A speed bump for industrial scraping
Anubis is a reverse-proxy filter built around a simple economic idea. A normal visitor loads a page occasionally, so asking that browser to calculate a SHA-256 proof-of-work result costs little in aggregate. A scraper requesting pages at industrial scale must repeat the work constantly. The server verifies a successful nonce with one hash, then gives the visitor a temporary pass cookie.
This does not prove that a visitor is human. The project says some bots can solve the challenge and describes proof-of-work as a good-enough placeholder while fingerprinting improves. What it does is shift cost toward bulk clients and protect an upstream site from immediately processing every request. That can be valuable for a small forge, documentation site, archive, or community server whose capacity is being consumed by AI crawlers.
Anubis is also unusually candid about when not to use it. Its README calls the approach a nuclear response, warns that smaller and good crawlers may be blocked, and says most sites can probably use Cloudflare instead. Self-hosting is the reason to choose Anubis, not an assumption that it provides better identification than a large managed edge.
Policies matter more than challenge difficulty
Anubis can allow, deny, challenge, or adjust the suspicion weight of a request. Rules can match user agents, paths, remote address ranges, headers, and expressions. Standard policy snippets cover known crawlers and clients, while imports let administrators compose a local policy without copying every upstream rule. Prometheus metrics expose named-rule outcomes, which is necessary for tuning.
The default posture is intentionally aggressive. Documentation says browser-like clients, usually those with Mozilla in the user agent, are challenged. It also notes that RSS readers and other bot-looking clients may be legitimate. Small browsers such as Dillo, NetSurf, and Pale Moon need an optional standard rule to bypass expensive challenges. Good search and archive bots may need verified address rules.
That means the main operating job is classification, not picking a larger difficulty number. A broad catch-all rule can create false positives, punish assistive or low-power clients, and damage discovery. Raising proof-of-work cost also taxes legitimate visitors. Start with the supplied policies, record which rules fire, and add narrow exceptions from observed traffic. Anubis should reduce abusive load without becoming the main reason users cannot reach the site.
The proxy diagram hides important work
The expected path is load balancer or TLS terminator, then Anubis, then the application. Docker Compose can start an Anubis container beside Nginx, and the project documents Nginx, Caddy, Apache, HAProxy, Traefik, Kubernetes, native packages, and beta Windows Server support. The Go service itself has modest stated requirements.
A dependable deployment still requires correct routing in both directions. The proxy must pass the real client address and prevent users from spoofing trusted headers. Anubis documents a specific X-Forwarded-For failure: with a public proxy such as Cloudflare in the chain, it can select the proxy address instead of the visitor. The result may be universal blocking or an endless challenge loop. Administrators may need to normalize the header or configure a dedicated real-IP header.
Cookies add another layer. Secure, SameSite, partitioned, domain, and expiration settings must match the site's HTTPS and embedding behavior. Release 1.27.0 began deriving cookie names from settings because browsers can retain same-named cookies with different attributes, previously causing infinite challenge loops after a configuration change. Open issue #1851 says the documented COOKIE_PARTITIONED default lagged the release and describes Firefox rejecting cookies after an upgrade when combined with insecure-cookie settings. Test upgrades with old browser state, not only clean sessions.
Production needs state and escape routes
The default in-memory store makes a demo easy, but the policy documentation says not to use it persistently in production and notes that it currently has no size limit. A single host can use bbolt, which takes an exclusive database lock. Multiple replicas can share Valkey, S3-compatible object storage, or another documented network backend, each with its own request and operations cost. Persistent stores require a stable Ed25519 or HS512 secret so outstanding challenges survive restarts, and every instance on the same base domain must agree on that key.
Plan a bypass before going live. Health checks, monitoring systems, APIs, Git clients, mobile applications, and webhooks cannot be assumed to complete a browser challenge. Policies should explicitly allow or authenticate those paths and clients. A direct administrative route can keep an application reachable when a cookie, header, or rule change locks out normal traffic.
WebSockets deserve separate testing. The installation guide says Anubis may be a poor fit for applications with long-lived WebSocket connections and acknowledges limited experience. Open issue #1847 also reports browsers occasionally getting stuck after solving a challenge, possibly around service restarts. That report is not proof of a general outage pattern, but it reinforces the need for realistic session and restart tests.
Fast-moving and well documented
The repository was pushed on August 10, 2026, two days after version 1.27.0. The combined open count of 346 includes issues and pull requests. Recent work covers crawler ranges, cookie behavior, proxy configurations, translations, dependency updates, and bug reports, so the large queue sits alongside very active maintenance rather than a stale codebase. More than 21,000 stars and packaging across several ecosystems show considerable attention for a project created in 2025.
Documentation is a major strength. It goes well beyond a container example into proxy-specific layouts, a policy language, storage choices, metrics protection, header caveats, cookies, bot lists, and design rationale. The project also labels Windows Server support as beta and admits uncertainty around WebSockets instead of projecting certainty.
Choose Anubis when scraper pressure threatens availability and retaining infrastructure control matters more than invisible access. Treat it as a tunable traffic filter, not a truth machine. The best deployment is not the one with the hardest challenge; it is the one that measurably lowers waste while legitimate readers, tools, archives, and integrations continue to work.