Shield
Stop abuse. Not automation.
Free, privacy-first verification without puzzles or tracking. Shield scores every visitor invisibly from 1–100 — so you can welcome humans, route legitimate AI agents to the right endpoints, and stop abuse before it reaches your forms.
Free forever for core protection — unlimited widgets, no credit card required.
// siteverify response
{ "success": true, "score": 96 }
<15KB
JavaScript Bundle
1–100
Humanity Score
0
Cookies & Trackers
Free
Forever
How it works
From script tag to verified traffic in under five minutes.
Add the snippet
One script tag and one div with your sitekey. Works with plain HTML, React, Vue, or any framework — under five minutes to integrate.
Visitors verify invisibly
A lightweight proof-of-work runs in a background thread while risk signals are scored. Real humans almost never see a challenge.
Validate server-side
Your server checks the response token with one API call and gets a pass/fail verdict plus a 1–100 humanity score. Tokens are single-use and expire in five minutes.
Everything Turnstile does. Less of what it costs you.
Bot protection shouldn't mean puzzles for your users, tracking scripts on your pages, or routing your traffic through someone else's network.
Invisible verification
No traffic lights, no crosswalks, no fire hydrants. Managed mode only shows a single "I am human" click to genuinely suspicious traffic.
Humanity score
Every verification returns a 1–100 score — 1 is confirmed automation, 100 a confirmed human. Allow, step up, redirect, or block: your rules, not a binary verdict.
Privacy by design
No cookies, no fingerprint database, no per-visitor storage — only hourly aggregate counters. GDPR and CCPA friendly by default, not by configuration.
Genuinely lightweight
A dependency-free widget under 15KB that solves challenges in a Web Worker. Your Core Web Vitals won't notice it exists.
Drop-in Turnstile migration
The siteverify response matches Turnstile's exactly, and compatibility mode populates the same form field. Migrate by swapping a URL and two keys.
Edge accelerated
Challenges are stateless and cryptographically signed, built to be served from Edge Network PoPs closest to your visitors.
Two snippets. That's the integration.
A script tag and a div on the client, one HTTP call on your server. If you're on Turnstile today, the response format is identical — swap the URL and your keys, and you're migrated.
Sitekey + secret key model — familiar from Turnstile and reCAPTCHA
Works with SPAs, mobile web, and any backend language
Single-use tokens with short expiry, cryptographically signed
Embeddable on any site — your traffic never routes through our network
<!-- 1. On your page -->
<script src="https://shield.edge.network/api.js" defer></script>
<div class="edge-shield" data-sitekey="es_your_sitekey"></div>
// 2. On your server
POST https://shield.edge.network/siteverify
// Response
{
"success": true,
"score": 96,
"hostname": "example.com"
}
Three modes. Zero puzzles.
Choose how visible verification is — from a subtle badge to nothing at all.
Managed
Adapts automatically. Verification is invisible for real users; only suspicious traffic gets a one-click confirmation with a harder challenge.
Non-Interactive
Background verification with a small status badge. No user action, ever — traffic that fails simply doesn't get a token.
Invisible
No visible widget at all. Verification runs silently behind your forms and login pages, triggered on load or on demand.
Built for the agentic web
A growing share of legitimate traffic isn't human — shopping assistants, booking agents, and research tools acting on behalf of real people. Binary CAPTCHAs treat them all as attacks. Shield treats automation as a signal, not a verdict — you decide what happens next.
Score, don't guess
A low score means automation — it doesn't mean malicious. The score plus your context makes the call, not a black box.
Redirect, don't dead-end
Send verified automation to your API, docs, or agent endpoints instead of a puzzle it can't solve. Good agents become good traffic.
Block what's actually abusive
Credential stuffing, spam floods, and scraping abuse still get stopped cold — abuse is about behaviour, not whether the visitor is human.
On the roadmap: first-class agent identification, so verified agents can declare who they are and get the fast path automatically.
Privacy isn't a setting. It's the architecture.
Shield never stores per-visitor data — not anonymised, not aggregated per user, not at all. Verification signals are scored in memory and discarded; the only thing persisted is hourly counters. There's nothing to consent to, because there's nothing collected.
Your users aren't robots. Stop testing them.
Invisible, privacy-first verification that welcomes humans, routes good agents, and stops abuse — free forever. Add it to your site in under five minutes.
Get Started Free