---
title: "Deploy Next.js + WebDecoy Bot Detection"
description: "Next.js app with WebDecoy bot and AI-scraper detection in proxy.ts"
category: "Starters"
url: https://railway.com/deploy/nextjs-webdecoy-bot-detection
---

# Deploy Next.js + WebDecoy Bot Detection

Next.js app with WebDecoy bot and AI-scraper detection in proxy.ts

**[Deploy Next.js + WebDecoy Bot Detection on Railway](https://railway.com/template/nextjs-webdecoy-bot-detection)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/nextjs-webdecoy-bot-detection/manifest.json

- **Creator:** Chris Portscheller's Projects
- **Category:** Starters

## Template content

### railway-nextjs-starter

- **Source:** WebDecoy/railway-nextjs-starter
- **Public domain:** Yes

## Documentation

# Deploy and Host Next.js + WebDecoy Bot Detection on Railway

A Next.js 16 app with WebDecoy bot detection already wired in. WebDecoy records the scrapers, AI crawlers, and automated tools hitting your routes, flags crawlers that fake their identity, and plants a hidden honeytoken link that only bots follow. Deploy it as a starting point, or copy `proxy.ts` and the link in `app/layout.tsx` into your own app.

## About Hosting Next.js + WebDecoy Bot Detection

The template is a single Next.js service built from a public GitHub repo and started with `next start`, with a `/health` route for Railway's healthcheck. It needs one variable: `WEBDECOY_API_KEY`, which you create for free at app.webdecoy.com under Settings, API Keys. Detection runs in `proxy.ts` (Next 16's name for middleware) in monitor mode, so detections are recorded and every request is still served. Railway's `X-Forwarded-For` holds the client address followed by its own edge address, so the proxy trusts two hops rather than the default one. Without a key the app still runs, with local rules only.

## Common Use Cases

- See which AI crawlers and scrapers are reading your pages and API routes, and which ones are forging a known crawler's user agent
- Catch scrapers with a hidden honeytoken link in the root layout that people never see or follow
- Start in monitor mode, then switch to enforce and return a 403 to automated traffic once you trust what it flags

## Dependencies for Next.js + WebDecoy Bot Detection Hosting

- A free WebDecoy account and API key (app.webdecoy.com)
- Node.js 20.9 or later (Railway's builder provides it)

### Implementation Details

```typescript
// proxy.ts
export default withWebDecoy({
  apiKey: process.env.WEBDECOY_API_KEY,
  trustProxy: 2, // Railway: client, then Railway's edge
  rules: bait ? [tripwire({ paths: bait.activePaths, includeDefaults: false })] : [],
});
```

Prove it reports: `curl -A "WebDecoy-Test/1.0" https://YOUR-APP.up.railway.app/` fires a detection labeled Test in your WebDecoy dashboard, excluded from stats and billing.

## Why Deploy Next.js + WebDecoy Bot Detection on Railway?


Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Next.js + WebDecoy Bot Detection on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.


## Similar templates

- [open-excalidraw](https://railway.com/deploy/open-excalidraw) — Self-hostable collaborative drawing built on Excalidraw
- [caring-vibrancy](https://railway.com/deploy/caring-vibrancy) — Deploy and Host caring-vibrancy with Railway
- [Appsmith](https://railway.com/deploy/appsmith-1) — Low-code platform for internal tools, dashboards, and admin panels.

Open this page in a browser: https://railway.com/deploy/nextjs-webdecoy-bot-detection