Bots don't belong on your site.
Bot detection, No JS. No CAPTCHAs.
Thunderhead is a lightweight reverse proxy that silently scores every incoming HTTP request 0–100. Bots get tarpitted or blocked. Humans never notice.
Silent observation.
Graduated response.
Thunderhead never interrupts real users. It watches how clients move through your site and builds an intent score from passive signals — no fingerprinting, no cookies, no third-party calls.
Request pipeline
Every request enters the proxy, gets scored, and is dispatched to one of three actions — all within a single hop.
Signal weights
Five passive signals are sampled per request. Each contributes an additive score. No single signal is decisive — the combination is what matters.
Score thresholds
The final score determines the action tier. Thresholds are configurable in config.json — tune them for your traffic profile.
Every decision is a log line.
Thunderhead emits structured JSON for every request. Pipe it to your existing stack or just jq.
Everything you need.
Nothing you don't.
Thunderhead is deliberately minimal. A single binary, a single config file, and a scoring engine that runs entirely in-process — no sidecars, no databases, no SaaS.
No JS challenges. No CAPTCHAs. No interruptions.
Thunderhead never touches the client. It reads five passive signals from the raw HTTP request — headers, path patterns, request rate — and scores silently in the background.
Three tiers of action
Not every suspicious request deserves a hard block. Tarpitting drains bot resources without revealing detection. Tune thresholds to fit your traffic.
Structured JSON logs
Every decision emits a log line with IP, path, score, action, and which signals fired. Pipe to Grafana, Loki, or jq.
IP, CIDR & user-agent bypass
Lock out entire CIDR ranges or allowlist trusted crawlers by user-agent. Googlebot never gets tarpitted.
Single config file
One JSON file controls listen address, upstream URL, score thresholds, tarpit delay, and log output. No env vars required.
What's shipping next
Dashboard UI, JS challenge mode, and a Go middleware library are in active development. Core detection is stable and production-ready.
Up and running
in 60 seconds.
Thunderhead sits in front of any HTTP upstream. No code changes to your app required — just install, configure, and run.