ShieldFont is a new technique that deters AI scrapers by encoding website text with font ligatures, making it unreadable to scraping algorithms while keeping it normal to human readers.
The method works by substituting about a quarter of words with ligature versions that render nonsensically when parsed as raw HTML but correctly when displayed through the intended font.
While scrapers can technically adapt by parsing rendered text, doing so becomes significantly more expensive, making ShieldFont one of a growing set of defenses available to site owners whose robots.txt files are ignored by LLM training operations.
What happened
A new method called ShieldFont uses font ligatures—combining multiple letters into single glyphs—to render website text unreadable to AI scrapers while keeping it normal-looking to human visitors. About a quarter of words are substituted with ligature versions, making HTML parsed by scrapers appear grammatically valid but nonsensical, while the rendered font version reads normally.
Why it matters
Traditional robots.txt files are routinely ignored by AI training scrapers, forcing site owners to find new defenses. ShieldFont makes scraping significantly more expensive by forcing scrapers to parse rendered text instead of raw HTML, addressing a growing problem where LLM training operations bypass site owners' indexing wishes without consequence.
What to watch
ShieldFont works best on static or archived content marked as 'do not follow' in robots.txt; it affects legitimate search engine bots equally. Scrapers can adapt by parsing rendered text, but doing so raises scraping costs. Other emerging defenses include maze traps like Nepenthes and Cloudflare offerings that send scrapers through infinite linked pages of dynamically generated content.
Ask the AI about this article →
The emergence of ShieldFont reflects a fundamental shift in how the web's social contract operates. The robots.txt file, a decades-old mechanism built on mutual respect between site owners and automated visitors, has become largely ineffective against modern AI training operations. Unlike traditional search engine crawlers that typically honor robots.txt directives, contemporary LLM scrapers routinely disregard them, leaving site owners without recourse through conventional means. This has forced the development of increasingly technical countermeasures.
ShieldFont works by exploiting the gap between machine parsing and human perception. Scrapers that ingest raw HTML see gibberish; human readers and properly configured browsers see coherent text. The key insight is that forcing scrapers to parse rendered output—rather than raw markup—imposes a measurable cost on their operations. While this is not an absolute barrier, it functions as a friction point: adapting to ShieldFont requires either abandoning the site or investing in more sophisticated (and therefore more expensive) parsing infrastructure. The white paper details the use of dictionaries to intelligently substitute ligatures, suggesting the technique is deliberately engineered to maximize usability for humans while minimizing utility for automated systems.
However, ShieldFont is not a universal solution. It works best on archived or static content explicitly marked as off-limits in robots.txt, where the primary concern is preventing training data incorporation rather than supporting real-time discoverability. The technique's equal impact on legitimate search engines highlights a core tension: defenses built for one type of unwanted scraper often catch innocent traffic. This is why site owners are turning to a layered approach—ShieldFont for static archives, maze traps and infinite redirect schemes (like those offered by Nepenthes and Cloudflare) to exhaust scraper resources on dynamically generated pages, and robots.txt compliance for cooperative clients. The availability of multiple tools suggests the arms race between site owners and scrapers is only accelerating.
For example, today's edition would include:
AI-summarized, only the topics you pick — one digest a day via Email, Slack, or Discord.
Free · takes 30 seconds · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. Q&As are published on this page for other readers too.
Google's AI search gave advice to call emergency services for users alone with an African, Indian, or Pakistan…
The U.S. Department of Defense announced on August 31 that it has deployed ChatGPT Mil, a customized version o…
OpenAI stopped running inference on a model involved in the HuggingFace incident, but the post argues this is…
OpenAI announced its support for California Senate Bill 1119, which aims to establish strong, age-appropriate…
A UK study by UK AI Security Institute and Limbic AI surveyed 6,474 British adults
Anthropic trained an Opus-class model with large-scale reinforcement learning on environments vulnerable to re…
