{"slug": "anubis", "name": "Anubis", "category": "security", "category_name": "Security and passwords", "description": "Self-hosted web AI firewall that uses proof-of-work browser challenges to block AI scrapers.", "recommenders": 7, "commenters": 19, "warners": 3, "score": 5.805, "rising": 0.36, "first": "2025-11-01", "latest": "2026-10-19", "why": "Recommended for cutting AI-scraper traffic on self-hosted sites and Forgejo servers, with operators reporting drops from hundreds of thousands of daily requests to around a hundred or fewer.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 9, "neutral": 5, "compare": 4, "warn": 3}, "spark": [2, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1], "listed": true, "loved": ["Stops scrapers", "Proof-of-work design"], "caveat": "Requires JavaScript", "short_quote": "it's the only thing that stopped the bot problem for me, (2) it's really easy to deploy, and (3) very few human visitors are incorrectly blocked by it", "icon": true, "domain": null, "github_repo": "github.com/techarohq/anubis", "official_url": "https://anubis.techaro.lol/", "pricing": "open source", "aliases": ["Anubis"], "verdict": [{"text": "Recommended for cutting AI-scraper traffic on self-hosted sites and Forgejo servers", "cites": [{"id": 802272624, "item_id": 50142039, "url": "https://news.ycombinator.com/item?id=50142039", "by": "m-p-3", "date": "2026-10-18", "stance": "recommend", "quote": "So far we use Anubis to protect our services from scraping and it's been a decent experience.", "excerpt": "We host a website in Canada (physical server hosting VMs in a Canadian DC) and with the ongoing trade-war we do whatever we can to avoid anything US-based tech such as Cloudflare. So far we use Anubis to protect our services from scraping and it's been a decent experience.", "context": "hosts website in Canada on own physical server", "use_case": "block scraping", "switched_from": "", "story": "Websites are closing their doors to AI agents"}, {"id": 732608192, "item_id": 45788012, "url": "https://news.ycombinator.com/item?id=45788012", "by": "gucci-on-fleek", "date": "2025-11-01", "stance": "recommend", "quote": "it's the only thing that stopped the bot problem for me, (2) it's really easy to deploy, and (3) very few human visitors are incorrectly blocked by it", "excerpt": "> But it still works, right? People use Anubis because it actually stops LLM bots from scraping their site, so it must work, right? > Yeah, but only because the LLM bots simply don\u2019t run JavaScript. I don't think that this is the case, because when Anubis itself switched from a proof-of-work to a different JavaScript-based challenge, my server got overloaded, but switching back to the PoW solution fixed it [0]. I als", "context": "runs a website that was overloaded by bots", "use_case": "blocking scraper bots", "switched_from": "", "story": "You Don't Need Anubis"}, {"id": 741100032, "item_id": 46318752, "url": "https://news.ycombinator.com/item?id=46318752", "by": "kstrauser", "date": "2025-12-18", "stance": "recommend", "quote": "I've also had enormous luck with Anubis.", "excerpt": "I love the insanity of this idea. Not saying it's a good idea, but it's a very highly entertaining one, and I like that! I've also had enormous luck with Anubis. AI scrapers found my personal Forgejo server and were hitting it on the order of 600K requests per day. After setting up Anubis, that dropped to about 100. Yes, some people are going to see an anime catgirl from time to time. Bummer. Reducing my fake traffic", "context": "runs personal Forgejo server", "use_case": "block AI scrapers on Forgejo server", "switched_from": "", "story": "Show HN: Stop AI scrapers from hammering your self-hosted blog (using porn)"}, {"id": 749401248, "item_id": 46837578, "url": "https://news.ycombinator.com/item?id=46837578", "by": "kstrauser", "date": "2026-01-31", "stance": "recommend", "quote": "I used Anubis and a cookie redirect to cut the load on my Forgejo server by around 3 orders of magnitude", "excerpt": "I\u2019ve been enduring that exact same traffic pattern. I used Anubis and a cookie redirect to cut the load on my Forgejo server by around 3 orders of magnitude: https://honeypot.net/2025/12/22/i-read-yann-espositos-blog.html", "context": "runs a Forgejo server", "use_case": "blocking crawler traffic", "switched_from": "", "story": "Disrupting the Largest Residential Proxy Network"}]}, {"text": ", with operators reporting drops from hundreds of thousands of daily requests to around a hundred or fewer.", "cites": [{"id": 741100032, "item_id": 46318752, "url": "https://news.ycombinator.com/item?id=46318752", "by": "kstrauser", "date": "2025-12-18", "stance": "recommend", "quote": "I've also had enormous luck with Anubis.", "excerpt": "I love the insanity of this idea. Not saying it's a good idea, but it's a very highly entertaining one, and I like that! I've also had enormous luck with Anubis. AI scrapers found my personal Forgejo server and were hitting it on the order of 600K requests per day. After setting up Anubis, that dropped to about 100. Yes, some people are going to see an anime catgirl from time to time. Bummer. Reducing my fake traffic", "context": "runs personal Forgejo server", "use_case": "block AI scrapers on Forgejo server", "switched_from": "", "story": "Show HN: Stop AI scrapers from hammering your self-hosted blog (using porn)"}, {"id": 761037648, "item_id": 47564853, "url": "https://news.ycombinator.com/item?id=47564853", "by": "NooneAtAll3", "date": "2026-03-29", "stance": "recommend", "quote": "I love experimental data like this.", "excerpt": "> Before it was enabled, it was getting several hundred-thousand requests each day. As soon as Anubis became active in there, it decreased to about 11 requests after 24 hours I love experimental data like this. So much better than gut reaction that was spammed when anubis was just introduced", "context": "", "use_case": "blocking bot traffic", "switched_from": "", "story": "The bot situation on the internet is worse than you could imagine"}]}, {"text": " The most common complaint is that it makes visitors run JavaScript challenges", "cites": [{"id": 787449728, "item_id": 49215608, "url": "https://news.ycombinator.com/item?id=49215608", "by": "basilikum", "date": "2026-08-07", "stance": "warn", "quote": "As said Anubis is trivially bypassed.", "excerpt": "1. It makes the web more annoying and time wasting. 