Block bad guys before they hit the list.

Stop fake sign-ups before they reach your list. Visitors never solve a puzzle, and it's free for now.

Get a free site key Read the guide
Acme sign-up Live

We keep the domain and a one-way hash. Never the address.

What it blocks.

Every sign-up runs 8 checks in order. The first one that fails blocks it.

You see why. Bots don't.

Blocked visitors only see “Couldn't verify”. Your dashboard shows the reason.

Acme sign-up Live

Caught by Temporary email.

Checked in this order.

Checks 8 on every sign-up

Invalid email

Malformed addresses and domains with no mail server.

Temporary email

Disposable and throwaway inbox domains.

Spam-listed domain

Email domains listed by StopForumSpam.

Free webmail

Optional

For B2B sign-ups that should use a work address.

Bounces across PostShiba

Addresses that hard-bounced or complained with more than one PostShiba sender.

Scripted browsers

Headless browsers, curl, webdriver, and forms filled faster than a person can type.

Spam-listed IP

IPs listed by StopForumSpam.

Abusive IPs

IPs reported on AbuseIPDB and Tor exit nodes. Data-center IPs too, unless you allow them per site.

Add it in three steps.

Create a site key.

In your PostShiba account, open Security, then ShieldShiba. Add the hostnames you embed on.

Acme sign-up ss_pk_...
Allowed hostnames
example.com app.example.com

Embed the widget.

Add the script and a <shield-shiba> tag next to your email field.

1<script src="https://postshiba.com/shield/v1/widget.js" async></script> 2 3<form action="/signup" method="post"> 4 <input type="email" name="email" id="email"> 5 <shield-shiba sitekey="ss_pk_..." email-field="#email"></shield-shiba> 6 <button>Sign up</button> 7</form>

Verify on your server.

POST the token, the email, and your secret key. Accept the sign-up when success is true. Each token works once, for that email, and expires in five minutes.

1curl -X POST https://postshiba.com/shield/v1/verify \ 2 -H 'Content-Type: application/json' \ 3 -d '{ 4 "secret": "ss_sk_...", 5 "token": "...", 6 "email": "jane@example.com" 7 }'
1{ 2 "success": true, 3 "verdict": "good_boy", 4 "reasons": [], 5 "email": "jane@example.com", 6 "hostname": "example.com", 7 "created_at": "2026-09-23T05:12:44Z" 8}
1{ 2 "success": false, 3 "error": "invalid_token" 4}
Protect sign-ups with ShieldShiba

Why was I checked?

The site you were on uses ShieldShiba to keep bots and fake accounts out. You didn't do anything wrong.

Verification
Address
8c87b489ce35cf2e2f39f80e282cb2e804932a56a213983eeeb428407d43b52d
Domain
example.com
IP
203.0.113.15
Browser
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
Verdict
Passed
What we looked at
The email you typed, your IP address, and a few signals from your browser. We check them against public blocklists and our own sending history.
What we keep
The email's domain and a one-way hash of the address. Never the address itself. Plus the IP, your browser's user agent, and the result.
What we don't do
No puzzles and no traffic lights. Your browser solves a small math problem in the background in about a second.
If you were blocked
We never say why on screen, so bots can't learn from it. The site owner can see the reason. If you think it's a mistake, contact them.

Keep fake sign-ups off your list.

ShieldShiba is free for now. Create a PostShiba account and add your first site key.

Get a free site key Read the guide