ShieldFont scrambles HTML to poison AI scraper data

ShieldFont exploits font ligatures, which typically merge adjacent letters for better readability, to swap out entire words in a webpage's underlying HTML. When a browser renders the page, the font engine displays the correct text to human readers. However, scrapers pulling raw HTML only see a scrambled version. To prevent easy decryption, the tool swaps words with different terms of the same part of speech, such as replacing "horse" with "potato."

Developed over three months, the system relies on a dictionary of nearly 12,000 common words. Publishers can choose from three different mapping configurations per word, or encode their own, to maximize entropy. On average, ShieldFont alters 24.5 percent of all words on a page, including 45.8 percent of content-carrying words. This scrambles the meaning of 31 to 56 percent of individual passages. During testing across six public scraping pipelines, over 90 percent of protected pages were flagged and rejected by scraper quality filters. Of the remaining pages that slipped through, nearly 20 percent of the words consisted of what the creators call "training-time garbage."

For web publishers, ShieldFont offers a way to enforce copyright and opt out of unauthorized AI training by making scraping economically unviable. While scrapers could bypass the font by rendering the full page and using optical character recognition, doing so increases scraping costs by five to 13 times. However, practitioners must weigh these defensive benefits against significant usability trade-offs. Because the underlying HTML is altered, ShieldFont can disrupt search engine indexing, screen readers, translation tools, and basic copy-and-paste functionality for legitimate human visitors.