2. I'm a real user and I have to enable JavaScript and run arbitrary programs from untrusted websites to access them. One browser that I use doesn't even support JavaScript (w3m). Fortunately it is unaffected because it doesn't have the string \"Mozilla\" in its UA and Anubis lets every user without that pass to not hurt legitimate bots like search engine crawlers. As", "context": "", "use_case": "bot protection", "switched_from": "", "story": "99% of My Website Traffic Is Bots"}, {"id": 732608192, "item_id": 45788012, "url": "https://news.ycombinator.com/item?id=45788012", "by": "gucci-on-fleek", "date": "2025-11-01", "stance": "recommend", "quote": "it's the only thing that stopped the bot problem for me, (2) it's really easy to deploy, and (3) very few human visitors are incorrectly blocked by it", "excerpt": "> But it still works, right? People use Anubis because it actually stops LLM bots from scraping their site, so it must work, right? > Yeah, but only because the LLM bots simply don\u2019t run JavaScript. I don't think that this is the case, because when Anubis itself switched from a proof-of-work to a different JavaScript-based challenge, my server got overloaded, but switching back to the PoW solution fixed it [0]. I als", "context": "runs a website that was overloaded by bots", "use_case": "blocking scraper bots", "switched_from": "", "story": "You Don't Need Anubis"}, {"id": 784582000, "item_id": 49036375, "url": "https://news.ycombinator.com/item?id=49036375", "by": "hedora", "date": "2026-07-24", "stance": "warn", "quote": "Is there a bypass for those yet?", "excerpt": "Is there a bypass for those yet? Not all of the machines I have run it at a reasonable pace, so I'd like to just farm the challenge to some other machine. My nice desktop that I use for C++/Rust/Formal Verification takes multiple minutes sometimes, and I'd rather not replace the motherboard over this, or figure out why it's not using the GPU/whatever. OTOH, I have a MacBook with Apple's terrible window manager. It bl", "context": "", "use_case": "proof-of-work bot challenge", "switched_from": "", "story": "I Regret Migrating to Codeberg"}]}, {"text": ", which some find annoying, slow on certain hardware, or bad for accessibility.", "cites": [{"id": 787449728, "item_id": 49215608, "url": "https://news.ycombinator.com/item?id=49215608", "by": "basilikum", "date": "2026-08-07", "stance": "warn", "quote": "As said Anubis is trivially bypassed.", "excerpt": "1. It makes the web more annoying and time wasting. 2. I'm a real user and I have to enable JavaScript and run arbitrary programs from untrusted websites to access them. One browser that I use doesn't even support JavaScript (w3m). Fortunately it is unaffected because it doesn't have the string \"Mozilla\" in its UA and Anubis lets every user without that pass to not hurt legitimate bots like search engine crawlers. As", "context": "", "use_case": "bot protection", "switched_from": "", "story": "99% of My Website Traffic Is Bots"}, {"id": 737055985, "item_id": 46065999, "url": "https://news.ycombinator.com/item?id=46065999", "by": "Jach", "date": "2025-11-26", "stance": "warn", "quote": "them using Anubis is annoying", "excerpt": "Their \"VP of Community\" wrote this in 2020: https://kristoff.it/blog/addio-redis/ I didn't come across it until 2022. Still, particularly that and other writing from him and others convinced me the Zig community is full of goobers. That's not so bad, I have my tastes in immature humor and can sometimes be a goober too, but the application in that post's clearly-marked over-the-top skit still is just bizarre and doesn", "context": "", "use_case": "bot protection on sites", "switched_from": "", "story": null}, {"id": 784582000, "item_id": 49036375, "url": "https://news.ycombinator.com/item?id=49036375", "by": "hedora", "date": "2026-07-24", "stance": "warn", "quote": "Is there a bypass for those yet?", "excerpt": "Is there a bypass for those yet? Not all of the machines I have run it at a reasonable pace, so I'd like to just farm the challenge to some other machine. My nice desktop that I use for C++/Rust/Formal Verification takes multiple minutes sometimes, and I'd rather not replace the motherboard over this, or figure out why it's not using the GPU/whatever. OTOH, I have a MacBook with Apple's terrible window manager. It bl", "context": "", "use_case": "proof-of-work bot challenge", "switched_from": "", "story": "I Regret Migrating to Codeberg"}, {"id": 785216545, "item_id": 49076034, "url": "https://news.ycombinator.com/item?id=49076034", "by": "exiguus", "date": "2026-07-27", "stance": "compare", "quote": "tools like Cloudflare and Anubis can create serous accessibility issues; some more than others.", "excerpt": "In my view, if blocking is necessary, whitelisting is generally more effective than blacklisting. And if whitelisting isn't feasible, this might be a poor solution. On the other hand, tools like Cloudflare and Anubis can create serous accessibility issues; some more than others. I prefer rate limiting; it's elegant and avoids accessibility problems. For temporary issues, short-term IP bans can also work well. Persona", "context": "", "use_case": "bot blocking on Git web