








Thunderhead
A lightweight reverse proxy that scores the intent of incoming HTTP requests to detect and mitigate bot traffic - without relying on Cloudflare or third-party services.
- โ Sits in front of any web app and passively scores each request's intent instead of relying on JS challenges or CAPTCHAs that hurt real users
- โ Combines multiple behavioral signals - crawl patterns, request rate, header anomalies - into a single 0-100 score to tell bots from humans without a single hard rule
- โ Responds proportionally to risk: lets low-score traffic through, slows down suspicious requests with a tarpit, and only blocks outright once a request is clearly malicious

























