BotShield
Self-hosted bot detection for websites: a browser SDK, a Cloudflare Worker that scores every request, and an optional FastAPI service for server-side verification.
Source repositories
Project overview
BotShield is a self-hosted alternative to commercial bot-protection services. A small SDK collects a browser fingerprint and guards forms; a Cloudflare Worker scores each request on user agent, fingerprint, request age and rate, then answers allow, challenge or block. Everything runs in the site owner’s own Cloudflare account, on the free tier.
What I built
- 01
Built a TypeScript browser SDK with fingerprint collection, local detection and a one-line form-protection helper.
- 02
Wrote a Cloudflare Worker that scores requests and returns allow, challenge or block with the reasons behind the decision.
- 03
Added per-session and per-IP rate limiting at the edge, with an optional proxy mode in front of the origin.
- 04
Added an optional FastAPI service with a plugin system for custom rules and a /verify endpoint for logins, sign-ups and checkout.
Implementation notes
The Worker fits Cloudflare’s free plan (100,000 requests a day), so small sites get bot protection at no cost.
Guides cover WordPress, Webflow and custom backends, and Playwright integration tests exercise real headless browsers against the detector.
Technology stack
- TypeScript
- Cloudflare Workers
- Python
- FastAPI
- Docker
- Playwright
More open-source projects
Need a similar product?
Let’s discuss the workflow, website, or application you want to ship.