UI", "switched_from": "", "story": "How to Block Some of the Bots"}]}], "praise": [{"label": "Stops scrapers", "summary": "Operators say it stopped bot scraping and greatly reduced server load.", "quotes": [{"id": 741100032, "item_id": 46318752, "url": "https://news.ycombinator.com/item?id=46318752", "by": "kstrauser", "date": "2025-12-18", "stance": "recommend", "quote": "I've also had enormous luck with Anubis.", "excerpt": "I love the insanity of this idea. Not saying it's a good idea, but it's a very highly entertaining one, and I like that! I've also had enormous luck with Anubis. AI scrapers found my personal Forgejo server and were hitting it on the order of 600K requests per day. After setting up Anubis, that dropped to about 100. Yes, some people are going to see an anime catgirl from time to time. Bummer. Reducing my fake traffic", "context": "runs personal Forgejo server", "use_case": "block AI scrapers on Forgejo server", "switched_from": "", "story": "Show HN: Stop AI scrapers from hammering your self-hosted blog (using porn)"}, {"id": 749401248, "item_id": 46837578, "url": "https://news.ycombinator.com/item?id=46837578", "by": "kstrauser", "date": "2026-01-31", "stance": "recommend", "quote": "I used Anubis and a cookie redirect to cut the load on my Forgejo server by around 3 orders of magnitude", "excerpt": "I\u2019ve been enduring that exact same traffic pattern. I used Anubis and a cookie redirect to cut the load on my Forgejo server by around 3 orders of magnitude: https://honeypot.net/2025/12/22/i-read-yann-espositos-blog.html", "context": "runs a Forgejo server", "use_case": "blocking crawler traffic", "switched_from": "", "story": "Disrupting the Largest Residential Proxy Network"}, {"id": 732608192, "item_id": 45788012, "url": "https://news.ycombinator.com/item?id=45788012", "by": "gucci-on-fleek", "date": "2025-11-01", "stance": "recommend", "quote": "it's the only thing that stopped the bot problem for me, (2) it's really easy to deploy, and (3) very few human visitors are incorrectly blocked by it", "excerpt": "> But it still works, right? People use Anubis because it actually stops LLM bots from scraping their site, so it must work, right? > Yeah, but only because the LLM bots simply don\u2019t run JavaScript. I don't think that this is the case, because when Anubis itself switched from a proof-of-work to a different JavaScript-based challenge, my server got overloaded, but switching back to the PoW solution fixed it [0]. I als", "context": "runs a website that was overloaded by bots", "use_case": "blocking scraper bots", "switched_from": "", "story": "You Don't Need Anubis"}]}, {"label": "Proof-of-work design", "summary": "Commenters find the proof-of-work challenge interesting and say it beat a non-PoW challenge against bots.", "quotes": [{"id": 770212384, "item_id": 48138274, "url": "https://news.ycombinator.com/item?id=48138274", "by": "wolttam", "date": "2026-05-14", "stance": "recommend", "quote": "I think the proof-of-work approach that anubis[0] takes is pretty interesting.", "excerpt": "This is just like security; the most secure system is the one that nobody can use. I think the proof-of-work approach that anubis[0] takes is pretty interesting. I love the idea of having to do a small amount of work for the author of the content in order to get access to their content. It would be interesting to a scheme where the proof-of-work that clients do in systems like anubis actually had a way to directly be", "context": "", "use_case": "blocking AI scrapers", "switched_from": "", "story": "New agents.txt file found on DreamHost"}, {"id": 732608192, "item_id": 45788012, "url": "https://news.ycombinator.com/item?id=45788012", "by": "gucci-on-fleek", "date": "2025-11-01", "stance": "recommend", "quote": "it's the only thing that stopped the bot problem for me, (2) it's really easy to deploy, and (3) very few human visitors are incorrectly blocked by it", "excerpt": "> But it still works, right? People use Anubis because it actually stops LLM bots from scraping their site, so it must work, right? > Yeah, but only because the LLM bots simply don\u2019t run JavaScript. I don't think that this is the case, because when Anubis itself switched from a proof-of-work to a different JavaScript-based challenge, my server got overloaded, but switching back to the PoW solution fixed it [0]. I als", "context": "runs a website that was overloaded by bots", "use_case": "blocking scraper bots", "switched_from": "", "story": "You Don't Need Anubis"}, {"id": 784873168, "item_id": 49054573, "url": "https://news.ycombinator.com/item?id=49054573", "by": "gucci-on-fleek", "date": "2026-07-25", "stance": "recommend", "quote": "I really have no idea why Anubis works right now", "excerpt": "> That's a double edged sword because bots will eventually get through too, and unlike humans, their time is dirt cheap. Yeah, I really have no idea why Anubis works right now: residential proxies are far more expensive than compute, yet the bots seem to have no problem obtaining millions of residential IPs, but they give up on even short-ish Anubis challenges. > I never ran into this issue despite using seemingly ma", "context": "", "use_case": "blocking bots", "switched_from": "", "story": "Cloudflare's new AI traffic options for customers"}]}, {"label": "Non-US alternative", "summary": "Used as a self-hosted alternative to US-based Cloudflare.", "quotes": [{"id": 802272624, "item_id": 50142039, "url": "https://news.ycombinator.com/item?id=50142039", "by": "m-p-3", "date": "2026-10-18", "stance": "recommend", "quote": "So far we use Anubis to protect our services from scraping and it's been a decent experience.", "excerpt": "We host a website in Canada (physical server hosting VMs in a Canadian DC) and with the ongoing trade-war we do whatever we can to