For business · heySec Shield

Bot protection without the puzzle.

heySec Shield keeps automated visitors out of your sign-ups, logins, comments and checkout, and asks people for as little as it can.

What visitors see

Mostly nothing

Shield judges each visit while the page is in use, and only asks a person for something when it has to.

Nothing
Most visits. The check runs in the background and the form is sent as usual.
One click
When Shield is unsure: a single checkbox, “Confirm you’re a person”. No pictures to pick, no letters to decode.
A short wait
Rarely. The browser does a little work first, with the expected time shown, then asks for the click.
Open to everyone
It works with a keyboard and a screen reader, has no time limit and follows reduced-motion settings. It speaks every official EU language, and English.

How it works

One script on the page. One check on your server.

  • Mark the form. Add the script once and one attribute to each form you want protected, including forms your page adds later.
  • A one-time token. When the form is sent, the browser adds a token that works once and can be tied to the fields you choose.
  • Your server asks. Before it acts, your server sends the token to Shield and gets a decision back: allow, deny, or pretend it worked.
  • On WordPress, no code. The heySec Shield plugin covers logins, registration, comments, WooCommerce checkout and the common form plugins.

On your page

<script src="https://shield.heysec.com/v1/[email protected]"
  integrity="sha384-5kXXesFdJILdOedHPf5136zY8yeY+EXCUnl+Pe8PCEnhTb6ONOBwZITy54sl3FSF"
  crossorigin="anonymous" async></script>

<form method="post" action="/contact"
  data-shield-site="hssk_…" data-shield-action="contact">

On your server

curl https://shield.heysec.com/v1/verify \
  -H "Authorization: Bearer $HEYSEC_SHIELD_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"token": "v1.…", "remoteip": "203.0.113.7",
       "action": "contact"}'

Answer, in short

{"success": true, "decision": "allow",
 "verdict": "human", "action": "contact"}

Your rules

You decide what happens next

Shield tells your server what it saw. Your site sets what to do about it, action by action: sign-ups, logins, comments, checkout and the rest.

  • Watch first. A new site starts in watch mode: nothing is blocked while you see what Shield would decide. Switch to enforce when you are ready.
  • Or pretend it worked. Instead of refusing, a form can show its usual thank-you and keep and send nothing.
  • Crawlers and agents on your terms. Search engines are recognised by what their operators publish, never by name alone, and AI agents that sign their requests are recognised as agents. Let each kind in, or refuse it. Where this data comes from
  • Tell Shield when it got one wrong. Report a missed bot or a stopped person from your server.

Private first

What people type stays theirs

Shield never stores what a person types. It keeps what it needs to tell people from programs, and little else.

What Shield keeps, and for how long

  • Tested on every release. A test types a unique marker into a protected form, then searches every log and store for it. If it turns up anywhere, the release fails.
  • No cookies of its own. Shield’s servers set and read none. Whole-site protection uses one cookie, on your own domain, set by your own server.
  • The verdict goes to your server only. What the browser hears from Shield carries no decision, score or reason.
  • Coarse values only. The check looks at broad facts about the browser, such as its name and version, or a yes or no.
  • Run from the EU. heySec is an EU company. All servers and data are hosted within the EU.

Where you add it

On a form, or in front of the whole site

Forms and logins

A script and a check

Order Shield in the heySec portal, add your site and get its keys and the install guide. Then follow every check, your rules and what you reported, all in one place.

Join the waitlist

Whole sites

In front of every page

Every visitor is checked once, and people who pass go straight through. Search engines and agents you allow are let in. It runs in your own web server, framework or edge platform.

Ask about whole sites

Questions, answered

Does it stop every bot?

No, and no bot protection does. A determined attacker, or a person paid to fill in forms by hand, can still get through. Shield stops cheap automation and makes the rest slow and costly. Start in watch mode to see how it judges your own traffic before it blocks anything.

Can it stop a real person?

Rarely, yes: any judgement about a visit can be wrong. When Shield is unsure it asks for one click instead of refusing, a failed check can offer a “Contact us another way” link, and your server can report a person who was stopped.

What if Shield cannot be reached?

You choose in advance whether your site lets visitors through or refuses them. Either way it is written to your log, so nothing fails silently.

Can I switch from another CAPTCHA?

Yes. Shield can fill the same form field as Cloudflare Turnstile, hCaptcha or reCAPTCHA and answers the same verification request, so a switch usually means changing two addresses.

What happens to a bot that is caught?

Whatever your rules say for that action: refused with the form’s usual error, or shown the usual thank-you while nothing is kept or sent.

Keep your forms open to people

heySec Shield is in private testing. Join the waitlist and we will invite you as places open.

Join the waitlist