SilentShield

SilentShield is an invisible, GDPR-compliant CAPTCHA alternative for PHP applications. You add a client script to your forms and verify each submission server-side with a single HTTP call and one API key — nothing to install, nothing to keep updated. There are no cookies, no tracking and no personal data, and hosting is EU-only by default.

Invisible CAPTCHA for PHP

One API key and a few lines of PHP — no package, no dependency. Works in Laravel, Symfony or plain PHP. Invisible, GDPR-compliant, integrated in minutes.

PHP CAPTCHA integration

PHP Developer Features

No dependency — five lines of plain PHP
Compatible with PHP 8.1+
Framework-agnostic — Laravel, Symfony, or plain PHP
Nonce-based — invisible, no user interaction
One API key, one call: POST /captcha/verify-nonce
Fail-open by design — never blocks on an API outage

Code examples

Requirements

# No package, no dependency.
# PHP 8.1 or newer with the cURL extension — that is all.
php -m | grep curl

Frontend embed

<!-- Add to <head> with SRI for security -->
(function () {
  var KEY = "YOUR_API_KEY";
  var SITE = location.hostname;
  var V = "2025.09.1";
  var s = document.createElement('script');
  s.src = "https://api.silentshield.io/client.js?k=" + encodeURIComponent(KEY)
    + "&v=" + encodeURIComponent(V)
    + "&site=" + encodeURIComponent(SITE);
  s.async = true;
  s.crossOrigin = "anonymous";
  document.head.appendChild(s);
})();

Backend verification

<?php
$api_key = "YOUR_API_KEY";
$nonce = $_POST['behavior_nonce'] ?? ''; // hidden input injected by client.js

$payload = json_encode(['nonce' => $nonce]);

$ch = curl_init("https://api.silentshield.io/v1/verify");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  "Content-Type: application/json",
  "api-key: " . $api_key,
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_TIMEOUT, 5);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code !== 200) {
  error_log("SilentShield API error: " . $http_code);
  // Fail secure: reject on API errors
  exit(json_encode(['error' => 'Verification failed']));
}

$data = json_decode($response, true);
$is_human = $data['ok'] && $data['verdict'] === 'human' && $data['confidence'] >= 0.7;

if (!$is_human) {
  error_log("Bot detected. Nonce: " . ($data['requested_nonce'] ?? 'unknown'));
  exit(json_encode(['error' => 'Bot detected']));
}

How SilentShield works in PHP

SilentShield adds an invisible check to your PHP forms and verifies each submission on the server. The client script runs in the background while the visitor fills in the form, and the generated token is sent with the request. Your PHP backend confirms the token before processing, so real users are never shown a puzzle.

One call, one API key

Verification is a single POST to https://api.silentshield.io/api/v1/captcha/verify-nonce with your key in the X-Api-Key header. Read ok from the response and reject the submission when it is false. The same five lines work in plain PHP as in Laravel or Symfony — there is nothing framework-specific about an HTTP request.

Setup walkthrough

Add the SilentShield client script https://api.silentshield.io/client.js?k=YOUR_API_KEY to your form and copy your API key from the dashboard. On submit, read the token from the request, create a SilentShield\Client and call verify. When the check passes, process the form; otherwise return a 403 response and reject the submission.

Privacy and accessibility by default

SilentShield uses no cookies, no tracking and no personal data, which keeps your PHP forms aligned with the GDPR. All verification runs on EU-only infrastructure by default. Because there are no image or audio puzzles, the protection meets WCAG 2.1 AA and stays accessible to keyboard and screen-reader users.

Integrate with PHP now

Five lines of PHP — ready in minutes.

Try for freeView pricing

Frequently asked questions

How do I add a CAPTCHA to a PHP site?

Add the SilentShield client script `https://api.silentshield.io/client.js?k=YOUR_API_KEY` to your pages, then verify the proof-of-work nonce in PHP with a single POST to `https://api.silentshield.io/api/v1/captcha/verify-nonce`, sending your key in the `X-Api-Key` header. One API key covers frontend and backend.

Is there a PHP SDK for SilentShield?

You do not need one. Verification is a single HTTP call, so a few lines of plain PHP with cURL do the job in any framework — Laravel, Symfony or none at all. You add the client script to your pages and check the `ok` field of the response before you accept the form. If you would rather use a package, the Agent Enforce guide shows how to install our SDK straight from GitHub.

How do I verify a SilentShield nonce in PHP?

Send the `behavior_nonce` your form submitted in a POST to `https://api.silentshield.io/api/v1/captcha/verify-nonce`, with your API key in the `X-Api-Key` header. The response carries `ok`, `verdict` and `confidence`; reject the submission when `ok` is false.

Does SilentShield work with Laravel or plain PHP?

Yes. Because verification is a plain HTTP call, it works in any PHP application — Laravel, Symfony or plain PHP. You add the client script to your forms and verify the nonce server-side before processing the submission.

Is SilentShield GDPR-compliant on a PHP backend?

Yes. Whatever your backend, SilentShield hosts data in the EU by default, sets no cookies, does no tracking, and stores only pseudonymised data. Your PHP server verifies the nonce with a single HTTPS call; no personal data leaves your application.

Do PHP users have to solve a puzzle?

No. SilentShield is invisible, so visitors to your PHP site never see an image puzzle or checkbox. The client script verifies real users in the background through behavioral signals and a proof-of-work nonce, meeting WCAG 2.1 AA, while your backend blocks bots via `SilentShield\Client`.