avoid anything US-based tech such as Cloudflare. So far we use Anubis to protect our services from scraping and it's been a decent experience.", "context": "hosts website in Canada on own physical server", "use_case": "block scraping", "switched_from": "", "story": "Websites are closing their doors to AI agents"}, {"id": 735717442, "item_id": 45982340, "url": "https://news.ycombinator.com/item?id=45982340", "by": "colesantiago", "date": "2025-11-19", "stance": "recommend", "quote": "If we support alternatives they can grow into an open source CDN.", "excerpt": "> Bunny has raised money from VC which indicates it\u2019s going the \u201cWall Street\u201d path. Yet it is an available alternative to Cloudflare that is not on Wall Street (a public company). If you want to do this 100% yourself there is Apache Traffic Control. https://github.com/apache/trafficcontrol > Anubis is a bot firewall not a CDN. For now. If we support alternatives they can grow into an open source CDN.", "context": "", "use_case": "bot firewall", "switched_from": "", "story": "Questions for Cloudflare"}]}, {"label": "Good enough", "summary": "Defended as imperfect but meaningful protection compared with none.", "quotes": [{"id": 792081344, "item_id": 49505084, "url": "https://news.ycombinator.com/item?id=49505084", "by": "FridgeSeal", "date": "2026-08-31", "stance": "recommend", "quote": "Evidently, it makes _enough_ of a difference for the people running it.", "excerpt": "It doesn\u2019t have to be fully sound, it\u2019s there to provide _some_ degree of interim protection. Evidently, it makes _enough_ of a difference for the people running it. Criticising it is just letting the perfect be the enemy of the good. The alternative to Anubis isn\u2019t \u201csomething better that isn\u2019t being picked\u201d, it\u2019s \u201ccompletely unprotected\u201d, and the people criticising it for being imperfect could helpfully move the con", "context": "", "use_case": "bot protection", "switched_from": "", "story": "Creepy Crawlies"}, {"id": 795546273, "item_id": 49721642, "url": "https://news.ycombinator.com/item?id=49721642", "by": "mskalski", "date": "2026-09-16", "stance": "neutral", "quote": "The rest probably still have to be treated with Anubis.", "excerpt": "I wonder if protocols like Web Bot Auth [1] will see wider adoption. At least as a supported mechanism for those bots which identify themselves. The rest probably still have to be treated with Anubis. In my free time I've recently been experimenting with a Web Bot Auth implementation as an Envoy dynamic module [2] to have a way to define some additional policies for the traffic from bots. [1] https://datatracker.ietf", "context": "", "use_case": "blocking unidentified bots", "switched_from": "", "story": "Stay discoverable in search while disallowing AI training"}]}, {"label": "Easy deployment", "summary": "One operator says it is easy to deploy and rarely blocks real visitors.", "quotes": [{"id": 732608192, "item_id": 45788012, "url": "https://news.ycombinator.com/item?id=45788012", "by": "gucci-on-fleek", "date": "2025-11-01", "stance": "recommend", "quote": "it's the only thing that stopped the bot problem for me, (2) it's really easy to deploy, and (3) very few human visitors are incorrectly blocked by it", "excerpt": "> But it still works, right? People use Anubis because it actually stops LLM bots from scraping their site, so it must work, right? > Yeah, but only because the LLM bots simply don\u2019t run JavaScript. I don't think that this is the case, because when Anubis itself switched from a proof-of-work to a different JavaScript-based challenge, my server got overloaded, but switching back to the PoW solution fixed it [0]. I als", "context": "runs a website that was overloaded by bots", "use_case": "blocking scraper bots", "switched_from": "", "story": "You Don't Need Anubis"}]}], "caveats": [{"label": "Requires JavaScript", "summary": "Visitors must run JavaScript, and one operator had to add JS to a site that used none.", "quotes": [{"id": 787449728, "item_id": 49215608, "url": "https://news.ycombinator.com/item?id=49215608", "by": "basilikum", "date": "2026-08-07", "stance": "warn", "quote": "As said Anubis is trivially bypassed.", "excerpt": "1. It makes the web more annoying and time wasting. 2. I'm a real user and I have to enable JavaScript and run arbitrary programs from untrusted websites to access them. One browser that I use doesn't even support JavaScript (w3m). Fortunately it is unaffected because it doesn't have the string \"Mozilla\" in its UA and Anubis lets every user without that pass to not hurt legitimate bots like search engine crawlers. As", "context": "", "use_case": "bot protection", "switched_from": "", "story": "99% of My Website Traffic Is Bots"}, {"id": 732608192, "item_id": 45788012, "url": "https://news.ycombinator.com/item?id=45788012", "by": "gucci-on-fleek", "date": "2025-11-01", "stance": "recommend", "quote": "it's the only thing that stopped the bot problem for me, (2) it's really easy to deploy, and (3) very few human visitors are incorrectly blocked by it", "excerpt": "> But it still works, right? People use Anubis because it actually stops LLM bots from scraping their site, so it must work, right? > Yeah, but only because the LLM bots simply don\u2019t run JavaScript. I don't think that this is the case, because when Anubis itself switched from a proof-of-work to a different JavaScript-based challenge, my server got overloaded, but switching back to the PoW solution fixed it [0]. I als", "context": "runs a website that was overloaded by bots", "use_case": "blocking scraper bots", "switched_from": "", "story": "You Don't Need Anubis"}]}, {"label": "Annoyance, accessibility", "summary": "Some find it annoying and say it can cause accessibility problems.", "quotes": [{"id": 