Deploy and Host Angular SSR + WebDecoy Bot Detection on Railway

An Angular 22 app rendered on the server, with WebDecoy bot detection already wired into the Express server the Angular CLI generates. WebDecoy records the scrapers, AI crawlers, and automated tools requesting your pages, flags crawlers that fake their identity, and injects a hidden honeytoken link that only bots follow, including into streamed renders. Deploy it as a starting point, or copy what src/server.ts does into your own app.

About Hosting Angular SSR + WebDecoy Bot Detection

The template is a single Node.js service built from a public GitHub repo: Railway runs ng build and then the SSR server, with a /health route for Railway's healthcheck. It needs one variable: WEBDECOY_API_KEY, which you create for free at app.webdecoy.com under Settings, API Keys. The middleware starts in monitor mode, so detections are recorded and every request is still served. Railway's X-Forwarded-For holds the client address followed by its own edge address, so the server trusts two hops rather than one. Angular's host check is set up for Railway domains; if you add a custom domain, list it in the optional NG_ALLOWED_HOSTS variable. Without a key the app still runs, with local rules only.

Common Use Cases

See which AI crawlers and scrapers are reading your server-rendered pages, and which ones are forging a known crawler's user agent
Catch scrapers with a hidden honeytoken link that people never see or follow
Start in monitor mode, then switch to enforce and return a 403 to automated traffic once you trust what it flags

Dependencies for Angular SSR + WebDecoy Bot Detection Hosting

A free WebDecoy account and API key (app.webdecoy.com)
Node.js 22.12 or later (Railway's builder provides it)

Implementation Details

// src/server.ts
app.set('trust proxy', 2); // Railway: client, then Railway's edge

app.use(webdecoy({
  apiKey: process.env['WEBDECOY_API_KEY'],
  skipPaths: ['/health'],
}));

Prove it reports: curl -A "WebDecoy-Test/1.0" https://YOUR-APP.up.railway.app/ fires a detection labeled Test in your WebDecoy dashboard, excluded from stats and billing.

Why Deploy Angular SSR + WebDecoy Bot Detection on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Angular SSR + WebDecoy Bot Detection on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.