​

BotShield Gate

BotShield Gate is a reverse-proxy gateway that sits in front of your website and verifies human presence before granting access. No CAPTCHA puzzles, no tracking, no personal data collected.

​

How It Works

1. A visitor navigates to your domain
2. The gateway checks for a valid session
3. No session — the visitor sees a verification page and completes a quick biometric check via the BotShield app
4. Valid session — the request is transparently proxied to your origin server

Once verified, the visitor receives a secure, time-limited session. Subsequent requests pass through without interruption until the session expires.

​

Use Case: Protecting a Limited-Edition Drop

Imagine you run a sneaker shop at shop.kicksonly.com. You have a limited-edition release dropping Friday at noon, and past launches have been hammered by bots — inventory sells out in seconds, real customers get nothing, and your support inbox fills with complaints. With BotShield Gate:

1. You point shop.kicksonly.com through BotShield Gate
2. Before the drop, every visitor completes a one-time biometric verification (Face ID / Touch ID via the BotShield app)
3. Verified humans get a session and browse your store normally
4. Bots, scripts, and headless browsers can’t pass verification — they never reach your storefront
5. When the drop goes live, only real humans are in the queue

The result: your limited inventory goes to real customers. No CAPTCHA friction, no account creation walls, no PII collected. Visitors verify once and shop freely for the duration of their session. This same pattern works for:

• Ticket sales — prevent bot scalping for concerts and events
• Flash sales — ensure fair access during time-limited promotions
• Membership portals — gate access to exclusive content or communities
• Waitlist launches — verify humans before granting early access
• Any high-demand page — protect landing pages from automated traffic

​

Deployment Options

BotShield Gate offers two ways to deploy, depending on how much control you need.

---

​

Managed Gateway

The managed gateway is the fastest path to protection. You configure everything from your BotShield Partner Dashboard — no code required.

​

Setup

​

Protection Modes

You can switch modes at any time from the dashboard. Drop mode uses shorter sessions to ensure presence is re-verified more frequently during high-stakes events.

​

Managing Your Gate

From the dashboard you can:

• Toggle protection on/off — disable the gate without removing DNS records (useful for maintenance)
• Switch modes — change between Standard and Drop mode instantly
• Monitor status — see domain and SSL status in real time
• Delete — remove the gate entirely and restore direct access to your origin

---

​

Session Security

BotShield Gate sessions are designed to be secure and tamper-proof:

• Cryptographically signed — session tokens use HS256 JWT signatures that cannot be forged
• Time-limited — sessions expire automatically based on your chosen mode
• HttpOnly cookies — session tokens cannot be read or modified by client-side JavaScript
• Single-domain — tokens are validated against the specific hostname they were issued for
• No PII — the session contains no personal information about the visitor

​

What Gets Protected

The gate applies to all requests to your public domain. Once a visitor has a valid session, all subsequent requests (pages, API calls, assets) are proxied transparently to your origin with no added latency.

​

Next Steps