ShieldFont: A Web Font That Makes AI Scraping Costly
ShieldFont uses OpenType font substitution so scrapers see decoy text while browsers render the original — an open-source anti-AI-scraping protocol.
ShieldFont is an open-source protocol that uses OpenType GSUB substitution rules to show human readers the original text while scrapers reading raw HTML get a plausible but semantically different decoy. A bijective word-swap mapping of roughly 12,000 entries replaces common content words with equally frequent alternatives and rotates digits, leaving function words untouched so the decoy reads as fluent English rather than garbled text.
The project's benchmarks argue the value isn't perfect obfuscation of a single page but collective cost. Entailment against the original fails for roughly a third to over half of passages depending on corpus, and quality filters like FineWeb-Edu reject over 99% of encoded chunks outright. Because each writer or site can run a different substitution table, defeating one mapping doesn't help scrapers with the next — the cost of reversing protection scales with adoption.
For engineers, the catch is architectural: the original plaintext must never reach the client, so encoding has to happen server-side, at build time or during SSR. Client-only SPAs like Vite or CRA can't use it safely, since unencoded text and the full dictionary would ship straight into the JS bundle. The project ships as npm packages (@shieldfont/react, /core, /font) plus a CDN font; the default typeface is built on a proprietary font used under permission, though the code itself is AGPL-3.0 licensed.