Skip to main content
One integer from 0 to 100 summarizes how anonymous a visit looks, and the signals array next to it names every signal that produced that number. Higher means more anonymous: more likely masked, spoofed, or abusive. ShieldLabs surfaces the score and the reasons. Your own code decides allow, challenge, review, or block.

What the Risk Score is

The Risk Score is one value per visit, with the evidence attached.
  • Range 0 to 100, hard-capped at 100. There is no value above 100 and no negative score.
  • Explainable. Every Risk Score ships with a signals array, so you never act on a black box.
  • Delivered, not computed in the browser. It arrives by webhook and is readable from the History API.
Individual signals can sum past 100 internally, but the score you receive is always clamped to 100.

How the score is built

Each signal that fires contributes a fixed number of points, and the points are summed. The signals array carries one entry per signal: { "name": "<name>", "weight": <int> }. weight is the points that signal added. signal names it in plain language. A realistic webhook body for a visit on a proxy with a timezone mismatch:
The score is 20 because the two signals add 10 points each. Because both reasons are visible, your code can treat that 20 at a withdrawal differently from a 20 on a low-stakes action.
The signal string is a display label and can change — never branch on it. Identify which signals fired with the stable detection_flags booleans (and the Risk Score band). A numeric weight alone does not tell you which signal fired: 30 from os_not_detected is not the same case as 30 from browser_vpn_proxy. Read the band, the flags, and the sensitivity of the action together — see Acting on the Risk Score.
The Risk Score is delivered by Webhooks and readable from the Server API. The browser does not compute it.

The weights

Every scoring signal carries a fixed weight, published below. This is the scoring contract: the same signal always adds the same points before the total is capped. The heavier the weight, the stronger and rarer the tell: Tor or a disabled-scripting client is near-certain masking, while a lone VPN or proxy is common and often legitimate, so it carries far less.
The names in this table are the human-readable labels shown in the dashboard, and Anonymity Signals covers what each one means. The raw signal string on the wire can change — never branch on it. Use detection_flags to see which signals fired; use the score band for severity. The same weight from two different signals is not interchangeable — decide with flags plus context, not the number alone.

How signals combine

The score is additive, but a few rules shape which signals are added before the sum.
  • The strongest anonymity signal takes priority. Tor, Privacy Relay, and VPN are evaluated in that order. If one fires, the weaker anonymity signals are not added on top of it.
  • A disabled-scripting visit yields almost no browser signals. With nothing to collect in the page, the JavaScript Disabled weight dominates the score.
  • Anti-detect indicators do not stack. One verdict is enough.
  • Proxy-family signals stack. Proxy, Datacenter, and Abuser reputation signals add up with each other.
VPN is asserted only when multiple independent signals agree, which catches masking that a simple IP blocklist misses.

How to use the score

The score maps to four bands, and these labels are the only ones ShieldLabs uses. The recommended action is a guide, not a rule. You set the rules: pick the action per band that fits your own risk tolerance. ShieldLabs gives you the number and the reasons. Your code owns the verdict.

Caveats

A legitimate user can score high. A corporate proxy, a VPN, or a privacy browser all raise the score without any wrongdoing. Decide on Risk Score plus signals plus context (signup, login, payment, withdrawal), never on the number alone. Tune your thresholds gradually as you observe real traffic.
The risk scale is 0 to 100. The value 999 is a rate-limit ban marker, not a 0–100 score and not a band; a rate-limit ban also surfaces as HTTP 429 at the gateway. The 999 marker can still arrive in the score field of a webhook or stored snapshot, so guard score > 100 before you read the band.

Next steps

Acting on the Risk Score

Turn the Risk Score plus signals into allow, challenge, review, or block in your own code.

Anonymity Signals

What each scoring signal covers and how it is surfaced.

Accuracy

Why corroborating independent signals reaches up to 99% accuracy.