Skip to content
Use case

Cover the endpoints your browser checks never see

Mobile apps, partner integrations and backend services call your API directly. None of them load a page, so a browser-only check never runs.

Request a site audit
Why it matters

83% of simple, curl-based bots

pass unnoticed by passive inspection, and so do 95% of advanced bot attacks. An API endpoint with no check in front of it is exactly the gap that traffic is built to find.

Read the research
How it works against you

What the traffic looks like

  • No page, no JavaScript

    A direct HTTP request never executes the page's script, so any check that only runs in the browser never runs at all.

  • Credentials that leak like passwords

    API keys and tokens get exposed the same way passwords do, then get called from wherever the attacker is running.

  • Traffic shaped like your own app

    The same endpoint your mobile app calls is reachable by anyone who reads its requests off the wire.

How Centinel closes it

What runs against this traffic

  • Client validation

    Connection-level signals, TLS fingerprint and HTTP/2 behavior are checked whether or not a page ever loads.

    Coverage does not stop at the requests that happen to run a browser.

    Read more

  • Crawler identity checks

    Declared bots and known API clients are matched by identity and checked against the ranges their operators publish.

    A request claiming to be a partner integration is held to the same standard as one claiming to be Googlebot.

    Read more
Other use cases

Traffic doesn't stop at one attack

Start with your site

Want to see what reaches your site?

A site audit shows the crawler families reaching your domain and the pages where you may need more control.

Request a site auditBook a demo