Shield on a Static Site

Where the check lives

Shield has two halves. The widget runs in the visitor's browser, talks only to shield.edge.network, and drops a signed token into a hidden edge-shield-response input. The check is a single HTTP call to siteverify with your secret key, which confirms the token is genuine, unexpired and unused, and returns a humanity score.

The check has to run somewhere that can hold the secret, which rules out the page itself. On a static site there's nothing on your side to run it, so from the browser the integration looks half-finished. It isn't. The widget half is done; the check simply needs a place to live, and for testing that place can be your terminal.

Test the check from your laptop

siteverify is just an HTTP call. You can make it with curl and watch the whole flow work end to end, no server required.

1. 1

   Embed the widget

   Use your real sitekey from Control → Shield. The form doesn't need a real action yet.

   <script src="https://shield.edge.network/api.js" defer></script>
   
   <form action="#" method="post">
     <input name="email" type="email" required>
     <div class="edge-shield" data-sitekey="es_your_sitekey"></div>
     <button>Send</button>
   </form>

2. 2

   Complete the widget and copy the token

   Load the page, let the widget reach its success state, then read the hidden input in the browser console. The token is a long string starting ey….

   // In your browser's console, after the widget shows its success state:
   document.querySelector('[name="edge-shield-response"]').value
   
   // Or via the JS API if you rendered the widget yourself:
   edgeShield.getResponse(widgetId)

3. 3

   Verify it from a terminal

   This is exactly the call a server would make. Your secret is also in Control → Shield. You have five minutes from the widget completing before the token expires.

   # From a terminal on your own machine. Never put the secret in your page.
   curl -X POST https://shield.edge.network/siteverify \
     -d "secret=es_secret_..." \
     -d "response=PASTE_THE_TOKEN_HERE"

   You should see the token accepted, with a score and the hostname it was minted for:

   {
     "success": true,
     "score": 87,
     "challenge_ts": "2026-09-13T20:41:12.000Z",
     "hostname": "www.example.com",
     "error-codes": []
   }

4. 4

   Run it again

   Repeat the same curl with the same token. It fails. Tokens are strictly single-use, which is what stops a bot replaying one good solve across a thousand submissions.

   {
     "success": false,
     "score": 0,
     "hostname": "www.example.com",
     "error-codes": ["timeout-or-duplicate"]
   }

<!-- Widget: always verifies, works on any hostname including localhost -->
<div class="edge-shield" data-sitekey="es_test_pass"></div>

# Terminal: always succeeds, score 90
curl -X POST https://shield.edge.network/siteverify \
  -d "secret=es_secret_test_pass" \
  -d "response=anything"

Protecting a real form

Once you're happy the check works, the question becomes: where does the form post to? Whatever answers that is where the siteverify call goes. Cheapest first:

// The whole job of the function: verify, then do the thing.
// Any serverless runtime, or a tiny Edge Compute VM, is enough.
export default async function handler(req) {
  const form = await req.formData()
  const token = form.get('edge-shield-response')

  const verify = await fetch('https://shield.edge.network/siteverify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      secret: process.env.SHIELD_SECRET,
      response: token ?? '',
      remoteip: req.headers.get('x-forwarded-for') ?? ''
    })
  }).then(r => r.json())

  if (!verify.success || verify.score < 60) {
    return new Response('Verification failed', { status: 403 })
  }

  // Verified human. Email it, post it to a webhook, write it to storage...
  await sendEmail({ to: 'hello@example.com', body: form.get('message') })
  return Response.redirect('/thanks', 303)
}

In short

• The widget works on any static site with no configuration. That half is done.
• To see the check work, grab the token from the console and curl siteverify from your terminal.
• To use the check, the form has to post somewhere that can hold the secret: a form service that supports it, or a small function or VM.
• Shield can't protect page views on a static site, and a widget with no server-side check protects nothing.