What enters through an unprotected form

ProblemDetail
Invalid lead emails Undeliverable, disposable, role-based, or mistyped addresses that pollute client CRMs and waste follow-up
Spam bots Automated submissions that flood inboxes, distort campaign reporting, and waste team time
Malicious file uploads PDFs and Office documents submitted through upload fields that contain malware, macros, or phishing links
CAPTCHA friction Traditional CAPTCHAs hurt conversion and frustrate legitimate visitors — Shield is invisible

Start with email validation at submission

Send the submitted address to the email scan endpoint before the lead reaches the client CRM. Verifence checks deliverability, disposable and role-based accounts, free providers, and common typos. When Shield is also enabled, you can pass the email to siteverify to enforce your account's Email Rules in the same request:

JSON
{
  "secret": "your_secret_key",
  "token": "<shield token>",
  "email": "user@example.com"
}

Use the returned verdict to accept, correct, review, or reject the address before it becomes a lead. Existing lists can be cleaned in bulk through Email Validation.

Add bot protection with Shield

Shield is an invisible bot-protection widget that embeds in any form. No checkbox, no image puzzle — legitimate users never know it's there.

How it works

  1. 1The Shield widget script loads with your form
  2. 2On page load, the browser solves a proof-of-work challenge in the background
  3. 3When the form is submitted, a signed token is included automatically
  4. 4Your server sends the token to the siteverify endpoint
  5. 5Verifence returns a success verdict and risk score — reject if success: false

What Shield checks

  • ✓Proof-of-work — The browser must complete a computational challenge; bots typically can't or won't
  • ✓Browser fingerprinting — Headless browsers, WebDriver, and automation frameworks are flagged
  • ✓Behavioral signals — Instant submissions, no mouse movement, and uniform keystroke timing indicate bots
  • ✓IP reputation — Spamhaus, Barracuda, and AbuseIPDB checks applied to the submitter's IP

Spam text classification

If your form has a free-text field — a message body, description, or comment — pass it to siteverify via the text field:

JSON
{
  "secret": "your_secret_key",
  "token": "<shield token>",
  "text": "Hi I want to buy cheap replica..."
}

Verifence returns a spam_score (0–1), the detected language, and classifier signals. Your server sets the threshold — for example, reject any submission with spam_score > 0.85.

Scan every uploaded file

When your form includes a file upload field, POST the file to the document scanner before storing or processing it:

HTTP
POST /api/scan
API-KEY: your_api_key
Content-Type: multipart/form-data

file=@uploaded.pdf

The scanner returns a verdict and threat breakdown:

  • ✓Viruses detected by the antivirus engine
  • ✓Macros in Office documents (Word, Excel, PowerPoint)
  • ✓Suspicious or phishing links embedded in PDFs
  • ✓OLE embedded objects and XML external entities

Reject block verdicts immediately. Route warn verdicts to a manual review queue. Only accept ok results into your normal pipeline.

The full protected submission flow

1. User fills in form (Shield widget runs in background)
2. User submits → token added to form data automatically
3. Your server receives the submission
4. Call siteverify with token + email + text
   → invalid token or low score  → reject
   → email blocked by rules       → reject
   → high spam score              → reject or queue for review
5. If file included → POST to /api/scan
   → block verdict  → reject
   → warn verdict   → queue for review
6. All checks pass → save and process normally

Roll out in stages

Shield and the scan API work independently — add them one layer at a time:

StepWhat it adds
Connect the email scan endpoint Deliverability, disposable, role-account, and typo checks for every lead
Embed Shield widget + siteverify Bot blocking, IP reputation, behavioral checks, and email rule enforcement
Pass text to siteverify Spam text classification with score and language detection
POST uploads to the file scanner Malware and threat screening for PDF and Office documents