Marech Docs
Marech stops AI scrapers from harvesting your website's content. It works in two modes — monitor anywhere, block where you control the edge. Start here to understand the difference, then jump to the guide for your platform.
Start here
Three ways in, depending on what you want to do right now.
The two protection modes
Understand this first — it decides what you can actually stop.
1 · Monitoring (the snippet)
Paste one line of JavaScript into your site's <head>. It runs in the visitor's browser, reports traffic to your dashboard, and overlays JS-running bots. Works anywhere — but a non-JS scraper never runs it, so it can't block those.
2 · Blocking (the edge integration)
A Cloudflare Worker, WordPress plugin, Vercel middleware, or nginx proxy checks each request before your content is served and returns a 403 for bots. This is the only thing that stops curl / python-requests / GPTBot. Needs an API key and a block policy.
Core concepts
The handful of terms that show up across the dashboard and these guides.
The snippet
One line of JavaScript served per account. Runs in the visitor's browser, reports page views, and overlays JS-running bots. Find yours on the Snippet page.
API key
A secret bm_ key that authenticates your server-side integration. Created on the API Keys page and shown once at creation.
Policy
The rules that decide what gets blocked — by bot type, path, or schedule. Enforcement honors the same policies the dashboard shows. Manage them on Policies.
Traffic logs
Every decision — bot type, path, action — recorded and scoped to your account. Browse or export them from Traffic Logs.
Fail-open
Every server-side integration serves your page normally if Marech is ever unreachable or slow. Protection can never take your site offline.
Monitor vs. block
Monitoring sees traffic (any platform). Blocking stops non-JS scrapers before content is served (only where you control the edge). Most people monitor first, then block.
How it fits together
Two request paths: the snippet reports visits for monitoring; the edge check enforces blocking before your origin responds.
Monitoring (any platform)
Browser ──▶ your site ──▶ loads snippet ──▶ POST /v1/decisions ──▶ Dashboard
(reports the visit)
Blocking (where you control the edge)
Scraper ──▶ [edge check] ──▶ POST /v1/enforce ──▶ block? ──▶ 403 (content never served)
worker/plugin/ └▶ allow ──▶ your origin
middleware/nginxYour dashboard data is scoped to your account, and both paths evaluate the same policies — so what counts as a bot is consistent whether you're only monitoring or actively blocking.
How detection works
Marech weighs several independent signals to tell an automated scraper from a real visitor. At a high level:
Known-bot database
A continuously updated list of known AI scrapers and crawlers — GPTBot, ClaudeBot, CCBot, Amazonbot, PerplexityBot, and more — matched on each request.
Behavior signals
Requests that look automated — missing or inconsistent headers, non-human timing, and whether the client executes JavaScript — are weighed together, so bots that spoof a browser user-agent still stand out.
Network origin
Real people browse from home and mobile networks; scrapers tend to run from cloud datacenters. Requests from datacenter ranges are flagged accordingly.
You stay in control of what happens to a flagged request via policies. For a walkthrough of the decision flow, see How Marech Works.
Guides by platform
Whether a platform can block comes down to who owns the request path. If you (or Cloudflare) can sit in front of the server, you can block; fully-hosted builders can only monitor.
Real blocking
Monitoring only
integrations/ directory on GitHub, with setup instructions for each.Reference
Quick commands to confirm each mode is working. Swap in your own snippet ID, API key, and domain.
curl https://api.marech.tech/cdn/<snippetId>.js
curl -i -X POST https://api.marech.tech/v1/enforce \
-H "Content-Type: application/json" -H "X-API-Key: bm_..." \
-d '{"userAgent":"Mozilla/5.0 (compatible; GPTBot/1.0)","ip":"1.2.3.4","path":"/"}'A blocked request responds with 403 and the header X-Blockme-Action: block.