Stop bad bots before they reach your application.
KillTheBots combines local request decisions, country filtering, IP intelligence, proxy/VPN/Tor detection, rate limiting, browser verification and transparent JavaScript challenges — in one Go agent you run next to Nginx.
Honest by design: KillTheBots reduces automated abuse and gives you the record to prove it. No filtering product stops every bot, and we never claim otherwise.
Request path
- VisitorHTTP request
- Nginxauth_request
- KillTheBots agentlocal decision
- AllowChallengeBlockOriginyour application
Requests inspected (6h)
32,244
- Allowed29,196 · 90.5%
- Challenged2,096 · 6.5%
- Blocked952 · 3.0%
Top reason codes
- Datacenter ASN8,421
- Rate limit exceeded5,112
- VPN detected3,980
- Tor exit node1,204
Core protection features
Every signal is configurable per site, and every decision is explainable through a reason code.
How it works
Five steps from install to enforcement. You control when filtering starts affecting traffic.
- Step 1
Install the local Go agent
One binary or one container next to your web tier.
- Step 2
Connect Nginx auth_request
Add a small location block that asks the agent for a decision.
- Step 3
Start in Insight
Nothing is blocked. Every decision is recorded as if protection were active.
- Step 4
Review the impact
Check reason codes, countries, routes and suspected false positives.
- Step 5
Choose protection
Use risk-based Protected or require every visitor to verify with Full Protection.
Where KillTheBots fits
KillTheBots is infrastructure-level filtering. It is not a CAPTCHA replacement for every use case — some flows still deserve an application-level verification step.
- Every request reaches the origin
- Credential stuffing hits your app logic
- Scrapers consume origin capacity
- No decision record
- Friction for real visitors on protected pages
- Applies at the application layer, after the request lands
- Limited context about network origin
- Little visibility into automated traffic patterns
- Decisions at the edge, before your application runs
- Country, IP, reputation, rate and route signals combined
- Challenge only when signals justify it
- Full reason-code record in every protection mode
Security and privacy by construction
Filtering decisions need network context, not personal data. The agent keeps sensitive material local and sends only what the dashboard needs to explain a decision.
Read the security model- No request body collection
- No application cookie collection
- No raw browser fingerprint stored in the SaaS
- Hashed or truncated network identifiers
- Signed policies and threat intelligence
Protect your first site
Create a site, install the agent, and start in Insight mode. You will see exactly what protection would have done before anything is blocked.