







Thunderhead
A lightweight reverse proxy that scores the intent of incoming HTTP requests to detect and mitigate bot traffic — without relying on Cloudflare or third-party services.
- > Passive behavioral scoring engine, no JS challenges or CAPTCHAs
- > Scores requests 0-100 across signals: robots.txt violations, path crawling, request rate, suspicious headers, and content patterns
- > Graduated responses: allow (< 40), tarpit with configurable delay (≥ 40), or block 403 (≥ 75)
- > Structured JSON logging for all proxy decisions
- > IP, CIDR, and user-agent allowlist support
- > Config-driven: listen address, upstream URL, thresholds, and tarpit delay all configurable


