everywall/ladder

What it does

Ladder is a self-hosted HTTP web proxy written in Go. It fetches a target page on the server side, then applies configurable modifications to the outgoing request and the returned response before sending the page to your browser. The typical use is observing how a site serves content to different client identities and how it reacts to altered CORS, CSP, referer, cookie or user-agent headers.

The core mechanism is a two-stage pipeline: request modifications are applied before fetching the site, and result modifications are applied to the returned HTML, CSS, JS and images. Domain-based YAML rulesets drive header overrides, regex replacements, HTML/CSS/JS injections and URL rewrites. It can also return raw HTML or JSON through /raw/ and /api/ paths, and it can load rulesets from a local file, a directory or a remote URL.

It is aimed at developers, researchers and publishers who need to inspect or debug paywall configuration, access controls and header behavior. The README frames it as legitimate testing, research and QA, while the repository topics include paywall and CORS bypass, so the intended audience may also include people studying those mechanisms.

Quick start

Run the container with a ruleset and open the proxy page:

docker run -p 8080:8080 -d \
  --env RULESET=https://raw.githubusercontent.com/everywall/ladder-rules/main/ruleset.yaml \
  --name ladder ghcr.io/everywall/ladder:latest

Then open http://localhost:8080, enter a target URL and press Enter. You can also paste a proxied URL directly in the form http://localhost:8080/https://www.example.com, or call the JSON API with curl -X GET "http://localhost:8080/api/https://www.example.com" for a structured response.

Alternative entry points from the README:

• Download a prebuilt binary from the releases page and run ./ladder -r https://raw.githubusercontent.com/everywall/ladder-rules/main/ruleset.yaml.
• Use the provided docker-compose.yaml or the Helm chart for Kubernetes deployments.
• Fetch raw HTML with http://localhost:8080/raw/https://www.example.com or inspect the active ruleset at http://localhost:8080/ruleset.

Configuration

All runtime behavior is controlled through environment variables. Key options include PORT (default 8080), USER_AGENT (defaults to a Googlebot string), X_FORWARDED_FOR (defaults to 66.249.66.1), USERPASS for Basic Auth, RULESET for the ruleset location, ALLOWED_DOMAINS for a domain allowlist, and EXPOSE_RULESET for making your ruleset available to other instances.

Custom rules live in a YAML file or directory. Each rule targets a domain and can override request or response headers, replace content with regex rules, inject HTML at specific DOM positions, or rewrite URL query, domain and path segments. A basic shared ruleset is available in the ladder-rules repository.

For sites protected by Cloudflare or JavaScript challenges, Ladder can be paired with FlareSolverr by setting FLARESOLVERR_HOST and marking specific domains with useFlareSolverr: true. This adds latency and resource usage because FlareSolverr runs a headless browser; enable it only for domains that need it.

Constraints and operational notes

• The README explicitly says Ladder does not circumvent advanced anti-automation mechanisms such as fingerprinting, rate limiting or behavioral analysis, and that results may break on sites that actively restrict access.
• If the instance is publicly reachable, the README warns that Basic Auth should be enabled; otherwise anyone can use your proxy, including for illegal content, and the operator may be held responsible.
• Access can be limited to a list of domains through ALLOWED_DOMAINS and optionally combined with domain entries from the ruleset.
• Windows binaries are listed as untested. Container images support amd64 and arm64.
• The project is licensed under GPL-3.0.

HotRepo's take

Ladder has around 9.4k stars and 541 forks. In the Go daily ranking for 2026-11-11 it was placed 12th with 6 stars gained that day. That single snapshot shows it was still being discovered in the Go ecosystem at that date, but the available data is too thin to describe a growth trend or a sustained ranking pattern.

The more meaningful signal is the gap between how the README presents the tool and how the repository tags it. The README markets Ladder as a developer testing and QA utility for header and paywall behavior, while the listed topics and the FlareSolverr section make it clear that access-control bypassing is a practical use case. Anyone evaluating it for production or research use should read the ruleset examples and the FlareSolverr notes closely, because the tool's behavior depends heavily on per-domain configuration and on the target site's own anti-automation measures.

Project source and documentation