Protect your app and content from scrapers, cloners and AI agents.
Corpilus Shield recognises automated visitors at your server and in your app, makes a copy of your app provable, and tells AI agents in a form machines read that your content is not theirs to take. Everything new starts switched off or only watching. The one exception, blocking visitors that pretend to be a known crawler, starts when you switch on blocking on your server.
Automated visitors, recognised at your server and in your app.
Scrapers and bots download your content page after page. Shield shows you who they are and, once you choose, answers them before they reach your app.
AI crawlers, handled by purpose
Crawlers that announce themselves are grouped by what they come for: training a model, a search index, an assistant fetching a page for a person, and others. For each group you choose: let it through, check it, block it, or send it into a maze of made-up pages. Everything is let through until you change it. These choices steer crawlers that say who they are.
Impostors and verified search engines
A visitor that calls itself a known crawler but comes from outside the addresses its vendor publishes is recognised as an impostor. This starts once you switch on blocking on your server, in “Monitor only” or “Block”: from then on an impostor is blocked in the Shield script and in form checks, and on your server in “Block”. Put your own SEO tools that pose as a search engine on the whitelist first. Google, Bing, Apple and DuckDuckGo, verified by their published addresses, are never touched; search engines that publish no address list, such as Seznam, are treated like any visitor.
Blocking on your server
A small snippet for Cloudflare, nginx or your own server code keeps your site's block list and decides on each request itself. Corpilus is never in your visitors' path: when Corpilus cannot be reached, the snippet keeps the last list for a short time and then lets every request through.
A check page instead of a block
An address Shield marks for a check, or a crawler group you set to “check”, gets a short check page in the browser when it opens a page; a person's browser with JavaScript passes it. Off until you switch it on.
In your pages and forms
The Shield script and the Hybrid SDK report how your app is being walked through, so a visitor that opens far more of it than a person would shows up as a suspicion. A form can answer a trapped bot with a fake “sent” and drop the message.
Blocking on your server needs the edge snippet or the Hybrid SDK; the Shield script alone checks only in the browser. Each response stays off until you switch it on.
A copy cannot be prevented. It can be slowed, detected and proven.
AI cloning tools rebuild a web app from what a browser downloads. No tool can stop a browser from downloading your frontend — Shield makes a copy recognisable and gives you evidence.
Decoys
With the invisible watermarks on, your site gets decoy addresses that no page of yours links to visibly and no person visits. A tool that requests one is a certain catch, not a guess. With deception on, it is first given made-up screens and feature descriptions, only inside decoys Corpilus creates, and is blocked when it carries on.
Marks you can prove
Invisible marks at the end of your pages, and text that exists only in your decoys. Your users see neither. An optional copy beacon tells you where a copy that kept the marks is running; each such report is a lead to check, not proof.
Check URL
Enter the address of a suspected copy. Corpilus fetches it once and looks for your marks and your decoy text. A hit is stored as verified evidence, and an administrator exports it as a signed file with instructions for checking the signature.
The view per account
In an app with sign-ins, the Hybrid SDK shows how many different screens each signed-in account opened today and over the past week, so an account that works through your whole app slowly still shows up. It only measures. You can also set a limit per account; over it, the SDK answers “Too Many Requests” once App copying and blocking on your server are both set to “Block”.
The watermarks, deception, the copy beacon, the view per account and the account limit are each off until you switch them on. Deception needs the watermarks and acts only when App copying and blocking on your server are both set to “Block”. The view per account and the account limit need the Hybrid SDK.
Tell AI agents no, and give the ones that ignore it nothing real.
An AI agent reads your site for someone else's product. Shield gives you a declared position that machines can read and a lawyer can point to, and sends agents that ignore it into decoys.
A machine-readable AI reservation
Your site declares in TDMRep, the W3C Community Group format made for the EU text and data mining opt-out, that text and data mining of your content are reserved. An optional notice for agents adds that copying your app to build another product is not permitted. The Shield script adds both to your pages; the edge snippet or the Hybrid SDK also add the reservation to your server's answers. Agents that respect such reservations stop. It never blocks anyone by itself.
A template for your terms
The guide in the app gives two paragraphs for your terms of use: no use of your service to build a competing product, and no automated copying or text and data mining. It is a template: have a lawyer check it for your jurisdiction.
Your public footprint
The Shield scanner checks what your public pages give away to anyone who downloads them, and whether your site declares the reservation where a plain download can read it.
Agents meet decoys, not your real screens
An agent that follows the hidden decoy links is given made-up screens; your real pages stay as they are for everyone else. Agents that drive a real browser: the decoys do not catch them. Shield measures the ones that reveal automation and acts on nothing from that measurement, unless you turn on “Decoys for browser agents that read broadly” (off by default, needs the Hybrid SDK): then one that also opens far more pages than a person would can be given made-up content inside the decoys, never a block and never on your real pages, and it never affects a signed-in person; your account limit and block list still apply to them.
