Moonito is a bot blocker and visitor filter for your website. You decide who gets in. Bots, content thieves, fake sign-ups, VPN users, even whole countries are turned away before the page opens.
Waiting to check
Not startedThis window runs your own connection through the same checks a protected site uses.
Checks run in order. The first filter a visit fails decides it, so the rest are skipped. The time is how long our server took to decide.
This is your own visit, checked live. Switch on a VPN and press Run again.
Works with the website you already have. Paste one line of code on any site, including WordPress, Shopify and Wix, or add it to your own code in any of these languages.
HTML
JavaScript
jQuery
TypeScript
Node.js
PHP
Python
Go
Cloudflare Workers
WordPress
Shopify
Wix
Drupal
Joomla
Weebly
Blogger
Tumblr
Cloudflare
Bots don't wear name tags. They open pages, click ads and fill in forms just like people do, and every tool you use counts them as real visitors.
Fake page views make you fix pages for bots instead of for buyers.
Click farms and competitors' tools click your ads and never buy anything.
AI scrapers take months of your writing and put it somewhere else.
Fake sign-ups and throwaway emails fill your inbox and waste your team's week.
One line of code checks every visit against 20+ filters. Here is who you can turn away, and who walks straight in.
Programs pretending to be people. Known bots are spotted by how they introduce themselves and where they connect from.
Visitors hiding where they really are behind a VPN, a proxy or Tor.
The oldest trick for dodging filters: a new IP on every request. We track the visitor, not the address, so it stops working here.
Bots that copy your content to train AI. You can still let in the AI assistants that send you visitors.
Only sell in five countries? Only let those five in. Everyone else sees your blocked page.
Block one IP address, a whole internet provider, a browser or a device type. Your list, your rules.
Break-in tricks like SQL injection and XSS are stopped by the built-in firewall.
Throwaway emails, fake phone numbers and bot-filled forms never reach your inbox.
Real people go straight in. No puzzles to solve, no waiting, nothing to notice.
Every visitor is checked the moment they arrive. Unwanted ones get your blocked page, everyone else gets your site, and the live feed shows each decision and the reason for it. You can catch a copying bot while it is still running.
| Time | Verdict | Reason | IP address |
|---|---|---|---|
| 20:22:49 | Allow | Genuine Visitor | 203.0.113.24 |
| 20:22:46 | Block | Proxy/VPN/Tor | 198.51.100.7 |
| 20:22:43 | Block | Blocked AI Data Scrapers | 192.0.2.144 |
| 20:22:40 | Allow | Search Engine | 192.0.2.66 |
| 20:22:37 | Block | Non-ISP IP Blacklisted | 198.51.100.201 |
| 20:22:34 | Allow | Genuine Visitor | 203.0.113.90 |
| 20:22:31 | Block | Rate Limit | 203.0.113.12 |
| 20:22:28 | Allow | Genuine Visitor | 192.0.2.19 |
See where your real visitors come from and what they read, with bots taken out of every chart. Spend your ad money on what brings people, not on what bots click.
Switch each filter on or off for every site. Block VPN users, let in only the countries you sell to, and pick which AI bots may read your content.
Out of 1,000 sample visits, these rules turn away495
Your site stays exactly where it is. Pick what it runs on, copy the code, and paste it in. If you can copy and paste, you can set this up.
Copy the code for your site and paste it in. On WordPress, you just install our plugin instead.
Before your page opens, Moonito looks at who is knocking. Real people walk right in. Bots and fake visitors are turned away.
Your dashboard shows real people and blocked bots side by side, and where every visit came from.
<!-- Paste before </head> on every page -->
<!-- One line, both jobs: the filter and the browser sensor -->
<script defer
data-public-key="YOUR_PUBLIC_KEY"
data-blocked-page="https://example.com/blocked"
src="https://cdn.jsdelivr.net/gh/moonito-net/[email protected]/all.min.js"
integrity="sha384-VZ68WATj2o5YUO8bZ1L84gaexLLf6PqpDBBNPLJfgPNN5KUjd+M7APWoGiulEH91"
crossorigin="anonymous">
</script>Public API Key and Secret API Key.<?php
// lib/config.php (from the PHP library in your dashboard)
$apiPublicKey = 'YOUR_PUBLIC_KEY';
$apiSecretKey = 'YOUR_SECRET_KEY';
$isProtected = true;
$unwantedVisitorTo = 'https://example.com/blocked';
$unwantedVisitorAction = 1; // 1 = redirect, 2 = iframe, 3 = load content
// First line of every page you protect, before any output:
include_once(__DIR__ . "/lib/detector.php");// npm install moonito
const { VisitorTrafficFiltering } = require('moonito');
const filter = new VisitorTrafficFiltering({
apiPublicKey: 'YOUR_PUBLIC_KEY',
apiSecretKey: 'YOUR_SECRET_KEY',
isProtected: true,
unwantedVisitorTo: 'https://example.com/blocked',
unwantedVisitorAction: 1, // 1 = redirect
});
// Express: add above your routes
app.use(async (req, res, next) => {
await filter.evaluateVisitor(req, res);
if (!res.headersSent) next();
});# pip install moonito
from flask import Flask, request
from moonito import VisitorTrafficFiltering, Config
app = Flask(__name__)
moonito = VisitorTrafficFiltering(Config(
is_protected=True,
api_public_key='YOUR_PUBLIC_KEY',
api_secret_key='YOUR_SECRET_KEY',
unwanted_visitor_to='https://example.com/blocked',
unwanted_visitor_action=1, # 1 = redirect, 2 = iframe, 3 = load content
))
@app.before_request
def before_request():
