Edge

Shield

Features

Invisible verification, a humanity score your server can act on, and privacy guaranteed by architecture rather than policy — with none of the puzzles.

Three widget modes

Managed mode adapts to the traffic: real users verify invisibly, while suspicious traffic gets a single "I am human" click backed by a harder challenge. Non-interactive and invisible modes never ask for anything.

Whatever the mode, no visitor ever labels traffic lights, transcribes text, or slides a puzzle piece. The interactive fallback is one click — and most of your users will never see it.

Capabilities

Managed: invisible for humans, one-click confirm for suspicious traffic
Non-Interactive: background verification with a subtle status badge
Invisible: no visible widget at all — verify on load or on demand
Per-widget mode configuration from the dashboard
Automatic token refresh before expiry
Explicit JavaScript API for SPAs (render, execute, reset)

Proof-of-work, not proof-of-patience

Shield issues a cryptographically signed challenge that the browser solves in a background Web Worker — tens of milliseconds on a phone, invisible to the user, and free of any impact on your Core Web Vitals.

Difficulty adapts to risk. A clean browser gets a trivial challenge; automation gets exponentially more expensive work. Bots pay in compute, humans pay nothing.

Capabilities

SHA-256 proof-of-work solved in a Web Worker
Adaptive difficulty driven by risk signals
Stateless, HMAC-signed challenges — built for edge delivery
Headless browser and automation-framework detection
Solve-time plausibility analysis
Rotating challenges with anti-replay enforcement

The humanity score

Turnstile tells you pass or fail. Shield tells you how confident it is: every verification carries a 1–100 score, where 1 is confirmed automation and 100 a confirmed human.

That granularity is yours to use. Auto-approve signups above 80, require email confirmation between 40 and 80, and below 40 choose what fits: block outright, or redirect legitimate automation to your API or agent endpoint. In a world where AI agents act for real customers, "not human" and "not welcome" are different things — thresholds and outcomes are tuned to your traffic, not ours.

Returned on every successful siteverify call
1 = confirmed automation, 100 = confirmed human
Act on it: allow, step up, redirect to your API, review, or block
Automation is a signal, not a verdict — good agents can be routed, not refused
Average score tracked per widget in analytics
Versioned feature schema — scoring improves without integration changes

// siteverify response

{

"success": true,

"score": 96,

"challenge_ts": "2026-07-19T13:00:00Z",

"hostname": "example.com",

"error-codes": []

}

96 / 100

Confident human — auto-approve

55 / 100

Uncertain — step up to email confirmation

8 / 100

Automation — block, or redirect to your API

Privacy by architecture

Most verification products promise not to misuse the data they collect. Shield doesn't collect it. Signals are scored in memory during the request and discarded; the only thing that touches a disk is hourly counters.

That means no cookie banners triggered by your bot protection, no data processing agreements for visitor data we don't hold, and no fingerprint database to breach.

Guarantees

No cookies or local storage
No fingerprint database
No per-visitor records — only hourly aggregate counters
Signals scored in memory, then discarded
Open-source client widget
GDPR / CCPA friendly by default

Integration & migration

Built to slot into your existing stack — and to make leaving your current CAPTCHA provider a one-line change.

One snippet, any stack

A script tag and a div. The widget auto-renders, appends a hidden form field, and works with plain HTML, React, Vue, or any SPA.

Turnstile-compatible siteverify

The response body matches Turnstile's exactly — success, challenge_ts, hostname, error-codes — plus our score field. Existing server code just works.

Sitekey + secret model

The key model you already know from Turnstile and reCAPTCHA. Secrets are hashed at rest and shown exactly once.

Hostname allowlists

Lock each widget to specific hostnames. Tokens minted elsewhere fail validation automatically.

WCAG 2.2 AA

No puzzles means no accessibility trade-off. The rare interactive confirmation is a real button with full ARIA support and keyboard navigation.

Isolated infrastructure

Shield runs on dedicated infrastructure at shield.edge.network. Your verification traffic never mixes with — or depends on — anything else.

Analytics dashboard

Everything you need to understand your traffic — and nothing that would compromise your visitors.

Challenge metrics

Issuance and solve rates per widget, hour by hour. See exactly how much traffic Shield is processing.

Score distribution

Average humanity score over time. A sudden drop is your early warning of a bot campaign.

Block & escalation insight

How often traffic was escalated to an interactive confirmation, failed verification, or attempted token replay.

Privacy-safe by construction

All analytics are hourly aggregates. There is no per-visitor drill-down because there is no per-visitor data.

Protection your users will never notice

Add Shield to your site in under five minutes. Free forever, no credit card required.

Get Your Sitekey