Put traps on your site. Know the moment one is sprung.
Paths and credentials that are worthless to a real guest and irresistible to an intruder. Nobody legitimate ever touches one — so when something does, there is nothing to interpret and no threshold to argue about. Somebody is inside.
One npm install · no server to run · never blocks a visitor
Trap sprungsomeone requested /.env
Honeytoken useda key that was never valid
Copy foundyour site on a domain you do not own
A trap has no false positives
Your firewall has to guess. A trap does not.
Every filtering product decides whether a request looks bad enough to act on, and it is sometimes wrong in both directions. A trap needs no judgement: the path exists for nobody, so a request for it is not evidence to weigh. It is an answer.
Reconnaissance is not an attack yet, so nothing blocks it
Somebody works through your paths for six minutes, learns where things are, and leaves. Nothing was exploited, so nothing fired — and the only record is forty lines in an access log nobody reads. That is the window this closes.
A used credential is proof, not a signal
Because you know which credentials were never real. A token planted where only an intruder would find it turns a maybe into a fact, and no amount of traffic filtering can produce that.
Doors that should never open
Paths on your own site that only an intruder asks for — /.env, /wp-admin, /backup.zip. A guest looking for a room never requests one, so a hit needs no interpretation and there is no false positive to argue about.
Keys that were never real
A credential that looks valid, works nowhere, and sits where somebody finds it only by looking where they should not. Nobody legitimate holds one, so a single use is not a signal to weigh. It is proof.
Not forty log lines
Dozens of small events from one source over a few minutes become a single alert with a score, a plain sentence, and every observation behind it kept so you can check the claim rather than believe it.
What it does
- Tells you someone is probing your site while they are still doing it
- Turns a used honeytoken into proof rather than a suspicion
- Compresses dozens of small events into one incident and one plain sentence
- Keeps the evidence, so every alert can be checked rather than believed
What it will never do
- Block, redirect, challenge or slow a visitor — that is your edge provider's job
- Read cookies, sessions, form fields or request bodies
- Delay a response: reporting is detached from the request
- Break your site — if anything throws, the request continues untouched
And the limit, stated here rather than buried: a trap only catches somebody who touches it. An intruder who knows exactly what they want and goes straight to it will not trip one. This makes the common case loud and cheap — it is not a guarantee, and any vendor offering you one is selling something.
And on Guard, the ground around them
The traps stay the product. Guard runs more of them, and adds continuous checks on the surface they sit in — the things that change without anyone deciding they should.
- Copies of your site
- A copied page carries our beacon with it, so the copy asks us for a script and tells us where it is running. We fetch that host ourselves and look for your own content before saying a word.
- Third-party scripts
- Fingerprinted each pass. Card skimming rarely breaks a site — it edits a script the site already trusted, and the booking form keeps working while it copies every keystroke.
- Lookalike names
- Public certificate logs make an impersonating domain visible within hours of registration. A watch list, not an accusation.
- Your own headers
- Checked from outside, continuously, so a protection you switched on last year is still on today.
- Sign-in patterns
- Spraying, stuffing and takeover — shapes no single request can show. You hash the account identifier, so we never learn whose it was.
Five minutes, inside the app you already run
There is no box to provision, no DNS to repoint, and no agent on a server somewhere. That is why it costs $54 a month rather than what a managed service costs.
Read the install guideimport { createGuard } from "@pharoshub/guard";
const guard = createGuard({
siteKey: process.env.PHAROS_SITE_KEY,
secret: process.env.PHAROS_SECRET,
});
app.use(guard.middleware());Twelve traps on one site
$54 a month, $60 once to set up. Cancel from the billing screen, any time.