BOTS AND AI AGENTS AT THE FRONT DOOR
Keep scripts out of sign-up and login. And see the AI agents that drive real browsers.
Credential stuffing, scripted sign-ups and agent-driven sessions arrive through the same forms your customers use. LR Defender checks every identification for automation and returns allow, challenge or block, so you do not have to put a puzzle in front of everyone.
- 01Sign-upChecked here
- 02LoginChecked here
- 03Payout
What runs there
- Hard signals
- Pointer model
- Agents
Your server gets
The playbook
How the abuse works.
Scripted clients.
Headless browsers and HTTP tools replaying your form.Stealth browsers.
Automation frameworks patched to hide their flags.AI agents.
A model driving a genuine browser, one careful click at a time.
What we check
What LR Defender checks at each step.
Scripted clients
What we check
Hard signals.
What you get back
Whether a hard automation signal fired, and whether the checks found a bot.
Stealth browsers
What we check
Pointer model and consistency heuristics.
What you get back
The combined bot score, from 0 to 1, and the pointer model's own result.
AI agents
What we check
Agent detection (on by default; you can switch it off for your account).
What you get back
Whether an AI agent was found, and whether it was verified by its signature or its published addresses.
Every step
What we check
Network verdict.
What you get back
Whether the address is a Tor exit, a VPN or in a datacenter, and the recommended action.
Try it
Move your pointer.
Your own pointer path and key presses, measured live in this browser. Signed-in accounts can also score them with the live bot check.
Move your pointer here. The trail is your real path.
Hard signals, read at once
Keep moving your pointer, or type, to enable the live score.
The counters are real event counts, the hard signals are plain property reads, and the verdict comes from the live bot check. Nothing here is simulated.
Where to call it
Call it on sign-up and login.
- 01
Your server
Mint a session token when you render the sign-up or login page.
- 02
The browser
Call identify() when the form is submitted and send requestId with it.
- 03
Your server
Fetch the verdict, then block, challenge or allow before the user signs in.
One script tag and two calls from your server.
Policy starting point
A starting point. Tune it on your own traffic.
| Situation | Suggested action |
|---|---|
| Hard automation signal | Block |
| Pointer model says scripted, no hard signal | Challenge |
| Agent detection, strong evidence | Block |
| Agent detection, ambiguous | Challenge |
| Nothing found | Allow |
Stop scripts without stopping people.
After a demo call, we set up your account and email you a link to set your password. It starts with a 90-day free trial on the Pro plan's limits, with no card.