The reservation and the optional notice for agents are off by default and never block anything. A reservation in your server's answers needs the edge snippet or the Hybrid SDK.
Three steps, at your pace.
- 01Install the Shield script, an edge snippet or the Hybrid SDKThe Shield script goes into your pages with one line. The edge snippet runs on Cloudflare, nginx or in your server code and answers before a request reaches your app. The Hybrid SDK for Node.js, Python or PHP adds what only your app knows: who is signed in.
- 02Start in “Monitor only”App copying starts in “Monitor only”: Shield records what it sees and what it would do, and acts on nothing. Use the time to put your offices, scanners and partners on the whitelist.
- 03Turn on blocking or deception when you're readySwitch to “Block” one place at a time: blocking on your server, the check page, deception. You can go back at any time.
The Shield script alone cannot refuse a request on your server: a binding refusal needs the edge snippet or the Hybrid SDK.
What Corpilus Shield never does.
Decoys stay away from your signed-in users
With the Hybrid SDK and your sign-in check passed to it, a decoy is served only when it is certain that nobody is signed in; your signed-in users go straight to your app. A request that still reaches a decoy address is recorded like any other. The edge snippet and the Shield script cannot see a sign-in.
People never see made-up content
Made-up answers go only to automated visitors, and only where you switch them on: decoy screens at addresses Corpilus creates, the maze for the crawler groups you send there, a fake API description for a caught copier, and a fake “sent” for a trapped bot in a form. The only additions to a page are the ones you switch on: invisible marks, hidden decoy links and the reservation.
Verified search engines are never touched
Google, Bing, Apple and DuckDuckGo, verified by their published addresses, are never touched; search engines that publish no address list, such as Seznam, are treated like any visitor. An address on your whitelist is never blocked by a decoy trap.
Nothing new starts by blocking
Everything new on this page starts switched off or in “Monitor only”, with one exception: once you switch on blocking on your server, a visitor that pretends to be a known crawler from the wrong address is blocked. Unknown never blocks: an address Shield cannot identify gets no decision.
What it cannot do
Prevent copying
A browser has to download your frontend to show it. Copying can be slowed, detected and proven, not prevented.
See screenshots
A copy rebuilt from screenshots, or one that strips or rewrites the marks, carries nothing Check URL can find.
Tell people apart behind one address
Everybody behind a shared office address shares its block. Put your own offices and partners on the whitelist before you switch to “Block”.
Prove there is no copy
You see the copies found so far. A lead becomes verified only when Check URL finds your marks.
Frequently asked.
- Can Corpilus Shield stop my app from being copied?
- No tool can: a browser has to download your frontend to show it. Shield slows a copier down, recognises it, can hand it made-up content instead of your app, and makes a copy provable with marks and Check URL.
- Will it block Google or my customers?
- Google, Bing, Apple and DuckDuckGo, verified by their published addresses, are never touched; search engines that publish no address list, such as Seznam, are treated like any visitor. Everything new starts off or in “Monitor only”, except blocking visitors that pretend to be a known crawler, which starts once you switch on blocking on your server. An address Shield cannot identify gets no decision. Behind a shared office address everybody shares a block, so put your offices, partners and SEO tools on the whitelist before you switch to “Block”.
- Do I need the Hybrid SDK?
- Not for everything. The Shield script adds the marks, the reservation on your pages, the decoy links and checks in the browser. The edge snippet adds blocking on your server, the reservation in your server's answers and the decoys themselves. Only the Hybrid SDK knows who is signed in: with your sign-in check passed to it, a decoy is served only when it is certain that nobody is signed in, and the view per account and the account limit need it too.
- Does the AI reservation stop AI agents?
- Only the ones that respect such reservations. It declares your position and never blocks anyone by itself. In a dispute it shows that you declared the reservation in a standard machine-readable form; keep your own dated copy of the page and its headers as proof.
- What about agents that drive a real browser?
- The decoys do not catch them. Shield measures the ones that reveal automation and acts on nothing from that measurement, unless you turn on “Decoys for browser agents that read broadly” (off by default, needs the Hybrid SDK): then one that also opens far more pages than a person would can be given made-up content inside the decoys, never a block and never on your real pages, and it never affects a signed-in person; your account limit and block list still apply to them. In an app with sign-ins, the view per account shows an account that works through your whole app, and a copy they make may still carry your marks for Check URL.
- What does it record about my visitors and users?
- Which kind of page was opened is reported only as counts and short fingerprints of the page kind, never the full page address or its query. The view per account is off by default; your user's ID never leaves your server, and the data is deleted after a limited time. You remain the controller of your users' data. If you turn on the copy beacon, the browsers of a copy's visitors contact Corpilus: mention it in your privacy notice.
Show us the app you want to protect.
We go through your app, how it is served and who signs in, and propose where Shield watches, which marks and decoys make sense, and when to switch to “Block”.
The price is individual, by scope. How the scope is determined