# Trap and tarpit

> Insert an invisible canary link that only automated readers follow, and send scrapers into a slow maze of generated pages instead of your origin.

## Trap

With `trap.enabled` (**Canary trap** in the dashboard), the edge inserts before `</body>` of your HTML pages a hidden block (`<div hidden aria-hidden="true" data-nosnippet>`) with a short note in English and Spanish addressed to AI agents and a `rel="nofollow noindex"` link under `/__waf/ai/t/`.

- People never see it. It is compatible with a Content Security Policy and doesn't change the cached page.
- It is never inserted for verified crawlers or search engines.
- Each link carries a signed token that expires after 24 hours.
- A client that follows it is automated: its IP and TLS fingerprint are marked for 24 hours, a `trap_hit` event is recorded and the [`trap_hit` policy key](https://developers.openwaf.dev/ai-crawl-control/categories/#policy-keys) applies to its next requests.

## Tarpit

With `tarpit.enabled` (off by default), the `tarpit` action answers HTML `GET` requests with a labyrinth under `/__waf/ai/l/`: cheap pages generated at the edge, marked `noindex`, each with about ten links that go deeper, served slowly and with per-IP and global limits. Your origin is never involved. Requests that aren't HTML `GET` get `403`.

The tarpit only acts in `enforce` mode, and never on verified crawlers.

## Turn them on

**Dashboard**

**AI Crawl Control → Overview → Settings**: **Canary trap → Inject the canary link** and **Tarpit → Tarpit (labyrinth)**. Then choose `Tarpit` as the action of a category, such as **Followed the trap**.
**CLI**

```sh
openwaf-cloud ctl zones set example.com ai_agents.trap.enabled=true ai_agents.tarpit.enabled=true \
  ai_agents.policy.trap_hit=tarpit --reason "Trap and tarpit scrapers"
```
**API**

```json
{"ai_agents": {"trap": {"enabled": true}, "tarpit": {"enabled": true}, "policy": {"trap_hit": "tarpit"}}}
```
**MCP**

`ai_agents_settings` with `"patch": {"trap": {"enabled": true}, "tarpit": {"enabled": true}, "policy": {"trap_hit": "tarpit"}}`.


The **Traps** report shows the trap over time and who followed it.