21.7k stars · MIT · v1.27.0 (2026-08-08), read from /releases/latest; the yearless '08 Aug' resolves to 2026 because it is in the past, and ungh.cc/repos/TecharoHQ/anubis/releases/latest confirms 2026-08-08 · Track this in Scout
It makes a visiting browser do a small piece of work before a page is served, which most scrapers will not pay for.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A small program written in Go that sits between the internet and a website, in front of the web server. It checks each request, lets the ones it recognises through, and gives everything else a puzzle that a browser solves with JavaScript before it is allowed past.
What it is good for. Anyone hosting original writing, documentation or source code that keeps being downloaded in bulk. Several open-source projects have put it in front of their code-hosting pages after scrapers made those pages slow for humans. The same problem appears on a much smaller scale on a personal site with a long archive: the traffic graph goes up, the reader count does not, and the hosting bill follows the traffic. Asking politely does not work, because the polite request is the one in robots.txt and it is ignored. This is the version that does not ask.
- MIT, which is a permissive licence: you may use it in a commercial product with no conditions beyond keeping the notice.
- It ships as a single program and as a container image (a container is a sealed box that holds a program and everything it needs, so it cannot break anything else on the machine), and it sits behind nginx, Caddy or Traefik without changing them.
- The rules are ordinary text files, so you can let through the search engines you want, the RSS readers you want, and anything else you name.
- The puzzle needs JavaScript. A text-only browser, some accessibility setups and some older devices will simply not get through, and that is a real cost, not a theoretical one.
- Every real visitor pays a small delay on the first page, and on an old phone it is longer than on a laptop.
- It is one more program in front of the website. If it stops, the site stops.
ai-robots-txt/ai.robots.txtIt also targets AI scrapers, but it publishes a list of their names for robots.txt, which is a request they can ignore, where this one refuses them outright.
Track this in Scout
altcha-org/altchaIt uses the same proof-of-work idea, but it guards a single form against spam rather than guarding every page of a site.
Track this in Scout- fail2ban/fail2ban
It also blocks unwanted traffic, but it reacts to bad behaviour already in the log and bans addresses, where this one challenges every visitor up front.
Track this in Scout
# the container image, put in front of an existing web server docker run --rm -p 8923:8923 \ -e BIND=":8923" \ -e TARGET="http://localhost:3000" \ -e DIFFICULTY=4 \ ghcr.io/techarohq/anubis:latest # then point your reverse proxy at port 8923 instead of port 3000
