Free check
Is your form protected?
Enter the address of a page with a contact, login or sign-up form. We load that one page and look in its HTML for the markers of well-known bot protection.
What the check can and cannot tell you
The check reads the HTML your server delivers. It finds the markers of reCAPTCHA, hCaptcha, Cloudflare Turnstile, Friendly Captcha and SilentShield. It does not run JavaScript, so a form that a script creates in the browser stays invisible. “Nothing detected” therefore means “nothing in the delivered HTML”, never “unprotected”. It also cannot tell whether your server actually verifies the answer.
What this check does not see
- Anything a script creates in the browser: forms, widgets and tokens that do not exist in the delivered HTML.
- Whether your server verifies the answer. A widget in the form with no check on the server stops nobody.
- Protection that sits in front of the page, such as a firewall or rate limit. It leaves no trace in the HTML.
- Pages behind a login. We fetch only public pages, without cookies.
How the check works
- 1We read the robots.txt of the site. If it forbids the fetch, or cannot be read, we stop there.
- 2We fetch the one page you entered, with a clear identification (SilentShieldFormCheck), no cookies, at most three redirects and at most 1 MB.
- 3We look in the HTML for the markers of known providers: script addresses, element classes and field names.
- 4We show the result and keep nothing. Only an anonymous daily count per verdict is kept, without any address.
Questions about the check
Does “nothing detected” mean my form is unprotected?
No. It means only that the delivered HTML contains no marker of a known provider. Protection may be added by a script in the browser, run entirely on the server, or sit in front of the page.
Does the check prove that a protection works?
No. It shows that a marker is placed in the form. Whether your server verifies the answer and rejects failed ones can only be shown by testing a submission from outside.
Which providers does the check know?
Google reCAPTCHA, hCaptcha, Cloudflare Turnstile, Friendly Captcha and SilentShield. A provider that is not on the list is simply not recognised.
Is the address I enter stored?
No. The address and the result are not stored and not written to the log. Only a daily count per verdict is kept, without any address.
Can I check any website?
Only public pages, and only if the site's robots.txt allows it. Internal addresses and unusual ports are refused. To protect other servers, each site can be checked only a few times per hour and each visitor a few times per day.
Want protection that does not need a puzzle?
SilentShield rates the behavior of a visitor in the background and decides between human, suspicious and bot. The free plan is enough to try it on one site.