Security Policy
Fine-tune how SilentShield protects your forms with IP filters, rate limits, and challenge modes.
In your dashboard, go to API Keys → select a key → Security tab.
Security Options
| Option | Description |
|---|---|
IP Whitelist | Only allow requests from these IPs or CIDR ranges (e.g., 192.168.1.0/24) |
IP Blacklist | Block requests from these IPs or CIDR ranges |
Country Block | Block requests from specific countries by ISO code (e.g., CN, RU) |
Bot Threshold | Score below this value is considered a bot (default: 0.3, range: 0.0–1.0) |
Challenge Mode | Decides WHETHER to ask: 'always', 'suspicious' = only on suspicious behaviour (default), 'never' = never ask. What happens to the submission is set by the three actions below — 'never' on its own is not monitor-only. (action_suspicious, action_bot, action_unverified) |
action_suspicious | What happens on verdict 'suspicious': 'challenge' (default), 'block' or 'allow'. |
action_bot | What happens on verdict 'bot': 'challenge' (default), 'block' or 'allow'. |
action_unverified | What happens when a nonce has no telemetry: 'block' (default) or 'allow'. No 'challenge' — the visitor is long gone, there is nobody left to ask. |
action_tor | What happens to a submission arriving over a Tor exit node: '' (default, record only), 'report', 'challenge' or 'block'. Empty means nothing changes. |
Rate Limit per IP | Maximum requests per IP per minute (default: 100) |
Allowed Referers | Additional domains allowed to send requests |
Escalation Levels
SilentShield uses a 5-level escalation system based on the behavior score:
| Score Range | Level | Action |
|---|---|---|
| 0.85 – 1.0 | Pass | No challenge — user is clearly human |
| 0.7 – 0.85 | Easy | Invisible proof of work, 18 bits (~260,000 hashes) — half a second to a few seconds depending on the device |
| 0.5 – 0.7 | Medium | Proof of work, 20 bits (~1 million hashes) |
| 0.3 – 0.5 | Hard | Proof of work, 22 bits (~4.2 million hashes) + visible arithmetic captcha as fallback |
| 0.0 – 0.3 | Block | Request is rejected (HTTP 403) |