Scraping is hard to notice because it does not look like an attack — no exploit, no spike in errors, just someone reading your site faster than any human could.
The reason scraping is hard to block is that a scraper is, from your server’s point of view, a very well-behaved client: it requests pages that exist, follows links, and sends a valid User-Agent. What gives it away is not any single request but the shape of the traffic — no session depth, no assets loaded, no interaction, and an origin that does not match the browser it claims to be. ZeroBot scores that combination rather than pattern-matching on User-Agent strings, which is why a scraper that spoofs Chrome still scores as a scraper while a real visitor on a VPN does not.
any stack — the check is one HTTP call
Full endpoint reference and an interactive tester are in the API docs. Get a key from the free tier — no card required.
Whole pages and article bodies republished within hours, often outranking the original on the strength of a higher-authority domain.
Competitors and repricing tools watch your catalogue continuously, matching your prices and undercutting you the same day.
Any list you render — member directories, reviews, profiles — is a dataset to someone.
Crawlers that ignore robots.txt and pull your entire archive. Unwanted traffic you pay for in bandwidth and never see in analytics as anything meaningful.
No. Verified search engine crawlers are matched by reverse DNS, not by User-Agent string, so a scraper claiming to be Googlebot from a datacenter IP is caught while the real one is allowed.
A VPN is a signal, not a verdict. The score is composite, so a shared corporate IP with normal browsing behaviour scores low. Every block is logged with its reason so you can review and whitelist.
No. This check needs nothing on the page — the API call is made server-side. ZeroBot also offers browser fingerprinting as a separate, optional layer if you want it.
Free tier, real verdicts, and documentation with a built-in tester.
Get started free →