HN Showcase
Back to browse
GitHub Repository

Self-hosted JA4 bot challenge for stock nginx & Apache — search-bot safe by design. PoW + behavioral CAPTCHA, RPM/DEB/APK packages.

1 starsGo

Unmask – Bot challenge for stock Nginx that doesn't break Googlebot

by unmask·Jul 22, 2026·2 points·0 comments
Visit ProjectView on HN

AI Analysis

●●SolidNiche GemBig Brain

JA4 fingerprinting catches headless browsers that fake User-Agent strings.

Strengths
  • •Two-stage search-bot rescue prevents breaking Googlebot or ClaudeBot by design.
  • •Native Nginx dynamic module adds only 0.05ms latency post-cookie challenge.
  • •Community ban feed with GDPR-compliant salted IP hashes and 30-day pruning.
Weaknesses
  • •Requires self-hosting and config tweaks compared to managed Cloudflare Turnstile.
  • •Privacy Pass and Web Bot Auth features are opt-in and currently niche.
Category
Security
Target Audience

DevOps engineers and sysadmins managing web servers

Similar To

Cloudflare Turnstile · hCaptcha · Friendly Captcha

Similar Projects