Shield
Stop abuse. Not automation.
Free, privacy-first verification without puzzles or tracking. Shield scores every visitor invisibly from 1–100 — so you can welcome humans, route legitimate AI agents to the right endpoints, and stop abuse before it reaches your forms.
Free forever for core protection — unlimited widgets, no credit card required.
// siteverify response
{ "success": true, "score": 96 }
<15KB
JavaScript Bundle
1–100
Humanity Score
0
Cookies & Trackers
Free
Forever
How it works
From script tag to verified traffic in under five minutes.
Add the snippet
One script tag and one div with your sitekey. Works with plain HTML, React, Vue, or any framework — under five minutes to integrate.
Visitors verify invisibly
A lightweight proof-of-work runs in a background thread while risk signals are scored — and the score keeps refining as the visitor interacts. Real humans almost never see a challenge.
Validate server-side
Your server checks the response token with one API call and gets a pass/fail verdict plus a 1–100 humanity score. Tokens are single-use and expire in five minutes.
Everything Turnstile does. Less of what it costs you.
Bot protection shouldn't mean puzzles for your users, tracking scripts on your pages, or routing your traffic through someone else's network.
Invisible verification
No traffic lights, no crosswalks, no fire hydrants. Managed mode only shows a single "I am human" click to genuinely suspicious traffic.
Humanity score
Every verification returns a 1–100 score — 1 is confirmed automation, 100 a confirmed human. Allow, step up, redirect, or block: your rules, not a binary verdict.
Privacy by design
No cookies, no fingerprint database, no per-visitor storage — only hourly aggregate counters. GDPR and CCPA friendly by default, not by configuration.
Genuinely lightweight
A dependency-free widget under 15KB that solves challenges in a Web Worker. Your Core Web Vitals won't notice it exists.
Drop-in Turnstile migration
The siteverify response matches Turnstile's exactly, and compatibility mode populates the same form field. Migrate by swapping a URL and two keys.
Edge accelerated
Challenges are stateless and cryptographically signed, built to be served from Edge Network PoPs closest to your visitors.
Shadow mode & test keys
Trial Shield in report-only mode on live traffic — nothing ever blocked — and run CI against fixed test sitekeys that never touch real state.
Offline verification
Tokens are Ed25519-signed JWTs with a public JWKS endpoint. Verify them on your own server with zero network calls.
The tarpit
Repeat offenders get exponentially harder proof-of-work. Bots can keep trying — they just pay for it in electricity.
Two snippets. That's the integration.
A script tag and a div on the client, one HTTP call on your server. If you're on Turnstile today, the response format is identical — swap the URL and your keys, and you're migrated.
Sitekey + secret key model — familiar from Turnstile and reCAPTCHA
Works with SPAs, mobile web, and any backend language
Single-use tokens with short expiry, cryptographically signed
Embeddable on any site — your traffic never routes through our network
<!-- 1. On your page -->
<script src="https://shield.edge.network/api.js" defer></script>
<div class="edge-shield" data-sitekey="es_your_sitekey"></div>
// 2. On your server
POST https://shield.edge.network/siteverify
// Response
{
"success": true,
"score": 96,
"hostname": "example.com"
}
Three modes. Zero puzzles.
Choose how visible verification is — from a subtle badge to nothing at all.
Managed
Adapts automatically. Verification is invisible for real users; only suspicious traffic gets a one-click confirmation with a harder challenge.
Non-Interactive
Background verification with a small status badge. No user action, ever — traffic that fails simply doesn't get a token.
Invisible
No visible widget at all. Verification runs silently behind your forms and login pages, triggered on load or on demand.
Built for the agentic web
A growing share of legitimate traffic isn't human — shopping assistants, booking agents, and research tools acting on behalf of real people. Binary CAPTCHAs treat them all as attacks. Shield treats automation as a signal, not a verdict — you decide what happens next.
Verified agent identity
Agents that sign their requests with Web Bot Auth — the IETF standard backed by OpenAI, Google, and Amazon — are cryptographically identified, not guessed at. Confirmed crawlers like Googlebot are verified too.
Route, don't dead-end
The siteverify response tells you exactly who a verified agent is, so you can send it to your API or agent endpoints instead of a puzzle. Per-widget policies — allow, challenge, or block — put you in control.
Aggressive with the anonymous
Automation that refuses to identify itself is, by definition, the traffic you can be hard on. Clear automation signals with no declared identity floor the humanity score — declaring identity is the fast path.
Live now: Web Bot Auth verification on every challenge, reverse-DNS crawler confirmation, per-widget agent policies, and a server-side agentverify API — no widget required.
Privacy isn't a setting. It's the architecture.
Shield never stores per-visitor data — not anonymised, not aggregated per user, not at all. Verification signals are scored in memory and discarded; the only thing persisted is hourly counters. There's nothing to consent to, because there's nothing collected.
Shield Examiner
Your AI traffic analyst
Charts tell you what happened; the Examiner tells you what it means. One click turns 30 days of metrics into a plain-English review — how much bot pressure you're under, whether escalation is calibrated for your audience, what abuse signals look like, and the exact score thresholds to use in your own verification handling.
It reads hourly aggregates only. Shield holds no per-visitor data, so your visitors are never part of the analysis — there's nothing about them to analyse.
Read the Examiner docs92
/ 100
Healthy traffic with no abuse signals — humans score well, replay protection has nothing to catch, and bot pressure is low.
Escalation rate above typical range
warning25% of background attempts were escalated to a click — consistent with a VPN-heavy audience rather than an attack.
Fix: If VPN users matter to you, treat scores 30–40 as acceptable at siteverify rather than blocking.
Common Questions
Including the one everyone asks: why deploy bot protection before you have a bot problem?
We don't have a bot problem. Why add Shield now?
Because "no bot problem" is usually an assumption, not a measurement — automated traffic doesn't announce itself. It shows up as inflated visitor counts, odd conversion rates, and email lists that decay faster than they should. Shield in invisible mode is a measurement instrument first: every visitor gets a 1–100 humanity score in the background, and your dashboard shows the real mix of humans, declared AI agents, and undeclared automation — without a single challenge shown. Most sites are surprised by what they see in the first fortnight.
Is Shield just a CAPTCHA replacement for once abuse starts?
That's part of it — but the reason CAPTCHAs are added reactively is that they cost conversion, so nobody wants one until they must. Shield is invisible and free, so that trade-off disappears. Running it early buys you traffic visibility, clean signup data from day one, and an agent policy that's already in place when you need it. If abuse arrives, you flip a setting instead of retrofitting a CAPTCHA under fire.
What does running Shield early actually protect?
Your data quality — which is much cheaper to keep than to recover. Fake signups skew funnel metrics and any marketing spend decisions based on them. Bot addresses on a mailing list damage sender reputation, which takes months to repair. Junk accounts pollute your CRM. Screening at the door means the numbers you make growth decisions from stay trustworthy.
What about AI agent traffic?
A growing share of web traffic is AI agents acting for real people — shopping assistants, booking agents, research tools. Shield distinguishes cryptographically verified agents (Web Bot Auth) from undeclared automation and lets you set policy per widget: welcome, challenge, or block. That's a routing question every site will face soon, independent of whether anyone is attacking you.
What does proactive deployment cost?
Close to zero. Shield is free forever — no caps, no card — integration takes about five minutes, and in invisible mode your users never see it. The only thing you spend is the embed snippet.
Your users aren't robots. Stop testing them.
Invisible, privacy-first verification that welcomes humans, routes good agents, and stops abuse — free forever. Add it to your site in under five minutes.
Get Started Free