737055985, "item_id": 46065999, "url": "https://news.ycombinator.com/item?id=46065999", "by": "Jach", "date": "2025-11-26", "stance": "warn", "quote": "them using Anubis is annoying", "excerpt": "Their \"VP of Community\" wrote this in 2020: https://kristoff.it/blog/addio-redis/ I didn't come across it until 2022. Still, particularly that and other writing from him and others convinced me the Zig community is full of goobers. That's not so bad, I have my tastes in immature humor and can sometimes be a goober too, but the application in that post's clearly-marked over-the-top skit still is just bizarre and doesn", "context": "", "use_case": "bot protection on sites", "switched_from": "", "story": null}, {"id": 785216545, "item_id": 49076034, "url": "https://news.ycombinator.com/item?id=49076034", "by": "exiguus", "date": "2026-07-27", "stance": "compare", "quote": "tools like Cloudflare and Anubis can create serous accessibility issues; some more than others.", "excerpt": "In my view, if blocking is necessary, whitelisting is generally more effective than blacklisting. And if whitelisting isn't feasible, this might be a poor solution. On the other hand, tools like Cloudflare and Anubis can create serous accessibility issues; some more than others. I prefer rate limiting; it's elegant and avoids accessibility problems. For temporary issues, short-term IP bans can also work well. Persona", "context": "", "use_case": "bot blocking on Git web UI", "switched_from": "", "story": "How to Block Some of the Bots"}, {"id": 787449728, "item_id": 49215608, "url": "https://news.ycombinator.com/item?id=49215608", "by": "basilikum", "date": "2026-08-07", "stance": "warn", "quote": "As said Anubis is trivially bypassed.", "excerpt": "1. It makes the web more annoying and time wasting. 2. I'm a real user and I have to enable JavaScript and run arbitrary programs from untrusted websites to access them. One browser that I use doesn't even support JavaScript (w3m). Fortunately it is unaffected because it doesn't have the string \"Mozilla\" in its UA and Anubis lets every user without that pass to not hurt legitimate bots like search engine crawlers. As", "context": "", "use_case": "bot protection", "switched_from": "", "story": "99% of My Website Traffic Is Bots"}]}, {"label": "Slow challenges", "summary": "One user reports challenges taking minutes on some machines.", "quotes": [{"id": 784582000, "item_id": 49036375, "url": "https://news.ycombinator.com/item?id=49036375", "by": "hedora", "date": "2026-07-24", "stance": "warn", "quote": "Is there a bypass for those yet?", "excerpt": "Is there a bypass for those yet? Not all of the machines I have run it at a reasonable pace, so I'd like to just farm the challenge to some other machine. My nice desktop that I use for C++/Rust/Formal Verification takes multiple minutes sometimes, and I'd rather not replace the motherboard over this, or figure out why it's not using the GPU/whatever. OTOH, I have a MacBook with Apple's terrible window manager. It bl", "context": "", "use_case": "proof-of-work bot challenge", "switched_from": "", "story": "I Regret Migrating to Codeberg"}]}, {"label": "Bypassable", "summary": "A critic says it is trivially bypassed and works only because AI companies ignore it.", "quotes": [{"id": 787449728, "item_id": 49215608, "url": "https://news.ycombinator.com/item?id=49215608", "by": "basilikum", "date": "2026-08-07", "stance": "warn", "quote": "As said Anubis is trivially bypassed.", "excerpt": "1. It makes the web more annoying and time wasting. 2. I'm a real user and I have to enable JavaScript and run arbitrary programs from untrusted websites to access them. One browser that I use doesn't even support JavaScript (w3m). Fortunately it is unaffected because it doesn't have the string \"Mozilla\" in its UA and Anubis lets every user without that pass to not hurt legitimate bots like search engine crawlers. As", "context": "", "use_case": "bot protection", "switched_from": "", "story": "99% of My Website Traffic Is Bots"}]}, {"label": "Mascot image", "summary": "Visitors may see an anime catgirl image on the challenge page.", "quotes": [{"id": 741100032, "item_id": 46318752, "url": "https://news.ycombinator.com/item?id=46318752", "by": "kstrauser", "date": "2025-12-18", "stance": "recommend", "quote": "I've also had enormous luck with Anubis.", "excerpt": "I love the insanity of this idea. Not saying it's a good idea, but it's a very highly entertaining one, and I like that! I've also had enormous luck with Anubis. AI scrapers found my personal Forgejo server and were hitting it on the order of 600K requests per day. After setting up Anubis, that dropped to about 100. Yes, some people are going to see an anime catgirl from time to time. Bummer. Reducing my fake traffic", "context": "runs personal Forgejo server", "use_case": "block AI scrapers on Forgejo server", "switched_from": "", "story": "Show HN: Stop AI scrapers from hammering your self-hosted blog (using porn)"}]}], "who": [{"by": "m-p-3", "context": "hosts website in Canada on own physical server", "url": "https://news.ycombinator.com/item?id=50142039", "date": "2026-10-18"}, {"by": "kstrauser", "context": "runs a Forgejo server", "url": "https://news.ycombinator.com/item?id=46837578", "date": "2026-01-31"}, {"by": "gucci-on-fleek", "context": "runs a website that was overloaded by bots", "url": "https://news.ycombinator.com/item?id=45788012", "date": "2025-11-01"}], "tags": ["self-hostable", "against AI scrapers", "Cloudflare alternative", "for Forgejo servers"], "use_cases": ["bot protection", "blocking ai crawlers", "benchmark comparison", "block scraping", "blocking llm crawlers", "proof-of-work ai scraper deterrent"], "compared": [{"slug": "cloudflare", "name": "Cloudflare", "co": 6, "switched_from": 0, "switched_to": 0}, {"slug": "cloudflare-turnstile", "name": "Cloudflare Turnstile", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "safeline", "name": "SafeLine", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "forgejo", "name": "Forgejo", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50141657", "title": "Websites are closing their doors to AI agents", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49211386", "title": "99% of My Website Traffic Is Bots", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49052564", "title": "Cloudflare's new AI traffic options for customers", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49927760", "title": "Frog and Toad and the Increasingly Capable Machines", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49766055", "title": "Is startpage.com mining Bitcoin when you open it?