Custom & HTML guide · Self-hosted

Marech for Any HTML Site

Running a custom-built or static HTML site? Paste one script tag to monitor AI-scraper traffic — and because you control your own hosting, you can turn on real edge blocking too.

PlatformCustom / self-hostedSetup~5 minutesBlockingSupported

How Marech protects a custom HTML site

A custom or static HTML site is the most flexible case: you own the hosting, so you can run both modes — monitor everywhere with the snippet, and block scrapers at your own edge.

Mode 1

Monitoring — the snippet

One <script> tag in your <head>. Reports scraper traffic to your dashboard and overlays JS-running bots.

Mode 2

Blocking — the edge check

An nginx proxy, Cloudflare Worker, or Vercel middleware checks each request before your origin serves HTML, returning a 403 to scrapers.

Before you begin

Monitoring needs only the first two. Blocking adds the last two.

A Marech account — start a free trial.
Access to your site's HTML files or shared layout/template.
For blocking: control of your hosting (a VPS, Cloudflare, or Vercel in front of your origin).
For blocking: a Marech API key and a block policy.

Install the monitoring snippet

Paste one line of JavaScript into the <head> of your pages — or once into a shared layout to cover the whole site.

Paste inside <head>…</head>

Copy your Marech snippet

After signing up, open your Marech dashboard and click "Get Snippet Code". Copy the one-line script tag.

Open your HTML files

Open the HTML files for your site in your code editor of choice.

Paste inside the <head> tag

Paste the Marech snippet anywhere inside the <head> element, before the closing </head> tag.

Repeat for every page (or use a shared layout)

If your site uses a shared header template or layout file, paste it there once — all pages will be covered automatically.

Upload and deploy

Save your files and redeploy your site. Marech immediately starts monitoring traffic in your dashboard.

Verify monitoring is live

Deploy your change, open the site in a normal browser, and check the dashboard— your visit should appear in the traffic feed within seconds. If it doesn't, view the page source and confirm the <script> tag is present inside <head>.

Monitoring vs. blocking — the honest version

The pasted snippet reports traffic and overlays JS-running bots, but non-JS scrapers never run it. To actually block them, add a server-side integration in front of your site — an nginx proxy, Cloudflare Worker, or Vercel middleware that checks each request with a Marech API key.

Turn on real blocking (optional)

Because you control your own hosting, you can run the enforcement check at your edge. All three integrations call the same endpoint and fail open. Needs a Marech API key and a block policy.

Create an API key and a block policy

In the Marech dashboard, create an API key (shown once — copy it) and add a block policy (e.g. bot types scraper and ai_tool).

Pick the integration that matches your hosting

nginx reverse proxy for a VPS/EC2/Docker origin, a Cloudflare Worker for a Cloudflare-fronted site, or Vercel/Next.js middleware for a site on Vercel. All three call the same enforcement endpoint.

Configure it with your API URL and key

Set BLOCKME_API_URL (https://api.marech.tech) and your bm_ key, then deploy it in front of your site. Each request is checked before your origin serves any HTML; scrapers get a 403 and it fails open on any outage.

Verify it's blocking. With the integration live, a fake scraper user-agent should get a 403 while a real browser loads the page:

verify blocking

curl -A "GPTBot/1.0" -I https://yoursite.com/

The exact source for each integration (nginx config, Cloudflare Worker, Vercel middleware) lives in the marech-BD integrations directory, with setup instructions for each.

Not a developer? Let AI add it for you

Copy a prompt below and paste it into ChatGPT, Claude, or any AI assistant. It will walk you through adding Marech to your exact setup.

Basic HTML file

I have a static HTML website and I want to add this script tag to every page:

<script src="https://cdn.marech.tech/YOUR_SNIPPET_ID.js"></script>

My main page is called index.html. Please show me exactly where to paste it in my HTML file, and show me what the <head> section should look like before and after.

Multiple pages / shared layout

I have a multi-page HTML site and I want to add this script to every page:

<script src="https://cdn.marech.tech/YOUR_SNIPPET_ID.js"></script>

Walk me through the most efficient way to do this. If I have a shared header file or template (like _header.html or layout.html), show me where to paste it there. If I don't have one, show me how to add it to each page quickly.

Static site generator (Jekyll, Hugo, 11ty…)

I use a static site generator (e.g. Jekyll / Hugo / Eleventy) and I want to inject this script into the <head> of every generated page:

<script src="https://cdn.marech.tech/YOUR_SNIPPET_ID.js"></script>

Show me exactly which layout or partial file to edit and where to paste it so it appears on all pages after I build the site.

GitHub Pages / Netlify / Vercel static deploy

I host a static HTML site on GitHub Pages / Netlify / Vercel and want to add this script tag to every page:

<script src="https://cdn.marech.tech/YOUR_SNIPPET_ID.js"></script>

Walk me through: (1) which file to edit, (2) where exactly to paste the snippet, (3) how to commit and redeploy so the change goes live.

Why it matters for HTML sites

Static and custom HTML sites are high-value AI targets — your content is right there in the markup.

Training data harvesting

AI companies scrape raw HTML pages to build training datasets. Your prose, your research, your creative work — fed into models without permission or compensation.

Prompt injection via scraped content

Attackers embed hidden instructions in page text (e.g. "Ignore previous instructions…") that get lifted by AI scrapers and injected into AI pipelines downstream. Marech stops the scraper before it reads anything.

Content duplication by AI agents

Autonomous AI agents crawl HTML sites to summarize, rewrite, and republish your content — stripping traffic and SEO value. Marech fingerprints and blocks known agent user-agents in real time.

Competitor intelligence bots

Businesses deploy AI crawlers to harvest pricing, copy, and product data from competitor HTML sites. Marech detects non-human request patterns and returns a 403 before any data is read.

Troubleshooting & FAQ

Which blocking integration should I use?

Match it to your hosting: nginx reverse proxy if you run your own server (VPS/EC2/Docker), a Cloudflare Worker if your domain is fronted by Cloudflare, or Vercel/Next.js middleware if you deploy on Vercel. They're interchangeable clients of the same enforcement endpoint.

Do I need both the snippet and the edge integration?

The edge integration is what actually blocks non-JS scrapers. The snippet adds in-browser monitoring and a block overlay for JS-running bots. Running both gives you the fullest picture, but blocking works with just the integration.

Will blocking ever take my site down?

No. Every integration fails open — if the Marech API is unreachable or slow, your pages are served normally. Protection can never make your site unavailable.

Next steps

How detection works

The signals Marech uses to tell scrapers from real visitors.

All platform guides

Compare setup and blocking support across every platform.

Create an API key

The bm_ key your edge integration authenticates with.

Plans & pricing

Free 7-day trial, then pick the plan that fits your traffic.

Ready to protect your HTML site?

Free 7-day trial. No credit card required.