# None lets the visitor through; anything else is sent instead.
return moonito.evaluate_visitor(request)
@app.after_request
def after_request(response):
# Stores the visitor's identity cookie. This is what lets a rotating
# proxy be recognised across the addresses it hops between.
return moonito.apply_token(response)// go get github.com/moonito-net/moonito-go
client := moonito.New(moonito.Config{
IsProtected: true,
APIPublicKey: "YOUR_PUBLIC_KEY",
APISecretKey: "YOUR_SECRET_KEY",
UnwantedVisitorTo: "https://example.com/blocked",
UnwantedVisitorAction: 1, // 1 = redirect, 2 = iframe, 3 = load content
})
// Wrap your handlers. EvaluateVisitor writes the block response itself.
protected := func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// An error means the check could not run, so the visitor is let
// through: a protection outage must not take your site down.
if err := client.EvaluateVisitor(w, r); err != nil {
log.Printf("moonito check skipped: %v", err)
}
next.ServeHTTP(w, r)
})
}
log.Fatal(http.ListenAndServe(":3000", protected(mux)))// Cloudflare Worker: checks each request at the edge.
// Shortened here. Your dashboard gives you the whole file to paste.
export default {
async fetch(request, env) {
const url = new URL(request.url);
const cookie = request.headers.get('cookie') || '';
try {
const check = await fetch('https://moonito.net/api/v2/decision', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'X-Public-Key': env.PUBLIC_KEY,
'X-Secret-Key': env.SECRET_KEY,
},
body: JSON.stringify({
ip: request.headers.get('cf-connecting-ip') || '',
ua: request.headers.get('user-agent') || '',
events: url.pathname + url.search,
domain: url.hostname.toLowerCase(),
// The header set and the visitor's token survive an address
// change, which is how a rotating proxy stops looking like
// a crowd of strangers.
headers: Object.fromEntries(request.headers),
client_token: /(?:^|;\s*)__mo_ct=([^;]+)/.exec(cookie)?.[1],
}),
signal: AbortSignal.timeout(2000),
});
const result = await check.json();
if (result?.data?.status?.need_to_block) {
return Response.redirect(env.BLOCKED_PAGE, 302);
}
// A visitor who scored too low to block but still looks like a
// rotating proxy. Left alone unless you ask for something else, so
// installing this never starts interrupting people on its own.
// Set CHALLENGE_ACTION to 'challenge' to make them prove they are a
// person, or 'block' to turn it into a block.
if (result?.data?.challenge_url && env.CHALLENGE_ACTION === 'challenge') {
return Response.redirect(result.data.challenge_url, 302);
}
} catch (error) {
// Fail open: a failed check never takes your site down.
}
// The full version also injects the browser sensor into the response,
// so there is no second tag to install.
return fetch(request);
},
};curl -X POST "https://moonito.net/api/v2/decision" \
-H "Content-Type: application/json" \
-H "X-Public-Key: YOUR_PUBLIC_KEY" \
-H "X-Secret-Key: YOUR_SECRET_KEY" \
-d '{
"domain": "example.com",
"ip": "203.0.113.24",
"ua": "Mozilla/5.0",
"events": "/pricing"
}'
# The response tells you what to do with the visit:
# data.status.need_to_block turn them away
# data.set_client_token store this, it is how a rotating proxy
# is recognised across changing addresses
# data.challenge_url optional. Present for a visitor who scored
# too low to block but still looks like a
# rotating proxy. Ignore it to let them
# through, which is what most sites do.Your personal key is waiting in your dashboard after you sign up. Stuck? Every setup has a step-by-step guide.
Your protection, your visitor logs and your uptime checks live in one place, so you stop jumping between three different tools.
Switch on what you need and leave the rest off. Every filter below comes with the same line of code.
The same account also protects your forms and your links, and tells you the moment your site goes down.
Throwaway emails, fake phone numbers and bot-filled forms are stopped before they reach your inbox. One line of code, nothing to change on your server.
About Form ShieldChecks that your site is up, that its security certificate is still valid and that Google hasn't flagged it. You get an email or Telegram message the moment something breaks.
About Uptime MonitoringBot clicks are filtered out before they reach your stats or your page, so every click you count is a real person.
About Protected ShortlinksCheck IP addresses, emails and phone numbers from your own sign-up form, using the same data as the dashboard.
