signals array next to it names every signal that produced that number. Higher means more anonymous: more likely masked, spoofed, or abusive. ShieldLabs surfaces the score and the reasons. Your own code decides allow, challenge, review, or block.
What the Risk Score is
The Risk Score is one value per visit, with the evidence attached.- Range 0 to 100, hard-capped at 100. There is no value above 100 and no negative score.
- Explainable. Every Risk Score ships with a
signalsarray, so you never act on a black box. - Delivered, not computed in the browser. It arrives by webhook and is readable from the History API.
How the score is built
Each signal that fires contributes a fixed number of points, and the points are summed. Thesignals array carries one entry per signal: { "name": "<name>", "weight": <int> }. weight is the points that signal added. signal names it in plain language.
A realistic webhook body for a visit on a proxy with a timezone mismatch:
20 because the two signals add 10 points each. Because both reasons are visible, your code can treat that 20 at a withdrawal differently from a 20 on a low-stakes action.
The
signal string is a display label and can change — never branch on it. Identify which signals fired with the stable detection_flags booleans (and the Risk Score band). A numeric weight alone does not tell you which signal fired: 30 from os_not_detected is not the same case as 30 from browser_vpn_proxy. Read the band, the flags, and the sensitivity of the action together — see Acting on the Risk Score.The Risk Score is delivered by Webhooks and readable from the Server API. The browser does not compute it.
The weights
Every scoring signal carries a fixed weight, published below. This is the scoring contract: the same signal always adds the same points before the total is capped. The heavier the weight, the stronger and rarer the tell: Tor or a disabled-scripting client is near-certain masking, while a lone VPN or proxy is common and often legitimate, so it carries far less.The names in this table are the human-readable labels shown in the dashboard, and Anonymity Signals covers what each one means. The raw
signal string on the wire can change — never branch on it. Use detection_flags to see which signals fired; use the score band for severity. The same weight from two different signals is not interchangeable — decide with flags plus context, not the number alone.How signals combine
The score is additive, but a few rules shape which signals are added before the sum.- The strongest anonymity signal takes priority. Tor, Privacy Relay, and VPN are evaluated in that order. If one fires, the weaker anonymity signals are not added on top of it.
- A disabled-scripting visit yields almost no browser signals. With nothing to collect in the page, the JavaScript Disabled weight dominates the score.
- Anti-detect indicators do not stack. One verdict is enough.
- Proxy-family signals stack. Proxy, Datacenter, and Abuser reputation signals add up with each other.
How to use the score
The score maps to four bands, and these labels are the only ones ShieldLabs uses. The recommended action is a guide, not a rule. You set the rules: pick the action per band that fits your own risk tolerance.
ShieldLabs gives you the number and the reasons. Your code owns the verdict.
Caveats
The risk scale is 0 to 100. The value 999 is a rate-limit ban marker, not a 0–100 score and not a band; a rate-limit ban also surfaces as HTTP 429 at the gateway. The 999 marker can still arrive in thescore field of a webhook or stored snapshot, so guard score > 100 before you read the band.
Next steps
Acting on the Risk Score
Turn the Risk Score plus signals into allow, challenge, review, or block in your own code.
Anonymity Signals
What each scoring signal covers and how it is surfaced.
Accuracy
Why corroborating independent signals reaches up to 99% accuracy.