For online stores and catalogs
Bots distort your store metrics.
Strazh stops them
Price scrapers and scanners load your server, and their short visits mix with those of real shoppers. Because of this, your store's statistics look worse than they really are. Strazh lets people and search crawlers through and sends the rest to a check.
Free pilot: we block nothing, and in 1–2 weeks we show you a report on the bots visiting your site.
At an online car paint store, the median visit time of real people grew from 4 to 14 seconds. Data for 6 Oct – 1 Nov 2026, details below.
What bots do in a store
A visitor who will never buy still takes up server time and still lands in your statistics.
Copy the catalog and prices
Scrapers walk through product pages in thousands of visits without a single order. The data ends up with competitors and aggregators.
Look for holes
Scanners try service paths and admin URLs. Every such request costs PHP and database time.
Distort behavior metrics
Time on site, the share of short visits and bounces (when a person leaves after one page) are counted together with bots. These metrics are used when a site is judged.
Case: an online car paint store
6 Oct – 1 Nov 2026A store on 1C Bitrix. We compared one week when Strazh only observed with 12 days when it sent bots to a check.
−84%
bot visits per day
From about 1,130 to about 180. Only bots that execute JavaScript are counted.
4 s → 14 s
median visit time of real people
Half of human visits last longer than 14 seconds.
33 s → 54 s
75th percentile of human visit time
One in four human visits lasts longer than 54 seconds; before, longer than 33.
60% → 44%
human visits shorter than 10 seconds
Precisely, 60.0% → 44.4%.
Human bounce rate barely changed: 88.2% → 84.7%. That is the honest picture: Strazh removes bots, it does not change the site itself.
Data period 6 Oct – 1 Nov 2026. The “before” window is 6–12 Oct, with Strazh in observe mode; it is only 7 days, there is no earlier history. The “after” window is 17–28 Oct; the transition days 13–16 Oct are excluded. Human metrics for 29 Oct – 1 Nov are the same.
A visit here is a session in the visit counter; a bot is a visit the counter flagged as a bot. Bots without JavaScript are not visible in these figures. CPU and PHP load were not measured in this study.
Fewer bots in your statistics.
More time people spend in your store.
How the pilot works
We connect in observe mode
We install Strazh next to your web server and turn on a check for every request. The site and CMS stay as they are. Strazh lets everyone through and only records whom it would have stopped.
We collect data for 1–2 weeks
How many bots come, from where, what they look at and how many requests they make. Shoppers notice nothing.
We show you the report
You see the bots on your site and decide whether to turn protection on. The pilot commits you to nothing.
How it works
For whoever runs the server
A check on every request. Before responding, the web server asks Strazh (auth_request). Strazh runs on the same server, so the answer takes milliseconds. There are three outcomes: let through, show a check page, or refuse.
What it looks at. The browser TLS handshake fingerprint (JA4), the network and hosting the request comes from (ASN), country, browser headers and whether they match the User‑Agent, and the address history. Declared bots and automation are recognized immediately; for the rest, signals add up to a score.
Search crawlers. Their pass is set in the rules; usually Google, Yandex and Bing are let through without limits. Strazh recognizes real crawlers by reverse DNS: anyone who only calls themselves Googlebot is treated as a fake.
What a visitor sees. People pass without a check: the decision takes milliseconds. Visitors that look like bots get a page with an “I am not a robot” button, and after the check the pass lasts a few hours. Bots you need (page-speed checks, link previews in messengers and social networks) can be allowed in the rules.
Two modes. In observe mode (observe) Strazh lets everyone through and logs whom it would have stopped. In enforce mode (enforce) decisions are applied. The pilot runs in observe mode.
If Strazh is unavailable. If the service does not answer within 300 ms, the web server lets the visitor through. The site opens as usual.
Client dashboard. A log of decisions for every request, allow and block lists by address, network, country and fingerprint.
Frequently asked questions
Will this hurt the site in Google and Yandex?
Search crawlers are set up in the rules. Usually we let Google, Yandex and Bing through without limits. Strazh stops those who only claim to be a search engine.
Will shoppers see a captcha?
During the pilot nobody sees anything: Strazh only observes. With protection on, visitors who look like automation see a check. The report will show how many visitors to your site Strazh would have sent to a check.
What happens if Strazh breaks?
The web server waits no longer than 300 ms. If Strazh is down or too slow, the visitor goes through to the site. The store keeps working.
Do I need to rebuild the site?
No. We do not touch the store code or the CMS. We need access to the web server configuration. If your site is on hosting without such access, we connect through our front: you change the DNS record of your own domain (an own domain is required).
What data does Strazh see?
The same as your web server log: address, page path, browser headers and cookies. Form and order contents never reach Strazh.
How much does it cost?
The pilot is free and commits you to nothing. We discuss protection terms after the pilot, once you have the report.
How long does setup take?
It depends on the server. We agree on a time after your request; during setup Strazh runs in observe mode and blocks no one.
Get a bot report for your store
Free pilot: we block nothing, and in 1–2 weeks we show you a report on the bots visiting your site.
- How many visits to your store are made by bots
- What they look at: catalog, prices, service paths
- How many visitors Strazh would send to a check with protection on