

Add-ons marked "soon" are being packaged now. Everything else is what the code does today.

Start with the core. Add what you need.

Self-host it, watch what your traffic looks like, and snap on an add-on when the gym needs a new obstacle or you want to see inside a request.

Self-host it free Browse add-ons