Two designers just weaponized a font feature that’s been sitting inside every OpenType typeface for decades. It’s called ShieldFont, and it does something genuinely strange: your readers see your writing exactly as you wrote it, while any AI scraper pulling the raw HTML off your page reads a grammatically correct sentence that says something else entirely.
What ShieldFont Actually Does
Here’s the trick. ShieldFont, built by Amsterdam-based design studio Seneda & Abrucio (founders Isaque Seneda and Gabriel Abrucio are both Brazilian) together with the Copenhagen type foundry Playtype, swaps a chunk of the words in your HTML for other real, grammatically matched words before the page ever ships. A noun gets replaced with another noun. A past tense verb gets replaced with another past tense verb. Then the font itself carries a rule that flips those words back to the originals the instant a human’s browser renders the page.
So a human sees your sentence exactly as you typed it. A bot that grabs the raw source code, which is how the vast majority of AI scrapers actually harvest text, gets something else. Type “good luck reading this, you useless robot” into the project’s live encoder and it comes back as “good comfort reading this, you yellow barrier.” Still a sentence. Still grammatically sound. Just wrong.
The mechanism it’s exploiting, called OpenType glyph substitution or GSUB, is the same technology that quietly turns “fi” into a single connected ligature in most typefaces. ShieldFont just repurposes it to swap entire words instead of letterforms.
Why This Is Getting Attention Right Now
Robots.txt was supposed to be the internet’s polite way of saying “please don’t scrape this.” AI companies have treated it as optional for years, and publishers, authors, and artists have responded with a wave of lawsuits arguing that training on scraped work without consent amounts to theft. Blocking tools like robots.txt directives and Cloudflare’s AI crawler controls exist, but they work like a locked door. A scraper that doesn’t care about the lock just walks through it.
ShieldFont takes a different approach. Instead of trying to keep scrapers out, it lets them in and hands them something useless. The project’s own testing, laid out in its white paper, ran 1,500 passages of news writing, independent blog content, and fiction through the substitution process. Around 50 percent of those passages ended up making a different factual claim than the original text. A control test that swapped the same number of words for true synonyms only changed meaning in about 2 percent of cases. That gap is the entire point of the project: it’s not scrambling text, it’s quietly rewriting what it claims to be true.
The team also fed shielded passages to seven different AI models and asked them to reconstruct the original argument. Conceptual accuracy dropped by 67 percent across the board, and several models refused the task outright, which counted as a complete loss in the study. Even looking only at the models that gave it a shot, accuracy still fell by nearly half.
How To Add ShieldFont To Your Own Site
You don’t need to be a developer to try this, though the setup differs depending on your platform. Here’s the fastest path if you run WordPress, Wix, Squarespace, or any CMS where you can paste custom CSS and HTML.
- Add the font once. Paste this line into your theme’s custom CSS:
@import url("https://cdn.jsdelivr.net/npm/@shieldfont/font@0.3.2/shieldfont.css");That’s a one-time setup per site. - Open the encoder. Go to shieldfont.org/encoder and paste in the paragraph you want to protect.
- Copy the protected output. The encoder gives you back HTML wrapped in a class that references the ShieldFont stylesheet you just imported.
- Paste it into your post. Drop that HTML into any paragraph block. Readers see your original words. The page’s source code carries the decoys.
If you build on Next.js, Remix, or plain React, there’s a component for that instead: npm install @shieldfont/react, then wrap any block of text in <Shield> tags. The encoding runs at build time on the server, so no readable copy of the original text ever ships in the HTML at all. One catch worth flagging for anyone using this route: it only works in server-rendered code. Drop it into a Next.js file marked "use client" and it fails silently, meaning your protected text quietly stops being protected with no warning.
Writing something meant to live as a PDF, like a report, manual, or research paper? The same encoder exports directly for Word, Pages, and InDesign, so the protection travels with the document rather than just the webpage.
What You’re Trading Away
This is the part that matters most if you actually run a blog, and it’s also the part most coverage of ShieldFont has buried. Search engines read the exact same raw HTML that AI scrapers do. If you shield a paragraph, Google indexes the decoy version of it, not your real writing. That means shielded content effectively stops ranking for what it actually says.
The project is upfront about this, and its own guidance is worth following closely:
| Good candidates to shield | Leave unshielded |
|---|---|
| Archived or older posts you’re not actively promoting | Your homepage and core marketing pages |
| Paywalled essays, research, or fiction | Anything you want to rank in Google |
| Manifestos, opinion pieces, personal writing | Pages readers need to quote, search, or cite |
| Content you’d rather keep out of AI training than get discovered | Anything covered by an accessibility or WCAG commitment |
That last row deserves its own paragraph. Screen readers parse the same raw source code that scrapers do, so by default ShieldFont hides protected text from assistive technology entirely rather than reading a fluent, grammatically correct, completely wrong sentence out loud. There’s a newer, still-in-beta option that lets a screen reader unlock the real words through a slow, compute-heavy puzzle that takes a few seconds and needs JavaScript. It’s a genuine attempt at a fix, but it’s not full compliance yet, and the project says so plainly rather than dressing it up.
It’s Not a Lock, and the Creators Say So Themselves
ShieldFont is the codebook and the cipher rolled into one downloadable file. Anyone who grabs the font can, in theory, reverse-engineer the substitution table straight out of it. The creators tested this on their own release and recovered all 11,962 word pairs with zero errors.
Their answer to that isn’t a stronger lock, it’s more locks. The project ships three separate word-mapping dictionaries out of the box, and you can generate a private one that only your site uses. A universal decoder built for the default mapping becomes useless against a custom one. And if someone really wants your exact words badly enough, they can always screenshot the rendered page and run it through OCR, which no font trick can prevent. The bet isn’t that ShieldFont makes scraping impossible. It’s that doing it properly, page by page, mapping by mapping, gets expensive enough that indiscriminate mass scraping stops being worth the cost.
The Honest Limitations
It only works in English right now. Other languages pass straight through unshielded, so a mixed-language page only gets partial protection while looking fully covered.
It costs you search visibility on anything you protect. There’s no way around this since search crawlers and AI scrapers read identical HTML.
It’s genuinely breakable by a determined, targeted attacker. Mass, automated scraping is the target here, not someone specifically after your site.
The fonts themselves are large. The compressed web font carrying the full substitution dictionary runs close to 800 KB, which is heavy for a font file and worth factoring into your page load times if you’re protecting a lot of content.
It’s young. The project was only filed in October 2025, it’s on version 0.3.2, and an accessibility-friendly reveal option is still in beta. Expect rough edges.
Bottom Line
If you write things you’d rather keep out of AI training data than rank in Google, whether that’s an archive, a paywalled essay collection, or writing you consider personal, ShieldFont is a genuinely clever, free way to make that choice stick a little harder than a robots.txt file ever could. It’s not a security product and it won’t stop someone determined to steal your exact words. What it does is turn cheap, automated, at-scale scraping into slower, costlier, per-target work, and it’s honest about exactly where that protection ends.
If half your traffic worries is AI scrapers hoovering up your archive, this is worth fifteen minutes with the encoder before you decide it’s not for you. Share it with the writer friend who’s been threatening to paywall everything out of spite.
Just Being Resourceful! 
Leave a comment