Integrations

Same-URL delivery (no integration)

The fastest option — paste a ShieldGate URL into your ad, and we handle the rest. UTMs and click IDs pass through automatically.

Reverse render:   https://your-host/r/SITE_KEY
Mirror (iframe):  https://your-host/m/SITE_KEY
Cookie overlay:   https://your-host/g/SITE_KEY?mode=overlay
Mouse-move gate:  https://your-host/g/SITE_KEY?mode=move
PrePage CAPTCHA:  https://your-host/g/SITE_KEY?mode=prepage

WordPress plugin

Download the pre-configured ZIP from Sites → your site → Install → WordPress plugin. Upload it via WP-Admin → Plugins → Add New → Upload, activate, and you're done. The plugin:

• Calls /api/public/decide for every non-admin request
• Caches verdicts in WordPress transients
• Honors your cloak_method setting (redirect / loading / iframe)
• Sets no-cache headers on safe / 403 responses

PHP snippet

Paste at the top of your landing page, before any output:

<?php
$payload = json_encode([
  'site_key' => 'YOUR_SITE_KEY',
  // ShieldGate derives IP, proxy trust, country, ASN, and challenge evidence
  // at the trusted server boundary. Send only contextual request metadata.
  'visitor' => [
    'ua'       => $_SERVER['HTTP_USER_AGENT'] ?? null,
    'referrer' => $_SERVER['HTTP_REFERER'] ?? null,
  ],
]);
$ch = curl_init('https://your-host/api/public/decide');
curl_setopt_array($ch, [
  CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 3,
  CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
  CURLOPT_POSTFIELDS => $payload,
]);
$res = json_decode(curl_exec($ch) ?: '{}', true);
curl_close($ch);
if (($res['action'] ?? 'white') === 'money' && !empty($res['url'])) {
  header('Location: ' . $res['url'], true, 302); exit;
}
?>

Cloudflare Worker (edge)

Best latency — decide before your origin is even touched:

export default {
  async fetch(req) {
    const cf = req.cf || {};
    const res = await fetch("https://your-host/api/public/decide", {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify({
        site_key: "YOUR_SITE_KEY",
        visitor: {
          // IP, country, ASN, proxy trust, and challenge evidence are derived
          // by ShieldGate at the trusted boundary; do not forward client claims.
          ua: req.headers.get("user-agent"),
          referrer: req.headers.get("referer"),
        },
      }),
    }).then(r => r.json());
    if (res.action === "money" && res.url) return Response.redirect(res.url, 302);
    return fetch(req);
  },
};

Node / Next.js middleware

// middleware.ts
import { NextResponse } from "next/server";
export async function middleware(req) {
  const res = await fetch("https://your-host/api/public/decide", {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify({
      site_key: process.env.SHIELDGATE_KEY,
      visitor: {
        // Do not forward x-forwarded-for as client evidence. ShieldGate
        // applies its canonical trusted-proxy policy server-side.
        ua: req.headers.get("user-agent"),
        referrer: req.headers.get("referer"),
      },
    }),
  }).then(r => r.json());
  if (res.action === "money" && res.url) return NextResponse.redirect(res.url);
  return NextResponse.next();
}

Trackers (Voluum / Binom / Bemob)

Point your postback URL at ShieldGate to record conversions against the visitor session. Postbacks require the site's HMAC contract, are rate-limited and idempotent, and are rejected for suspended or deleting organizations:

GET https://your-host/api/public/postback/YOUR_SITE_KEY
    ?cid={clickid}&payout={payout}&status={status}&sig={hmac}

sig is HMAC-SHA256 of the canonical query string using your site's hmac_secret. Duplicate delivery keys are not counted twice, and quota/accounting failures fail closed. Keep the secret server-side; never place it in browser code.