Skip to content
How it works

Stop crawlers that look human.

A scraper can copy your reader’s user agent, rent a home connection in the same city, and rebuild Chrome’s TLS handshake byte for byte. Centinel decides on what is left.

Request a site audit

What changes

Clear rules for crawler traffic.

You choose which tools can reach your site and which ones need to stop. Your existing CDN or WAF stays in place.

One request

Two visitors. One of them is a scraper.

Both ask for the same article, from the same German home connection, with the same Chrome user agent. A request filter has nothing left to separate them.

What both requests carry

identical
request
GET /markets/q3-outlook
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
network
AS3320 Deutsche Telekom · residential · Frankfurt
ja4
t13d1516h2_8daaf6152771_e5627efa2ab1

Tools like curl-impersonate rebuild Chrome’s TLS handshake byte for byte. A matching fingerprint is something the client picks now, not something it reveals. Why the handshake alone stopped deciding

  • HTTP/2 frame shape

    The frames a client sends before its first request. The network stack writes them, not the script.

    The reader

    Priority fields set, in Chrome's order.

    The scraper

    No priority fields. Every Chromium build sets them.

  • Browser runtime

    43 measurement modules run inside the page and report 467 properties, before protected content is served. No CAPTCHA, no puzzle.

    The reader

    All 467 agree with a Chrome on macOS.

    The scraper

    The worker thread reports a different user agent than the page.

  • Screen and window

    The reported display, compared against the layout viewport and the operating system window.

    The reader

    A 1512 by 982 display, window smaller than the screen.

    The scraper

    Screen and viewport identical, inside a window larger than both. That is an override, not a monitor.

  • Session shape

    What the same client asks for next.

    The reader

    Scrolls, pauses, reads for 40 seconds, follows one link.

    The scraper

    Page taken in 200 ms, then 180 more article URLs and no images.

Verdict, before the article is sent

Median 1.4 ms on the decision call. Your origin is not asked until the answer is allow.

Allow

Served. The reader sees no check.

Block

Stopped at the edge. Your origin never answers.

The decision path

Who does what, in order

Centinel returns a decision. Your edge stays the only thing talking to the visitor, and your origin never answers a blocked request.

Where Centinel plugs into your stack

  1. Your edge

    Sends the request it already has

    A Cloudflare Worker, Lambda@Edge or reverse proxy calls Centinel with the headers and connection details of the request in front of it. Your origin is not touched yet.

  2. Centinel

    Reads the request

    Network and address history, header shape, protocol behaviour, and a match against the crawler catalog. Declared crawlers are checked against the ranges their operators publish.

  3. The browser

    Answers a check

    For a session Centinel has not seen, a check runs inside the page before protected content is served. Real browsers pass in under a second. No CAPTCHA, no puzzle, and it does not repeat for the rest of the visit.

  4. Your policy

    Decides

    You set the rule per crawler and per path. Allow Googlebot on search pages, block a scraper on the paywall, hold an unknown client for verification on sign-in.

  5. Your edge

    Acts on the answer

    Serve the page, send the visitor to a check, or refuse. Centinel returns the decision; your infrastructure stays the one talking to the visitor.

What generic filters miss

Why do some crawlers get through?

Some crawlers drive a real browser, arrive on a home connection, or rent a scraping API that does both. Nothing in the request itself gives them away. The browser check and the session are what separate them from a reader.

Start with what matters

What should you protect first?

Start with the pages where scraping costs you the most. That may be paid content, signup flows, or the pages your subscribers use.

  • Paid articles and downloads
  • Account and signup flows
  • Search and archive pages
  • Comments and community areas
  • Checkout and subscription paths
Start with your site

Want to see what reaches your site?

A site audit shows the crawler families reaching your domain and the pages where you may need more control.

Request a site auditBook a demo