AI SHIELD

AI ACTIVITY

Know who's accessing your website.

AI Shield monitors authenticated website traffic to identify automated AI activity, understand what content is being requested, and compare activity against your access policies.

NOT CONNECTED

Last traffic received: No production traffic received yet.

NOT CONNECTED

CONNECT YOUR WEBSITE

Connect a traffic source to begin seeing real AI activity. Until then AI Shield has no request data for this website and will not display any metrics.

Already configured your access policies? Open the Protection Center.

CONNECT YOUR WEBSITE

Give AI Shield visibility into the automated traffic reaching your website

AI Shield does not need your website passwords or customer data. The forwarder sends limited request metadata to AI Shield so we can identify automated traffic, measure activity, and compare requests against your protection policies.

NOT CONNECTED

01 CONNECT02 INSTALL03 TEST04 VERIFY

YOUR WEBSITE STAYS YOURS

AI Shield does not receive:

PasswordsCookiesRequest bodiesForm submissionsAuthentication tokens

Traffic metadata is sent securely using your unique signing secret.

YOUR WEBSITE

Enter the website you want to connect. Scanning it first also shows your page count and AI exposure score here.

CHOOSE CONNECTION METHOD

STEP 1 · COPY YOUR AI SHIELD SIGNING SECRET

AI Shield generates a signing secret that belongs only to this website. Every forwarded batch must be signed with it.

STEP 2 · ADD IT TO YOUR WEBSITE

Endpoint /api/public/traffic/webhook/server · header x-aishield-signature · hex(HMAC-SHA256(secret, body))

// AI Shield forwarder — Node.js (Express/Connect middleware).
// Runs on YOUR server. Forwards request metadata only.
import crypto from "node:crypto";

const AISHIELD_URL = "/api/public/traffic/webhook/server";
const AISHIELD_SECRET = process.env.AISHIELD_SECRET; // <YOUR_AI_SHIELD_SIGNING_SECRET>
const AISHIELD_DOMAIN = "yourwebsite.com";

export function aiShieldForwarder(req, res, next) {
  res.on("finish", () => {
    const body = JSON.stringify({
      domain: AISHIELD_DOMAIN,
      events: [
        {
          eventType: "TRAFFIC",
          timestamp: new Date().toISOString(),
          requestUrl: req.originalUrl,
          method: req.method,
          statusCode: res.statusCode,
          responseBytes: Number(res.getHeader("content-length")) || null,
          userAgent: req.headers["user-agent"] ?? null,
          sourceIp: req.headers["x-forwarded-for"]?.split(",")[0] ?? req.socket.remoteAddress,
          action: "UNKNOWN"
        }
      ]
    });

    const signature = crypto.createHmac("sha256", AISHIELD_SECRET).update(body).digest("hex");

    fetch(AISHIELD_URL, {
      method: "POST",
      headers: { "content-type": "application/json", "x-aishield-signature": signature },
      body
    }).catch(() => {}); // never let telemetry affect your website
  });

  next();
}

// app.use(aiShieldForwarder);

STEP 3 · DEPLOY

Deploy the forwarder to the infrastructure that receives your website requests. It sends request metadata only — never request bodies, cookies, authorization headers, session tokens or form contents. AI Shield hashes source addresses with a server-side salt and never stores raw addresses.

STEP 4 · TEST THE CONNECTION

AI Shield signs one test event with your stored secret and sends it through the real ingestion path: webhook → authenticate → validate → deduplicate → normalize → classify → store. Test events never count as website traffic.

NEED HELP?

What does the forwarder do?: It runs on your own infrastructure and sends AI Shield limited metadata about each request — the time, the URL path, the method, the response status, and the User-Agent. AI Shield uses that to identify automated traffic and compare it against your protection policies.
Does AI Shield see my customers' information?: No. The forwarder never sends request bodies, cookies, form contents or authentication tokens. Source addresses are hashed with a server-side salt and raw addresses are never stored or shown.
Does this block AI crawlers?: Not by itself. Stage 4.2 connects traffic intelligence. Your Protection Center policies determine what you want to allow or block, while actual enforcement depends on a verified enforcement integration.
Will this slow down my website?: The forwarder sends metadata after your response has already been returned, and failures are ignored, so your visitors are not made to wait on AI Shield.
Where do I install it?: On whatever layer actually receives your website's requests — your application server, your reverse proxy, or your own Cloudflare Worker.

WHAT AI SHIELD COLLECTS

Limited request metadata needed for traffic intelligence: timestamp, domain, request URL, method, status code, response size, User-Agent, country and network (ASN), plus a salted hash of the source address.

WHAT AI SHIELD DOES NOT COLLECT

· Passwords
· Cookies
· Request bodies
· Form submissions
· Authentication tokens

TRAFFIC SOURCES

Where request data can come from

AI Shield reports each integration honestly. A provider without a working integration shows NOT CONFIGURED and delivers no data.

Checking integration status…

CRAWLER IDENTITY

How identity confidence is reported

A User-Agent header alone is not proof of identity, so AI Shield never marks a request VERIFIED from its User-Agent.

AI SYSTEM	CATEGORY	PURPOSE	VERIFICATION METHOD
GPTBot	AI Training	Model training	NOT IMPLEMENTED
OAI-SearchBot	AI Search	Search and discovery	NOT IMPLEMENTED
ChatGPT-User	AI Agent	User-initiated retrieval	NOT IMPLEMENTED
ClaudeBot	AI Training	Model/web data	NOT IMPLEMENTED
Google-Extended	AI Training	Google AI controls	NOT IMPLEMENTED
PerplexityBot	AI Search	Search/answers	NOT IMPLEMENTED
Bytespider	AI Training	Web data collection	NOT IMPLEMENTED
CCBot	AI Training	Common Crawl data	NOT IMPLEMENTED

Traffic intelligence records request metadata only. AI Shield does not store raw IP addresses, request bodies, cookies, or authentication data, never shows IP data or IP hashes in your dashboard, and excludes connection tests and development events from every production metric.