Not everything that visits your site is a visitor
Search engines, AI crawlers, scrapers and attackers reach your site alongside your customers. Klacos analyses that traffic before it gets to your application, and uses what it learns to protect your site, speed it up and measure its audience. Each visit gets the decision that fits: served, counted, slowed down or stopped.
- Starts in observation mode
- Every decision explained
- Run in the EU or on your servers
All of that traffic ends up on your infrastructure
Some of your requests don’t come from people. Search engines, which you need. AI crawlers reading your pages to train a model or to answer someone’s question. Scrapers copying your prices and articles, scanners probing for a weak spot, scripts trying passwords on your login page.
All of it comes through the same door as your customers. Your server serves it, and you pay for it. Your analytics tool counts the bots that run its script as visitors, and never sees the rest. Your ad tags report conversions that never happened. And a real attack gets lost in the noise.
How many of your visitors are actually human? Unless someone looks at the traffic where it arrives, nobody can tell you. Our guide to bots that skew your analytics explains where these fake visitors come from.
One read of every visit, then the right call
Klacos looks at every visit before your server does: how it connects, how it moves through your site, its pace, the network it comes from. From that it works out what it can: a person, a verified bot, an unwanted bot, or an unknown when the evidence isn’t there. Then it applies the policy you chose. The same read drives protection, caching, the waiting room and analytics. Here is what that means, visit by visit.
- A customer browsing Gets through
No puzzle to solve. Pages come from the cache where possible, and the visit counts in your cookieless analytics.
- The real Googlebot Gets through, counted apart
Its identity is checked with Google before it is believed. Verified bots get through and stay out of your audience figures.
- A fake Googlebot Unmasked
It borrows a search engine’s name without coming from one, and is treated as what it is: an impostor.
- An AI crawler Your call
Allow, slow down or block: you decide how AI crawlers are treated, once you have seen how much of your traffic they make up.
- A content scraper Slowed, then blocked
It works through your pages faster than any reader could. Bot management slows it down, checks it without showing anything, then stops it.
- A vulnerability scanner Stopped
It tries SQL injection and well-known paths. The web application firewall stops it before it reaches your application.
- A burst on your login page Capped
Password attempts, one after another. Rate limiting caps that route, and the rest of the site stays open.
- A sale-day crowd Queued in order
Shoppers come in at the pace your server can handle, through a waiting room where bots don’t take a single place.
- A conversion fired by a bot Not sent
Your ad tags don’t fire for bots, so your campaigns learn from real customers.
Every one of these decisions shows up in the console, with its reason. Traffic analysis shows you each group’s share, day by day.
Observe first, decide next, enforce last
Observe
The day you put Klacos in front of your site, it sees all your traffic and blocks nothing. You find out who is visiting, bots included, before you change a thing.
Decide
You choose what gets through, what slows down and what stops, site by site and traffic type by traffic type. Before a setting goes live, you replay it against your past traffic: the console shows how many requests it would have caught, and how many of those came from people. You correct it if it catches visitors you want to keep.
Enforce
One step at a time, with a one-click rollback. The web application firewall starts in observation too, and only blocks at the level you set.
The page on how bot detection works follows that path, from request to decision.
A block you can explain, and undo in one click
A block nobody can explain costs you twice: a lost customer, then a team searching in the dark. With Klacos, every decision keeps its reason and a reference.
A blocked visitor sees a page in your colours, with that reference and a link to appeal. Your support team finds it in the console, reads what happened and unblocks in one click. An API client gets a structured response a developer can read.
There is more on explained decisions.
One service in front of your site, three families of capabilities
Stop bots and attacks without getting in your visitors' way
All protection featuresBot management
Web application firewall
Rate limiting
Verified bots
AI crawler control
Access rules
SSL/TLS certificates
Explained decisions
A fast site that stays online, even when everyone turns up
All performance featuresCaching and purge
Rules and redirects
Compression and HTTP/3
Service continuity
Load balancing
Waiting room
See who visits your site, people and bots counted separately
All analytics featuresTraffic analysis
Cookieless analytics
Goals and funnels
Tag manager
Logs and exports
Sharing and teams
Each family has its own overview: protecting your site, its performance and availability, and analysing its traffic.
One service, different wins depending on your site
Online shops
Prices no longer scraped, a capped login page, a sale day without an outage, and conversions that count customers.
SaaS and APIs
An API shielded from abuse and injection, without breaking your customers’ integrations, and a reason for every refusal.
Media and publishers
See who reads your articles, decide whether AI crawlers get access, and keep an audience made of readers.
Agencies and hosts
All your clients’ sites in one console, the right access for each person, and the option to run it on your own servers.
Each has its own page: ecommerce bot protection, API abuse protection, content scraping protection for publishers and website security for agencies. Or compare every solution side by side.
Right for you, or not: best to say so up front
Klacos is right for you if
- you want to keep your hosting and your server;
- you want to know how much of your traffic is human;
- bots are costing you: server load, copied content, fake sign-ups, skewed analytics;
- you want a say in whether AI crawlers read your site;
- you want cookieless analytics that don’t count bots;
- you want to see what a setting would change before it is enforced;
- you want the option to run everything on your own servers.
It’s not the right choice if
- you need a global network of points of presence, close to every visitor;
- you’re looking for managed DNS or code running at the edge;
- you need to absorb volumetric attacks at network level;
- most of your visitors are on other continents and you don’t want to run anything yourself.
Klacos doesn’t try to do everything. It focuses on your site’s traffic: understanding it, protecting it and serving it. If you’re comparing it with the service in front of your site today, our feature-by-feature comparison sets out what you keep, what you gain and what you lose.
You choose where your traffic is handled
The managed service
Run in the European Union. Nothing to install: point your domain at it and you’re done. Early access opens in early 2027.
On your servers
A Debian package or a Docker image, and the console too if you like: everything can stay on your machines.
Running it on your own servers suits hosting providers, integrators and any team that wants a say in where its traffic goes.
The proxy has been serving our own sites since 30 September 2026
What people ask us most
Is Klacos available?
Not for general use yet: early access opens in early 2027. The proxy already serves our own sites in production.
How does early access work?
You put Klacos in front of the site of your choice, without changing hosting provider. It starts in observation mode: you see who visits your site and what each setting would have done, before it blocks anything. Then you move to enforcement, one step at a time.
How much does it cost?
From €29 a month (excluding VAT), depending on your sites' traffic. You’ll know your price before you commit.
Do I need to change hosting provider?
No. Klacos sits in front of your current server, whatever it is: nginx, Apache, object storage, a hosted CMS. Your server becomes the origin, behind it.
Do I have to switch everything on?
No. Each capability is switched on site by site: bot management, the firewall, the waiting room, analytics or tags, depending on what you need. And everything starts in observation.
Will my visitors see a CAPTCHA?
Not by default. A suspicious visit is first slowed down and checked invisibly. A visible challenge only appears if you turn it on.
Do search engines still get through?
Yes. Legitimate bots are recognised and verified rather than taken at their word, then they get through. They stay visible in your console, apart from your human audience.
What about my visitors' data?
Bot protection and analytics set no cookies and write nothing to local storage on the visitor’s device. What that means for your own compliance depends on your use: let’s discuss it before you go live.
See what Klacos would do with your traffic
Request early access: you start in observation mode, keep your hosting provider, and nothing is blocked until you decide it should be. Or talk to us about your site now.