> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/TecharoHq/Anubis/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Protect your website from AI scraper bots using proof-of-work challenges

## What is Anubis?

Anubis is a Web AI Firewall Utility that protects websites from AI scraper bots using SHA-256 proof-of-work challenges. It acts as a reverse proxy between your users and your application, weighing the soul of each connection to ensure legitimate traffic reaches your backend.

Built in Go, Anubis is lightweight and designed to help protect the small internet from the endless storm of AI scraper requests that flood in from AI companies.

<CardGroup cols={2}>
  <Card title="SHA-256 proof-of-work" icon="lock">
    Client-side computational challenges that are expensive for bots but transparent for browsers
  </Card>

  <Card title="Policy-based detection" icon="shield">
    Flexible YAML policies to identify and handle bots using user agents, paths, headers, and CEL expressions
  </Card>

  <Card title="JWT authentication" icon="key">
    Secure token-based session management with ED25519 or HS512 signing
  </Card>

  <Card title="Multiple storage backends" icon="database">
    In-memory, bbolt, Valkey, or S3-compatible storage for challenge state
  </Card>

  <Card title="Thoth integration" icon="globe">
    Optional IP reputation database for GeoIP and ASN-based filtering
  </Card>

  <Card title="Reverse proxy" icon="arrow-right-arrow-left">
    Built-in reverse proxy with TLS support, unix sockets, and custom headers
  </Card>
</CardGroup>

## How it works

Anubis sits in front of your web application as a reverse proxy. When a request comes in:

1. **Policy evaluation**: Anubis checks the request against your configured bot policies
2. **Action determination**: Based on the matching rule, Anubis can:
   * **ALLOW**: Pass the request directly to your backend
   * **CHALLENGE**: Present a proof-of-work challenge to verify the client is a real browser
   * **DENY**: Block the request entirely
   * **WEIGH**: Adjust a weight score that feeds into threshold-based rules
3. **Challenge validation**: If challenged, the browser solves a SHA-256 puzzle and receives a JWT cookie
4. **Future requests**: The JWT cookie allows subsequent requests to bypass challenges

The proof-of-work challenge is transparent to legitimate users (browsers solve it in milliseconds) but expensive for scrapers trying to make thousands of requests.

## Key features

### Flexible bot detection

Define bot rules using multiple criteria:

* User-Agent regex patterns
* Path-based matching
* Header inspection
* CIDR ranges for IP filtering
* GeoIP and ASN filtering (with Thoth)
* Custom CEL expressions for complex logic

### Multiple challenge algorithms

Anubis supports several challenge types defined in `lib/challenge/`:

* **fast**: Default SHA-256 proof-of-work optimized for speed
* **slow**: CPU-intensive variant to punish aggressive scrapers
* **metarefresh**: HTTP meta refresh for clients without JavaScript
* **preact**: Interactive browser-based challenge

### Production-ready features

* Configurable difficulty levels (0-64 leading zero bits)
* Cookie domain management with dynamic domain support
* Base path prefix support for hosting under subpaths
* Prometheus metrics at `/metrics`
* Health check endpoint at `/healthz`
* Hot-reloadable policy configurations
* Structured logging with configurable levels

## When to use Anubis

Anubis is designed for situations where:

* You're experiencing high load from AI scraper bots
* You can't or don't want to use commercial bot protection services
* You need fine-grained control over which bots to allow or block
* You want a self-hosted, open-source solution
* Your infrastructure can run a Go binary or Docker container

<Warning>
  Anubis is a nuclear response that will block smaller scrapers and may inhibit "good bots" like the Internet Archive. You can configure [bot policy definitions](/admin/policy-configuration) to explicitly allowlist them.
</Warning>

## Important considerations

**This is security software.** Anubis is designed to protect your application from potentially adversarial traffic. Configuration errors can result in:

* Blocking legitimate users
* Allowing bot traffic through
* Session invalidation on restart (if not using persistent storage with signing keys)

**Default policies are aggressive.** The built-in configuration blocks most AI/LLM bots by default and allows major search engines. You should review and customize the policy for your use case.

## Next steps

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Get Anubis running in minutes with Docker
  </Card>

  <Card title="Configuration" icon="gear" href="/installation/configuration">
    Learn how to configure Anubis for your environment
  </Card>

  <Card title="Bot policies" icon="shield-halved" href="/admin/policy-configuration">
    Understand how to write effective bot detection rules
  </Card>

  <Card title="Deployment" icon="server" href="/deployment/reverse-proxy">
    Deploy Anubis behind your reverse proxy
  </Card>
</CardGroup>