Read the API ReferenceMost sites need a firewall, an analytics tool and an IP lookup service. Moonito does all three with one line of code.
| Feature |  Moonito |
CDN firewall | Analytics tool | IP lookup service |
|---|---|---|---|---|
| Keeps unwanted visitors out | ||||
| Blocks VPN, proxy and Tor users | Yes | Partial | No | Partial |
| Catches bots pretending to be people | Yes | Partial | No | No |
| Lets you pick which AI bots get in | Yes | Yes | No | No |
| Blocks traffic from servers, not homes | Yes | Partial | No | Partial |
| Tracks visitors through rotating or residential IPsBeta | Yes | No | No | No |
| Stops hacking attempts like SQL injection | Yes | Yes | No | No |
| Caps how many pages one visitor opens | Yes | Yes | No | No |
| Lets in only the countries you choose | Yes | Yes | No | No |
| Shows you who got through | ||||
| Analytics with bots taken out | Yes | Partial | Partial | No |
| Live feed of every visit | Yes | Partial | Partial | No |
| A reason for every block | Yes | Partial | No | No |
| IP, internet provider and device for every visit | Yes | Partial | No | Partial |
| Beyond bots | ||||
| Stops fake sign-ups and form spam | Yes | Partial | No | Partial |
| Checks emails and phone numbers | Yes | No | No | Partial |
| Short links that ignore bot clicks | Yes | No | No | No |
| Tells you when your site goes down | Yes | Partial | No | No |
| Works without changing domain settings | Yes | No | Yes | Yes |
Each column is a type of tool, not a specific brand. Brand-by-brand comparisons are below.
means partial, or only on some plans.
Comparing Moonito with a specific tool?
Site owners on what they noticed once Moonito was running. Names are withheld for privacy.
Customer
Reviewed Moonito
Moonito simplifies website analytics for my 65 sites, offering more accessible insights than Google Analytics.
Customer
Reviewed Moonito
Moonito also provides a Website Security feature that helps me protect my website easily. How cool!
Customer
Reviewed Moonito
I liked Moonito because it gave more specific data by visitor than I could get with Google Analytics.
Customer
Reviewed Moonito
I really love how the User Interface looks and how easily it collects statistics.
Customer
Reviewed Moonito
It gave us detailed information on where our traffic came from, what pages were visited, and what browsers were being used.
Customer
Reviewed Moonito
The website views also come through instantly almost so you can get a real insight into your visitor activity minute by minute! Highly recommend.
Customer
Reviewed Moonito
Unlike Google Analytics, Moonito's user-friendly interface, mobile app, and real-time visitor tracking provide valuable data effortlessly, even on the go.
Customer
Reviewed Moonito
Moonito is a quick and easy approach to getting useful information about your website's visitors and identifying what works and what doesn't.
Every plan starts with seven days free. Move up when your traffic does, and cancel whenever you want.
7 days free, no credit card
$0.23 per 1,000 requests
7 days free, no credit card
$0.19 per 1,000 requests
7 days free, no credit card
$0.14 per 1,000 requests
7 days free, no credit card
$0.28 per 1,000 requests
7 days free, no credit card
$0.14 per 1,000 requests
7 days free, no credit card
$0.11 per 1,000 requests
7 days free, no credit card
$0.21 per 1,000 requests
7 days free, no credit card
$0.11 per 1,000 requests
7 days free, no credit card
$0.08 per 1,000 requests
Blocking, speed, setup and billing, answered in plain words.
No. Moonito looks at where a visit comes from and what it looks like, not at who the person is. Normal home and phone connections go straight in, and you choose how strict each site is. Every block is saved with its reason, so if someone you want gets stopped, you can let them in with one click.
No. The code loads in the background, so your page never waits for it. The server versions make one quick check per visit, and the Cloudflare Worker lets the visit through if a check ever takes longer than two seconds.
You choose for each site: send it to a page you pick, show your blocked page, or show different content. Every block is saved with the reason it happened, and blocked visits never count in your stats.
About five minutes. Add your site in the dashboard, copy your key, then paste one line of code or install the WordPress plugin. Your site stays where it is: there are no domain settings to change and nothing standing in front of it.
Not sure? Use the script tag. It works on any website. On WordPress, use the plugin. If you have a developer, the server versions and the Cloudflare Worker check each visit before the page is even sent, which also stops bots that skip JavaScript.
Yes. Moonito shows visits from AI assistants and AI scrapers apart from people, and you can allow or block each group on every site. Keep the assistants that send you visitors and block the scrapers that only copy.
The seven-day trial includes every feature and needs no credit card. When it ends, pick a plan to keep your site protected. Nothing is charged until you choose a plan yourself.
Yes. The API gives you the same answer the dashboard uses for every visit: the IP, location, device and whether to block it. There are ready-made packages for Node.js, Python, Go and PHP, and a full API reference.
Still have a question? We are happy to help.
Add one line of code, open your dashboard, and watch the first unwanted visitor get turned away. Seven days free, no credit card.
7 days free, no credit cardOnline · we usually reply in minutes
Start a Chat
