








Thunderhead
A lightweight reverse proxy that scores the intent of incoming HTTP requests to detect and mitigate bot traffic - without relying on Cloudflare or third-party services.
- ❀ Passive behavioral scoring engine, no JS challenges or CAPTCHAs
- ❀ Scores requests 0-100 across signals: robots.txt violations, path crawling, request rate, suspicious headers, and content patterns
- ❀ Graduated responses: allow (< 40), tarpit with configurable delay (≥ 40), or block 403 (≥ 75)
- ❀ Structured JSON logging for all proxy decisions
- ❀ IP, CIDR, and user-agent allowlist support
- ❀ Config-driven: listen address, upstream URL, thresholds, and tarpit delay all configurable












