Behavioral fingerprinting and real-time threat decisions for every API request. Block bots, credential stuffing, scrapers, OTP bombers, and promo abusers — before they hit your handlers. 3 lines of code.
Edge decision API with local LRU cache. 1500ms configurable timeout.
Bots · Credential Stuffing · Scraping · OTP Bombing · Promo Abuse · ATO · Fake Signups
Fail-open design — Shield unreachable means every request is allowed, not dropped.
Every request passes through three stages before reaching your handler. Signals in, verdict out, enforcement automatic.
The SDK extracts IP, User-Agent, header order, Accept headers, request timing, body size, and method from every request. These are hashed into an IP-independent device fingerprint — it survives IP rotation because it is derived from behavioral signals, not network identity.
Extracted signals are sent to the Decision API, which runs ML models, IP reputation checks, rate-limit evaluation, and your custom rules in parallel. The verdict — allow, block, or challenge — is returned in under 50ms. Results are cached locally in an LRU cache (10,000 entries, 5-minute TTL) to eliminate redundant round-trips.
Blocked requests are terminated with a 403 before touching your code. Challenged requests receive an X-Shield-Challenge header for downstream handling. All events are batched and sent to the Ingest service every 5 seconds or when 100 signals accumulate — asynchronously, with zero impact on response time.
IP-independent fingerprint survives IP rotation across proxy pools and botnets.
Same account targeted from many IPs; login failure rate per fingerprint exceeds threshold.
Regular request timing, sequential path traversal, high GET ratio, thin User-Agent diversity.
High OTP/SMS request rate per fingerprint in a rolling 1-hour window.
Same device fingerprint applying multiple promo codes or referral IDs.
Password spraying pattern — many accounts, low attempts per account, spread across IPs.
Same fingerprint creating multiple accounts with different emails in a short window.
Define your own detection logic using any signal field via the Rules Engine in the dashboard.
The SDK auto-installs as middleware. Signals are extracted, fingerprint generated, decision fetched, and verdict enforced — before your route handler runs.
Your login, signup, OTP, and payment endpoints are the primary targets. GoGuard sits in front of every request and terminates attacks before they ever count as a failed login attempt or trigger a fraud alert.
Protect your data and pricing APIs from automated extraction. Shield detects scraping patterns — regular timing, sequential endpoint traversal, low header diversity — and terminates the session before data leaves your system.
Everything you need to protect your live application.
Get StartedDedicated infrastructure, SLA guarantees, and custom integrations.
Contact Sales"We were losing thousands of dollars a month to credential stuffing on our login endpoint. After adding the Shield middleware, the attacks stopped in hours. The fingerprinting holds even when attackers cycle through residential proxies."
"Our promo system was being drained by bot farms using fresh email addresses. Shield's fingerprinting caught the device reuse across accounts within minutes. The custom rules engine let us tune the threshold without touching our codebase."
Technical specifications and frequently asked questions about the GoGuard detection engine, SDK, and infrastructure.
Add GoGuard to your stack in under 30 minutes. No infrastructure changes. No security expertise required. Start blocking real attacks today.