Shield
Stop abuse. Not automation.
Free, privacy-first verification without puzzles or tracking. Shield scores every visitor invisibly from 1–100 — so you can welcome humans, route legitimate AI agents to the right endpoints, and stop abuse before it reaches your forms.
Free forever for core protection — unlimited widgets, no credit card required.
// siteverify response
{ "success": true, "score": 96 }
<15KB
JavaScript Bundle
1–100
Humanity Score
0
Cookies & Trackers
Free
Forever
How it works
From script tag to verified traffic in under five minutes.
Add the snippet
One script tag and one div with your sitekey. Works with plain HTML, React, Vue, or any framework — under five minutes to integrate.
Visitors verify invisibly
A lightweight proof-of-work runs in a background thread while risk signals are scored — and the score keeps refining as the visitor interacts. Real humans almost never see a challenge.
Validate server-side
Your server checks the response token with one API call and gets a pass/fail verdict plus a 1–100 humanity score. Tokens are single-use and expire in five minutes.
Everything Turnstile does. Less of what it costs you.
Bot protection shouldn't mean puzzles for your users, tracking scripts on your pages, or routing your traffic through someone else's network.
Invisible verification
No traffic lights, no crosswalks, no fire hydrants. Managed mode only shows a single "I am human" click to genuinely suspicious traffic.
Humanity score
Every verification returns a 1–100 score — 1 is confirmed automation, 100 a confirmed human. Allow, step up, redirect, or block: your rules, not a binary verdict.
Privacy by design
No cookies, no fingerprint database, no per-visitor storage — only hourly aggregate counters. GDPR and CCPA friendly by default, not by configuration.
Genuinely lightweight
A dependency-free widget under 15KB that solves challenges in a Web Worker. Your Core Web Vitals won't notice it exists.
Drop-in Turnstile migration
The siteverify response matches Turnstile's exactly, and compatibility mode populates the same form field. Migrate by swapping a URL and two keys.
Edge accelerated
Challenges are stateless and cryptographically signed, built to be served from Edge Network PoPs closest to your visitors.
Shadow mode & test keys
Trial Shield in report-only mode on live traffic — nothing ever blocked — and run CI against fixed test sitekeys that never touch real state.
Offline verification
Tokens are Ed25519-signed JWTs with a public JWKS endpoint. Verify them on your own server with zero network calls.
The tarpit
Repeat offenders get exponentially harder proof-of-work. Bots can keep trying — they just pay for it in electricity.
Two snippets. That's the integration.
A script tag and a div on the client, one HTTP call on your server. If you're on Turnstile today, the response format is identical — swap the URL and your keys, and you're migrated.
Sitekey + secret key model — familiar from Turnstile and reCAPTCHA
Works with SPAs, mobile web, and any backend language
Single-use tokens with short expiry, cryptographically signed
Embeddable on any site — your traffic never routes through our network
<!-- 1. On your page -->
<script src="https://shield.edge.network/api.js" defer></script>
<div class="edge-shield" data-sitekey="es_your_sitekey"></div>
// 2. On your server
POST https://shield.edge.network/siteverify
// Response
{
"success": true,
"score": 96,
"hostname": "example.com"
}
Three modes. Zero puzzles.
Choose how visible verification is — from a subtle badge to nothing at all.
Managed
Adapts automatically. Verification is invisible for real users; only suspicious traffic gets a one-click confirmation with a harder challenge.
Non-Interactive
Background verification with a small status badge. No user action, ever — traffic that fails simply doesn't get a token.
Invisible
No visible widget at all. Verification runs silently behind your forms and login pages, triggered on load or on demand.
Built for the agentic web
A growing share of legitimate traffic isn't human — shopping assistants, booking agents, and research tools acting on behalf of real people. Binary CAPTCHAs treat them all as attacks. Shield treats automation as a signal, not a verdict — you decide what happens next.
Verified agent identity
Agents that sign their requests with Web Bot Auth — the IETF standard backed by OpenAI, Google, and Amazon — are cryptographically identified, not guessed at. Confirmed crawlers like Googlebot are verified too.
Route, don't dead-end
The siteverify response tells you exactly who a verified agent is, so you can send it to your API or agent endpoints instead of a puzzle. Per-widget policies — allow, challenge, or block — put you in control.
Aggressive with the anonymous
Automation that refuses to identify itself is, by definition, the traffic you can be hard on. Clear automation signals with no declared identity floor the humanity score — declaring identity is the fast path.
Live now: Web Bot Auth verification on every challenge, reverse-DNS crawler confirmation, per-widget agent policies, and a server-side agentverify API — no widget required.
Privacy isn't a setting. It's the architecture.
Shield never stores per-visitor data — not anonymised, not aggregated per user, not at all. Verification signals are scored in memory and discarded; the only thing persisted is hourly counters. There's nothing to consent to, because there's nothing collected.
Shield Examiner
Your AI traffic analyst
Charts tell you what happened; the Examiner tells you what it means. One click turns 30 days of metrics into a plain-English review — how much bot pressure you're under, whether escalation is calibrated for your audience, what abuse signals look like, and the exact score thresholds to use in your own verification handling.
It reads hourly aggregates only. Shield holds no per-visitor data, so your visitors are never part of the analysis — there's nothing about them to analyse.
Read the Examiner docs92
/ 100
Healthy traffic with no abuse signals — humans score well, replay protection has nothing to catch, and bot pressure is low.
Escalation rate above typical range
warning25% of background attempts were escalated to a click — consistent with a VPN-heavy audience rather than an attack.
Fix: If VPN users matter to you, treat scores 30–40 as acceptable at siteverify rather than blocking.
Your users aren't robots. Stop testing them.
Invisible, privacy-first verification that welcomes humans, routes good agents, and stops abuse — free forever. Add it to your site in under five minutes.
Get Started Free