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49721435", "title": "Stay discoverable in search while disallowing AI training", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 2, "warn": 1}, "2025-12": {"recommend": 1, "compare": 1}, "2026-01": {"recommend": 1}, "2026-02": {}, "2026-03": {"recommend": 1}, "2026-04": {}, "2026-05": {"recommend": 1}, "2026-06": {}, "2026-07": {"warn": 1, "recommend": 1, "neutral": 1, "compare": 1}, "2026-08": {"warn": 1, "compare": 1, "recommend": 1}, "2026-09": {"neutral": 3}, "2026-10": {"neutral": 1, "recommend": 1, "compare": 1}}, "quotes": [{"id": 802382001, "item_id": 50148875, "url": "https://news.ycombinator.com/item?id=50148875", "by": "vikrantrathore", "date": "2026-10-19", "stance": "compare", "quote": "I used anubis, safeline for benchmarks compparison", "excerpt": "Yes name was anubis backwards and thats the only resemblance between the 2 projects and also I used anubis, safeline for benchmarks compparison. Each of the design records are in the repo if you want to see the evolution and algorithms used.", "context": "", "use_case": "benchmark comparison", "switched_from": "", "story": "Websites are closing their doors to AI agents"}, {"id": 802272624, "item_id": 50142039, "url": "https://news.ycombinator.com/item?id=50142039", "by": "m-p-3", "date": "2026-10-18", "stance": "recommend", "quote": "So far we use Anubis to protect our services from scraping and it's been a decent experience.", "excerpt": "We host a website in Canada (physical server hosting VMs in a Canadian DC) and with the ongoing trade-war we do whatever we can to avoid anything US-based tech such as Cloudflare. So far we use Anubis to protect our services from scraping and it's been a decent experience.", "context": "hosts website in Canada on own physical server", "use_case": "block scraping", "switched_from": "", "story": "Websites are closing their doors to AI agents"}, {"id": 798983073, "item_id": 49936442, "url": "https://news.ycombinator.com/item?id=49936442", "by": "InvisibleUp", "date": "2026-10-02", "stance": "neutral", "quote": "it seemed quite effective.", "excerpt": "Nice analogy, wonderful art. Something I've found interesting is that LLMs tend to act like this on the small scale, too. Claude Code in particular appears to be absolutely relentless in trying to come up with workarounds when faced with a block page.[1] As an experiment, a developer for Anubis recently added a feature to give the LLMs an \"easier\" problem to solve instead of straight-up blocking them, and it seemed q", "context": "", "use_case": "blocking LLM crawlers", "switched_from": "", "story": "Frog and Toad and the Increasingly Capable Machines"}, {"id": 796260656, "item_id": 49766291, "url": "https://news.ycombinator.com/item?id=49766291", "by": "treesknees", "date": "2026-09-19", "stance": "neutral", "quote": "Anubis is the one I\u2019ve seen most often, but not the only one.", "excerpt": "Doubtful. You\u2019re not going to mine a bitcoin in 30 seconds. It\u2019s been pretty popular lately to utilize a proof of work problem to deter AI scrapers. This is likely what you\u2019re seeing. Anubis is the one I\u2019ve seen most often, but not the only one. https://github.com/techaroHQ/anubis", "context": "", "use_case": "proof-of-work AI scraper deterrent", "switched_from": "", "story": "Is startpage.com mining Bitcoin when you open it?"}, {"id": 795546273, "item_id": 49721642, "url": "https://news.ycombinator.com/item?id=49721642", "by": "mskalski", "date": "2026-09-16", "stance": "neutral", "quote": "The rest probably still have to be treated with Anubis.", "excerpt": "I wonder if protocols like Web Bot Auth [1] will see wider adoption. At least as a supported mechanism for those bots which identify themselves. The rest probably still have to be treated with Anubis. In my free time I've recently been experimenting with a Web Bot Auth implementation as an Envoy dynamic module [2] to have a way to define some additional policies for the traffic from bots. [1] https://datatracker.ietf", "context": "", "use_case": "blocking unidentified bots", "switched_from": "", "story": "Stay discoverable in search while disallowing AI training"}, {"id": 793287730, "item_id": 49580483, "url": "https://news.ycombinator.com/item?id=49580483", "by": "miningtcup", "date": "2026-09-05", "stance": "neutral", "quote": "https://anubis.techaro.lol/", "excerpt": "None of the instances listed have anything like that going on. I believe that all listed instances use either https://www.cloudflare.com/products/turnstile/, https://anubis.techaro.lol/, https://git.miningtcup.me/MiningTcup/dogwaf (made by me), or nothing at all. I recommend against using instances not listed unless you know the host because there are reasons for them to not be listed. I won't elaborate on the reason", "context": "", "use_case": "bot protection for Nitter instances", "switched_from": "", "story": "Nitter has more working instances than before the takedowns"}, {"id": 