DEVICE, BOT AND NETWORK INTELLIGENCE
Every sign-up checked. Every check explained.
LR Defender recognizes the device behind each sign-up and login, checks it for bots, AI agents and risky networks, and returns allow, challenge or block with the reasons attached. Your server confirms every result with its API key.
One script tag and two calls from your server.
After a demo call, your account starts with a 90-day free trial, no card.
Sign-up · Chrome 131 on Linux · 203.0.113.24 · AS64500, hosting provider
navigator.webdriver is true
pendingfactHeadless browser signals present
pendingfactAddress belongs to a hosting provider
pendingfactDevice first seen 2 minutes ago
pendingfact
CHECK EACH OF THESE YOURSELF
90+ signals
Browser, hardware and runtime signals, from one SDK.
See what we collectSurvives a cookie wipe
Clear this site's storage and run the check again. The device ID comes back.
Try itConfirmed on your server
Your server fetches each verdict with its API key, so the answer you act on comes from us, not from the browser.
Server APIPrices on the page
Published prices, and a 90-day free trial with no card after a demo call.
Pricing
LIVE CHECK
Run it on this browser. Nothing runs until you press the button.
One click runs the same SDK your users would get and shows what your server would receive: a device ID scoped to this demo, how it matched, the automation checks, and how your network looks from our side.
Device ID
not run yetMatch and confidenceHow closely this visit matched a device we have seen before. It is a heuristic score, not a probability.
not run yetAutomation: WebDriver, headless, scripted client
not run yetNetwork: VPN, public proxy, datacenter, Tor
not run yetAction: allow, challenge or block
not run yetResidential proxy
not run yetTime zone against IP location
not run yet
This runs our browser SDK in this tab and keeps the result in a demo account. See what we collect
- Clear this site's cookies and storage, then run it again. The ID does not depend on them.
HOW IT WORKS
How a sign-up gets its answer. Four steps, each one visible to you.
THE PLATFORM
Four capabilities. One API. Each one ships with its own evidence.
visit 38, after the wipe
Device identity
A device ID derived from hardware and runtime signals. Clearing cookies or site data does not reset it.
Device identityBots and AI agents
Flags headless browsers, WebDriver and automation frameworks on every identification. Ambiguous automation gets a challenge, not a block.
Bots and AI agents198.51.100.7 · AS64503
Network risk
VPN, public proxy, datacenter and Tor, with the ASN, the operator and an action.
Network riskAccount trust
Early accessReal, Suspicious or Fake for every account, with linked accounts and the reason for each link.
Account trustEXPLAINABILITY
A verdict you can defend. To your risk team, your support queue, and the customer you just blocked.
Every verdict comes back with its reasons. The device result says how it matched, the network verdict carries its rationale, and your rules show which one decided. When we cannot rule something out, such as a residential proxy we have no source for, the answer says so.
Unknown is not clean.
THE DASHBOARD
Built for the people who review the cases. Look up a device, read a network verdict, and change a rule without a deploy.
WHERE TO CALL IT
Built for the moments fraud happens. Sign-up, login, the moment value moves, and every promotion in between.
FOR DEVELOPERS
Live in an afternoon. One script tag and two calls from your server.
- In your pageapp.example.com / sign-upExample dataEmailname@example.comCreate accountLR Defender scriptin the page
Step 1: Add one script tag.
Put our script on the pages you want to protect, such as sign-up and login. It loads from our script host, so there is nothing to install.
- On your serverYour server / new sessionExample dataSession created
- For
- app.example.com
- Expires
- in 2 minutes
- API key
- stays on your server
Handed to the sign-up pageStep 2: Your server creates a session.
Your server asks us for a short-lived session with its API key and hands it to the page, which runs the check. The key itself never reaches the browser.
- On your serverYour server / verdictExample data
Sign-up · app.example.com
navigator.webdriver is true
pendingfactAddress belongs to a hosting provider
pendingfact
DecisionblockStep 3: Your server reads the verdict.
When the form is sent, your server fetches the verdict with its API key: allow, challenge or block, with the reasons. The answer you act on comes from us, not from the browser.
Works today: sign-up, login and checkout in any modern browser, mobile web included.
REST API, described in OpenAPI.
React, Vue, Angular and Next.js: the same script tag. See the frameworks guide.
Native iOS and Android SDKs: not available yet.
OUR RULES
We say what we measured, and nothing we didn't. The same rule applies to this page.
Private by design.
Device IDs are scoped to your account, so the same laptop has a different ID at every customer. The SDK does not collect names, email addresses, phone numbers, payment data or government IDs.
What we collectHonest about limits.
Matching holds across browsers that share an engine, such as Chrome and Edge. Matching across engines is in evaluation and off by default. Native mobile SDKs are not available yet. We tell you where the edges are before you find them.
Read the limitsPeople you can reach.
LR Defender is built by Lightning Research, Inc., Paris, France. Security reports go to security@lightningresearch.ai.
About us
Put reasons behind your next sign-up decision.
Book a demo: after the call, we set up your account with a 90-day free trial on the Pro plan's limits, with no card. Or talk to an engineer about volume, hosting and procurement.