Integrations

Same-URL delivery (no integration)

The fastest option — paste a ShieldGate URL into your ad, and we handle the rest. UTMs and click IDs pass through automatically.

Reverse render:   https://your-host/r/SITE_KEY
Mirror (iframe):  https://your-host/m/SITE_KEY
Cookie overlay:   https://your-host/g/SITE_KEY?mode=overlay
Mouse-move gate:  https://your-host/g/SITE_KEY?mode=move
PrePage CAPTCHA:  https://your-host/g/SITE_KEY?mode=prepage

WordPress plugin

Download the pre-configured ZIP from Sites → your site → Install → WordPress plugin. Upload it via WP-Admin → Plugins → Add New → Upload, activate, and you're done. The plugin:

• Calls /api/public/decide for every non-admin request
• Caches verdicts in WordPress transients
• Honors your cloak_method setting (redirect / loading / iframe)
• Sets no-cache headers on safe / 403 responses

PHP snippet

Paste at the top of your landing page, before any output:

<?php
$payload = json_encode([
  'site_key' => 'YOUR_SITE_KEY',
  'visitor' => [
    'ip'       => $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $_SERVER['REMOTE_ADDR'],
    'ua'       => $_SERVER['HTTP_USER_AGENT'] ?? null,
    'referrer' => $_SERVER['HTTP_REFERER'] ?? null,
    'country'  => $_SERVER['HTTP_CF_IPCOUNTRY'] ?? null,
  ],
]);
$ch = curl_init('https://your-host/api/public/decide');
curl_setopt_array($ch, [
  CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 3,
  CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
  CURLOPT_POSTFIELDS => $payload,
]);
$res = json_decode(curl_exec($ch) ?: '{}', true);
curl_close($ch);
if (($res['action'] ?? 'white') === 'money' && !empty($res['url'])) {
  header('Location: ' . $res['url'], true, 302); exit;
}
?>

Cloudflare Worker (edge)

Best latency — decide before your origin is even touched:

export default {
  async fetch(req) {
    const cf = req.cf || {};
    const res = await fetch("https://your-host/api/public/decide", {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify({
        site_key: "YOUR_SITE_KEY",
        visitor: {
          ip: req.headers.get("cf-connecting-ip"),
          ua: req.headers.get("user-agent"),
          referrer: req.headers.get("referer"),
          country: cf.country, asn: cf.asn,
        },
      }),
    }).then(r => r.json());
    if (res.action === "money" && res.url) return Response.redirect(res.url, 302);
    return fetch(req);
  },
};

Node / Next.js middleware

// middleware.ts
import { NextResponse } from "next/server";
export async function middleware(req) {
  const res = await fetch("https://your-host/api/public/decide", {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify({
      site_key: process.env.SHIELDGATE_KEY,
      visitor: {
        ip: req.headers.get("x-forwarded-for")?.split(",")[0],
        ua: req.headers.get("user-agent"),
        referrer: req.headers.get("referer"),
      },
    }),
  }).then(r => r.json());
  if (res.action === "money" && res.url) return NextResponse.redirect(res.url);
  return NextResponse.next();
}

Trackers (Voluum / Binom / Bemob)

Point your postback URL at ShieldGate to record conversions against the visitor session:

GET https://your-host/api/public/postback/YOUR_SITE_KEY
    ?cid={clickid}&payout={payout}&status={status}&sig={hmac}

sig is HMAC-SHA256 of the query string using your site's hmac_secret.