Shield
Features
Invisible verification, a humanity score your server can act on, and privacy guaranteed by architecture rather than policy — with none of the puzzles.
Three widget modes
Managed mode adapts to the traffic: real users verify invisibly, while suspicious traffic gets a single "I am human" click backed by a harder challenge. Non-interactive and invisible modes never ask for anything.
Whatever the mode, no visitor ever labels traffic lights, transcribes text, or slides a puzzle piece. The interactive fallback is one click — and most of your users will never see it.
Capabilities
Proof-of-work, not proof-of-patience
Shield issues a cryptographically signed challenge that the browser solves in a background Web Worker — tens of milliseconds on a phone, invisible to the user, and free of any impact on your Core Web Vitals.
Difficulty adapts to risk. A clean browser gets a trivial challenge; automation gets exponentially more expensive work. Bots pay in compute, humans pay nothing.
Capabilities
The humanity score
Turnstile tells you pass or fail. Shield tells you how confident it is: every verification carries a 1–100 score, where 1 is confirmed automation and 100 a confirmed human.
That granularity is yours to use. Auto-approve signups above 80, require email confirmation between 40 and 80, and below 40 choose what fits: block outright, or redirect legitimate automation to your API or agent endpoint. In a world where AI agents act for real customers, "not human" and "not welcome" are different things — thresholds and outcomes are tuned to your traffic, not ours.
// siteverify response
{
"success": true,
"score": 96,
"challenge_ts": "2026-07-19T13:00:00Z",
"hostname": "example.com",
"error-codes": []
}
Confident human — auto-approve
Uncertain — step up to email confirmation
Automation — block, or redirect to your API
Privacy by architecture
Most verification products promise not to misuse the data they collect. Shield doesn't collect it. Signals are scored in memory during the request and discarded; the only thing that touches a disk is hourly counters.
That means no cookie banners triggered by your bot protection, no data processing agreements for visitor data we don't hold, and no fingerprint database to breach.
Guarantees
Integration & migration
Built to slot into your existing stack — and to make leaving your current CAPTCHA provider a one-line change.
One snippet, any stack
A script tag and a div. The widget auto-renders, appends a hidden form field, and works with plain HTML, React, Vue, or any SPA.
Turnstile-compatible siteverify
The response body matches Turnstile's exactly — success, challenge_ts, hostname, error-codes — plus our score field. Existing server code just works.
Sitekey + secret model
The key model you already know from Turnstile and reCAPTCHA. Secrets are hashed at rest and shown exactly once.
Hostname allowlists
Lock each widget to specific hostnames. Tokens minted elsewhere fail validation automatically.
WCAG 2.2 AA
No puzzles means no accessibility trade-off. The rare interactive confirmation is a real button with full ARIA support and keyboard navigation.
Isolated infrastructure
Shield runs on dedicated infrastructure at shield.edge.network. Your verification traffic never mixes with — or depends on — anything else.
Analytics dashboard
Everything you need to understand your traffic — and nothing that would compromise your visitors.
Challenge metrics
Issuance and solve rates per widget, hour by hour. See exactly how much traffic Shield is processing.
Score distribution
Average humanity score over time. A sudden drop is your early warning of a bot campaign.
Block & escalation insight
How often traffic was escalated to an interactive confirmation, failed verification, or attempted token replay.
Privacy-safe by construction
All analytics are hourly aggregates. There is no per-visitor drill-down because there is no per-visitor data.
Protection your users will never notice
Add Shield to your site in under five minutes. Free forever, no credit card required.
Get Your Sitekey