A widget on your page only shows a score. Real protection starts when your server checks the result as soon as a form arrives. This post shows how to add that check and how to see in your dashboard that it works. The film below shows it with a test server and sample data, silent and with short captions. The text under it says the same in words, so you can follow along without playing the film.
The film in short
The film opens the “Integration guide” of a key, shows that the widget reports in but no server has checked yet, shows the Node.js code from step 2, lets a visitor submit the form on a test shop whose server runs exactly that code, and ends when “Server-side check” reads “Active”. It has no sound and does not start by itself.
Step 1: read the integration status
Open your key in the dashboard and go to the Integration guide. Under “Integration status” four lights show what actually reaches us: “Script loading”, “Widget reporting”, “Server-side check” and “Form protection”. Before your server has checked anything, “Server-side check” reads “Never” and says: “No server has ever checked a token for this key. Without that check, a form can still be submitted directly.”
Step 2: put the check in your server
Step 2 of the page, “Secure your forms (important)”, explains: “Embedding the widget only shows the confidence — real protection needs a server-side token check when a form is submitted.” Pick your stack in the tabs: Node.js, PHP, Go, Python, React or Frontend. The Node.js tab shows an Express route: it reads the nonce that the widget put into the form, asks SilentShield about it with your key in the header “X-Api-Key”, accepts the submission only if the answer is “human” with a confidence of at least 0.7, and answers with 403 and “Bot detected” otherwise.
Step 3: let a form arrive
Run the route in your server and point your form at it. In the film a visitor fills in the contact form of a test shop and presses the button; the form sends the nonce to the route, and the route asks SilentShield. Nothing about this needs the dashboard open.
Step 4: read the result
Reload the Integration guide. “Server-side check” now reads “Active”, and the status changes from “Unprotected” to “Partly protected”: “Three of four links hold.” The fourth light, “Form protection”, is a separate matter: the page tells you “Not every form is protected” until you have switched your forms on. How to read the rest of the dashboard is in how to read the result.
The package instead of your own code
If you use Node.js you can also use the package “@forge12interactive/silentshield-sdk-js” instead of writing the request yourself; at the time of writing the version on npm is 1.5.0. The documentation lists the package and the other languages. Whichever way you choose, the light in the Integration guide tells you whether your server really checks.
What the film does not show
The film does not show what the test server answered and does not make a claim about how well bots are detected; the visitor in it is a test script. The Integration guide also offers a list of causes if the light stays on “Never”, and a guide for the widget covers the part before this one.