signals array next to it names every signal that produced that number. Higher means more anonymous: more likely masked, spoofed, or abusive. ShieldLabs surfaces the score and the reasons. Your own code decides allow, challenge, review, or block.
What the Risk Score is
The Risk Score is one value per visit, with the evidence attached.- Range 0 to 100, hard-capped at 100. There is no value above 100 and no negative score.
- Explainable. Every Risk Score ships with a
signalsarray, so you never act on a black box. - Delivered, not computed in the browser. It arrives by webhook and is readable from the History API.
How the score is built
Each signal that fires contributes a fixed number of points, and the points are summed. The webhooksignals array carries one entry per signal: { "name": "<slug>", "weight": <int> }. name is a stable slug (proxy, antidetect_browser). weight is the points that signal added.
A realistic webhook body for a visit on a proxy with a timezone mismatch:
20 because the two signals add 10 points each. Because both reasons are visible, your code can treat that 20 at a withdrawal differently from a 20 on a low-stakes action.
Webhook
signals[].name is a stable slug (proxy, timezone_mismatch). Branch on name or detection_flags. Display labels can change on the dashboard and in History Details.Description. A numeric weight alone does not tell you which signal fired: 30 from os_not_detected is not the same case as 30 from browser_vpn_proxy. Read the band, the flags, and the sensitivity of the action together — see Acting on the Risk Score.The Risk Score is delivered by Webhooks and readable from the Server API. The browser does not compute it.
The weights
Every scoring signal carries a fixed weight, published below. This is the scoring contract: the same signal always adds the same points before the total is capped. The heavier the weight, the stronger and rarer the tell: Tor or a disabled-scripting client is near-certain masking, while a lone VPN or proxy is common and often legitimate, so it carries far less.The names in this table are dashboard labels. On the webhook,
signals[].name is the matching slug (vpn, proxy, antidetect_browser, …). Branch on that slug or on detection_flags; do not parse History Details.Description. The same weight from two different signals is not interchangeable.How signals combine
The score is additive, but a few rules shape which signals are added before the sum.- The strongest anonymity signal takes priority. Tor, Privacy Relay, and VPN are evaluated in that order. If one fires, the weaker anonymity signals are not added on top of it.
- A disabled-scripting visit yields almost no browser signals. With nothing to collect in the page, the JavaScript Disabled weight dominates the score.
- Anti-detect indicators do not stack. One verdict is enough.
- Proxy-family signals stack. Proxy, Datacenter, and Abuser reputation signals add up with each other.
How to use the score
The score maps to four bands, and these labels are the only ones ShieldLabs uses. The recommended action is a guide, not a rule. You set the rules: pick the action per band that fits your own risk tolerance.
ShieldLabs gives you the number and the reasons. Your code owns the verdict.
Caveats
The risk scale is 0 to 100. The value 999 is a rate-limit ban marker, not a 0–100 score and not a band; a rate-limit ban also surfaces as HTTP 429 at the gateway. The 999 marker can still arrive in thescore field of a webhook or stored snapshot, so guard score > 100 before you read the band.
Next steps
Acting on the Risk Score
Turn the Risk Score plus signals into allow, challenge, review, or block in your own code.
Anonymity Signals
What each scoring signal covers and how it is surfaced.
Accuracy
Why identification accuracy reaches up to 99%.