Flagship · Software

Pollen Trap

Defensive bot and scraper protection for website owners. Rule-based, starts in watch-only mode, and runs on a Cloudflare Worker or a Node.js server.

Download v0.1.1 Preview Read the limits

v0.1.1 Preview · Download

What it is

Protection that sits in front of your site.

Pollen Trap is rule-based software that you install on your own website. It looks at each request, applies your policy, and logs what it decided. It ships in watch-only mode, so nothing is blocked until you choose to enforce.

It is not an AI agent and not a desktop app. It doesn't use a machine-learning model. It's defensive only: it protects sites you own or are authorized to defend.

Version: v0.1.1 Preview
Runs on: Cloudflare Workers, or Node.js 24 on your own server
Default mode: Watch-only (log only)
Code license: MIT
Brand marks: Reserved by J&R Genetics LLC, not licensed by the MIT license

Features in this preview

What Pollen Trap does.

Watch-only first

Starts in log-only mode so you can see what it would do before it blocks anything.

Throttle, challenge or block

Rate limits, Cloudflare Turnstile challenges and 403 blocks when you switch enforcement on.

Trusted-bot allowlist

Keeps verified search crawlers you approve reaching your site. Never trusts a user-agent string alone.

Honeypot links

Hidden trap links that real visitors never follow. Bots that do are flagged.

Canary tokens

Unique markers you place in your content, then check authorized pages for copies.

Read-only owner console

A password-protected console and API for recent decisions and weekly reports.

Rate limits

Fixed-window request limits per visitor, using Cloudflare rate-limit bindings or the Node adapter.

Exact allow and block lists

Manual IP allow and block lists, plus a policy for self-identified AI crawlers.

Local reports

Weekly reports on the Worker, and a command-line report tool for Node logs.

How to start

Install, watch, then enforce.

Download the ZIP and check its SHA-256 checksum.
Follow INSTALL.md for Cloudflare Workers or Node.js 24.
Leave it in watch-only mode for about a week and review the console.
Allow the search crawlers you trust, then switch on enforcement.

Go to download

Limits, plainly

What this preview isn't.

Not tested on a live public website yet. Testing so far was local.
Not independently security-audited.
Not a guarantee. Determined scrapers can change tactics, and IP-based limits can affect shared networks.
No automatic alerts, and no full admin dashboard. The console is read-only.
Cloudflare bot features, such as AI Crawl Control, are set up by you, not by this package.

The full list is in docs/LIMITATIONS.md inside the download.

Acceptable use

Use Pollen Trap only on sites you own or are authorized to defend. It does not bypass CAPTCHAs, evade other sites' bot checks, impersonate people or strike back at scrapers.