792081344, "item_id": 49505084, "url": "https://news.ycombinator.com/item?id=49505084", "by": "FridgeSeal", "date": "2026-08-31", "stance": "recommend", "quote": "Evidently, it makes _enough_ of a difference for the people running it.", "excerpt": "It doesn\u2019t have to be fully sound, it\u2019s there to provide _some_ degree of interim protection. Evidently, it makes _enough_ of a difference for the people running it. Criticising it is just letting the perfect be the enemy of the good. The alternative to Anubis isn\u2019t \u201csomething better that isn\u2019t being picked\u201d, it\u2019s \u201ccompletely unprotected\u201d, and the people criticising it for being imperfect could helpfully move the con", "context": "", "use_case": "bot protection", "switched_from": "", "story": "Creepy Crawlies"}, {"id": 787514547, "item_id": 49219659, "url": "https://news.ycombinator.com/item?id=49219659", "by": "aorth", "date": "2026-08-08", "stance": "compare", "quote": "a more powerful and more reasonable self-hosted alternative to Cloudflare than Anubis", "excerpt": "This will resonate with anyone who operates a public-facing website and doesn't work at a big tech company. In the past few years I have also been down this exact same road. I'm desperately trying to avoid resorting to Cloudflare, but I'm running out of time and patience to keep tweaking nginx and firewall rules every few weeks. I had initial success with https://git.gammaspectra.live/git/go-away as a more powerful a", "context": "", "use_case": "bot protection", "switched_from": "", "story": "99% of My Website Traffic Is Bots"}, {"id": 787449728, "item_id": 49215608, "url": "https://news.ycombinator.com/item?id=49215608", "by": "basilikum", "date": "2026-08-07", "stance": "warn", "quote": "As said Anubis is trivially bypassed.", "excerpt": "1. It makes the web more annoying and time wasting. 2. I'm a real user and I have to enable JavaScript and run arbitrary programs from untrusted websites to access them. One browser that I use doesn't even support JavaScript (w3m). Fortunately it is unaffected because it doesn't have the string \"Mozilla\" in its UA and Anubis lets every user without that pass to not hurt legitimate bots like search engine crawlers. As", "context": "", "use_case": "bot protection", "switched_from": "", "story": "99% of My Website Traffic Is Bots"}, {"id": 785216545, "item_id": 49076034, "url": "https://news.ycombinator.com/item?id=49076034", "by": "exiguus", "date": "2026-07-27", "stance": "compare", "quote": "tools like Cloudflare and Anubis can create serous accessibility issues; some more than others.", "excerpt": "In my view, if blocking is necessary, whitelisting is generally more effective than blacklisting. And if whitelisting isn't feasible, this might be a poor solution. On the other hand, tools like Cloudflare and Anubis can create serous accessibility issues; some more than others. I prefer rate limiting; it's elegant and avoids accessibility problems. For temporary issues, short-term IP bans can also work well. Persona", "context": "", "use_case": "bot blocking on Git web UI", "switched_from": "", "story": "How to Block Some of the Bots"}, {"id": 784916384, "item_id": 49057274, "url": "https://news.ycombinator.com/item?id=49057274", "by": "altairprime", "date": "2026-07-26", "stance": "neutral", "quote": "Certainly, I imagine Anubis would be interested in adopting it if it\u2019s effective!", "excerpt": "As things stand right now, the current web may not be possible to maintain for old and low-end phones given the costs imposed by AI training crawlers. Please propose an alternative to both Cloudflare and Anubis, that shields websites against inhuman traffic without frequent operator intervention (or otherwise negates the capacity costs they pay for AI crawling) and is compatible with low-end smartphones. Certainly, I", "context": "", "use_case": "blocking AI crawlers", "switched_from": "", "story": "Cloudflare's new AI traffic options for customers"}, {"id": 784873168, "item_id": 49054573, "url": "https://news.ycombinator.com/item?id=49054573", "by": "gucci-on-fleek", "date": "2026-07-25", "stance": "recommend", "quote": "I really have no idea why Anubis works right now", "excerpt": "> That's a double edged sword because bots will eventually get through too, and unlike humans, their time is dirt cheap. Yeah, I really have no idea why Anubis works right now: residential proxies are far more expensive than compute, yet the bots seem to have no problem obtaining millions of residential IPs, but they give up on even short-ish Anubis challenges. > I never ran into this issue despite using seemingly ma", "context": "", "use_case": "blocking bots", "switched_from": "", "story": "Cloudflare's new AI traffic options for customers"}, {"id": 784582000, "item_id": 49036375, "url": "https://news.ycombinator.com/item?id=49036375", "by": "hedora", "date": "2026-07-24", "stance": "warn", "quote": "Is there a bypass for those yet?", "excerpt": "Is there a bypass for those yet? Not all of the machines I have run it at a reasonable pace, so I'd like to just farm the challenge to some other machine. My nice desktop that I use for C++/Rust/Formal Verification takes multiple minutes sometimes, and I'd rather not replace the motherboard over this, or figure out why it's not using the GPU/whatever. OTOH, I have a MacBook with Apple's terrible window manager. It bl", "context": "", "use_case": "proof-of-work bot challenge", "switched_from": "", "story": "I Regret Migrating to Codeberg"}, {"id": 770212384, "item_id": 48138274, "url": "https://news.ycombinator.com/item?id=48138274", "by": "wolttam", "date": "2026-05-14", "stance": "recommend", "quote": "I think the proof-of-work approach that anubis[0] takes is pretty interesting.", "excerpt": "This is just like security; the