---
title: "Web scraping protection that lets search engines in · camada"
description: "Spot scrapers by what they do across a session: page rate, no JavaScript, dropped cookies, faked crawler names. Googlebot and your allow-list still get in."
url: https://www.camada.app/use-cases/scraping
last_updated: 2026-10-31
---

Use case

# Scraping protection that keeps search engines in

Scrapers copy your prices, listings and content, and run up your compute bill. Search engines and partners you trust crawl you too. camada tells them apart by behaviour and by published crawler IP ranges, not by user agent alone.

[Get started free](https://my.camada.app/) [How camada works →](https://www.camada.app/how-it-works)

The pattern

## What it looks like in your traffic

- Hundreds of pages an hour from one client, with no JavaScript running in the browser.
- A new session on every request because the client drops cookies.
- A Chrome user agent without the client hints real Chrome sends.
- A user agent that claims to be Googlebot from outside Google's published IP ranges.

Detection

## How camada scores it

| What camada looks for | Score |
| --- | --- |
| 150+ pages an hour; 400+ pages an hour | `+25; +50` |
| 3+ HTML pages served and the beacon never ran (no JavaScript) | `+25` |
| Claims Googlebot, bingbot or Applebot from outside their published IP ranges | `+60` |
| Chrome or Edge user agent without Sec-CH-UA client hints | `+25` |
| Known AI crawler (GPTBot, CCBot and others); agents known to ignore robots.txt | `+20; +35` |
| The real Googlebot, bingbot or Applebot, from inside the published ranges | `-40` |

A crawler you invited goes on your allow-list and stays off the blocklist. The AI-crawler rule names the bot in its reason, so you can allow one you want.

A sample of the rules, with their default weights. The full pipeline and more rules are on [how it works](https://www.camada.app/how-it-works).

Setup

## Set it up

1. Install the SDK for your framework. [Framework quickstarts →](https://www.camada.app/frameworks)
2. Add the beacon to your HTML pages. It is first-party, served from your own origin, and it is what shows a real browser ran. [Beacon setup in the Express quickstart →](https://www.camada.app/docs/quickstart/express)
3. Allow-list the partners and crawlers you want by IP or CIDR range. [Rules and list entries →](https://www.camada.app/docs/rules)

Limits

## What camada does not do

- A slow scraper that behaves like one reader can stay under every threshold. camada catches volume and automation, not intent.
- Blocks apply from the analyst's next run, so a scraper's first pages are served.
- camada does not watermark content or charge crawlers per request.

Questions

## Common questions

### Will camada hurt my SEO?

Verified Googlebot, bingbot and Applebot are checked against the IP ranges those companies publish, and the real ones score lower, not higher. Fakes using their names are caught. The guardrails also say never to block on a user agent alone.

### Can I let some AI crawlers in and keep others out?

Yes. Each AI-crawler finding names the bot. Allow-list the address ranges of the ones you want, or turn the AI-crawler rule off for your project. You also choose what each verdict category does: block, challenge, alert or ignore.

### What about scrapers using residential proxies?

Rotating IPs does not hide a session that drops cookies, runs no JavaScript or shares one client build across many addresses. camada groups those requests by session and by client shape, not only by IP.

Other attacks camada handles: [Credential stuffing](https://www.camada.app/use-cases/credential-stuffing) · [AI agent abuse](https://www.camada.app/use-cases/ai-agents) · [CVE exploit scans](https://www.camada.app/use-cases/cve-exploits). Plans and the 14-day trial: [pricing](https://www.camada.app/pricing).

## Sitemap

[Every page on this site](https://www.camada.app/sitemap.md)