most secure system is the one that nobody can use. I think the proof-of-work approach that anubis[0] takes is pretty interesting. I love the idea of having to do a small amount of work for the author of the content in order to get access to their content. It would be interesting to a scheme where the proof-of-work that clients do in systems like anubis actually had a way to directly be", "context": "", "use_case": "blocking AI scrapers", "switched_from": "", "story": "New agents.txt file found on DreamHost"}, {"id": 761037648, "item_id": 47564853, "url": "https://news.ycombinator.com/item?id=47564853", "by": "NooneAtAll3", "date": "2026-03-29", "stance": "recommend", "quote": "I love experimental data like this.", "excerpt": "> Before it was enabled, it was getting several hundred-thousand requests each day. As soon as Anubis became active in there, it decreased to about 11 requests after 24 hours I love experimental data like this. So much better than gut reaction that was spammed when anubis was just introduced", "context": "", "use_case": "blocking bot traffic", "switched_from": "", "story": "The bot situation on the internet is worse than you could imagine"}, {"id": 749401248, "item_id": 46837578, "url": "https://news.ycombinator.com/item?id=46837578", "by": "kstrauser", "date": "2026-01-31", "stance": "recommend", "quote": "I used Anubis and a cookie redirect to cut the load on my Forgejo server by around 3 orders of magnitude", "excerpt": "I\u2019ve been enduring that exact same traffic pattern. I used Anubis and a cookie redirect to cut the load on my Forgejo server by around 3 orders of magnitude: https://honeypot.net/2025/12/22/i-read-yann-espositos-blog.html", "context": "runs a Forgejo server", "use_case": "blocking crawler traffic", "switched_from": "", "story": "Disrupting the Largest Residential Proxy Network"}, {"id": 741663312, "item_id": 46353957, "url": "https://news.ycombinator.com/item?id=46353957", "by": "s_ting765", "date": "2025-12-22", "stance": "compare", "quote": "I call it `temu` anubis.", "excerpt": "I use the same exact trick from the source the article mentions. I call it `temu` anubis. https://github.com/rhee876527/expert-octo-robot/blob/f28e48fc59b2a1b823551dfd1cb5ea6ea8bb7f88/app-charts/caddy-chart/templates/configmap.yaml#L19 Jokes aside, the whole web seems to be trending towards some kind of wall (pay, login, app etc.) and this ultimately sucks for the open internet.", "context": "", "use_case": "blocking AI crawlers", "switched_from": "", "story": "How I protect my Forgejo instance from AI web crawlers"}, {"id": 741100032, "item_id": 46318752, "url": "https://news.ycombinator.com/item?id=46318752", "by": "kstrauser", "date": "2025-12-18", "stance": "recommend", "quote": "I've also had enormous luck with Anubis.", "excerpt": "I love the insanity of this idea. Not saying it's a good idea, but it's a very highly entertaining one, and I like that! I've also had enormous luck with Anubis. AI scrapers found my personal Forgejo server and were hitting it on the order of 600K requests per day. After setting up Anubis, that dropped to about 100. Yes, some people are going to see an anime catgirl from time to time. Bummer. Reducing my fake traffic", "context": "runs personal Forgejo server", "use_case": "block AI scrapers on Forgejo server", "switched_from": "", "story": "Show HN: Stop AI scrapers from hammering your self-hosted blog (using porn)"}, {"id": 737055985, "item_id": 46065999, "url": "https://news.ycombinator.com/item?id=46065999", "by": "Jach", "date": "2025-11-26", "stance": "warn", "quote": "them using Anubis is annoying", "excerpt": "Their \"VP of Community\" wrote this in 2020: https://kristoff.it/blog/addio-redis/ I didn't come across it until 2022. Still, particularly that and other writing from him and others convinced me the Zig community is full of goobers. That's not so bad, I have my tastes in immature humor and can sometimes be a goober too, but the application in that post's clearly-marked over-the-top skit still is just bizarre and doesn", "context": "", "use_case": "bot protection on sites", "switched_from": "", "story": null}, {"id": 735717442, "item_id": 45982340, "url": "https://news.ycombinator.com/item?id=45982340", "by": "colesantiago", "date": "2025-11-19", "stance": "recommend", "quote": "If we support alternatives they can grow into an open source CDN.", "excerpt": "> Bunny has raised money from VC which indicates it\u2019s going the \u201cWall Street\u201d path. Yet it is an available alternative to Cloudflare that is not on Wall Street (a public company). If you want to do this 100% yourself there is Apache Traffic Control. https://github.com/apache/trafficcontrol > Anubis is a bot firewall not a CDN. For now. If we support alternatives they can grow into an open source CDN.", "context": "", "use_case": "bot firewall", "switched_from": "", "story": "Questions for Cloudflare"}, {"id": 732608192, "item_id": 45788012, "url": "https://news.ycombinator.com/item?id=45788012", "by": "gucci-on-fleek", "date": "2025-11-01", "stance": "recommend", "quote": "it's the only thing that stopped the bot problem for me, (2) it's really easy to deploy, and (3) very few human visitors are incorrectly blocked by it", "excerpt": "> But it still works, right? People use Anubis because it actually stops LLM bots from scraping their site, so it must work, right? > Yeah, but only because the LLM bots simply don\u2019t run JavaScript. I don't think that this is the case, because when Anubis itself switched from a proof-of-work to a different JavaScript-based challenge, my server got overloaded, but switching back to the PoW solution fixed it [0]. I als", "context": "runs a website that was overloaded by bots", "use_case": "blocking scraper bots", "switched_from": "", "story": "You Don't Need Anubis"}]}