Install FindIP Shield in under two minutes

npm install @findip/shield

import { init, track } from '@findip/shield';

init({
  siteKey: 'pub_xxxxxxxxx',
  privacyMode: 'balanced',
  autoTrack: true,
  autoDetectForms: true,
});

await track('signup_attempt', { plan: 'free' });

The official @findip/shield package includes ESM, CommonJS, and TypeScript declarations. Replace pub_xxxxxxxxx with your public site key from the dashboard.

To attach your own user to each session, pass identify: { userId, email, plan } to init(); the SDK hashes the values in the browser. The Install page's npm snippet has an Identify logged-in visitors toggle that adds this for you; see Identify users and add context.

<script
  src="https://cdn.findip.net/shield/v1.js"
  data-site-key="pub_xxxxxxxxx"
  data-auto-track="true"
  data-privacy-mode="balanced">
</script>

That's it — the v1.js URL always serves the latest non-breaking 1.x build, so you get fixes and improvements automatically. Prefer to lock down an exact version? See Versions below.

To attach your own user to each session, enable Identify logged-in visitors on the Install page. The snippet then carries the user's ID, email and plan as data-* attributes; the SDK hashes them in the browser before sending. See Identify users and add context.

Pinning an exact version. The rolling v1.js URL is the easiest option and safe for most sites. If your security policy requires a fixed, verifiable build, load a versioned URL with subresource integrity instead — the browser then refuses to run the script unless it exactly matches the hash:

<script
  src="https://cdn.findip.net/shield/1.9.1/findip-shield.min.js"
  integrity="sha384-/cU3Q0LvX5WyiTbgWG5kpRDHwY0cKtWl1FMKxGdyouAcuTQnAr4geWrKrW4zIaxr"
  crossorigin="anonymous"
  data-site-key="pub_xxxxxxxxx"
  data-auto-track="true"
  data-privacy-mode="balanced">
</script>

Pinned URLs are immutable — the file at a versioned URL never changes. Upgrading means updating both the version in the URL and the integrity hash (your site's Install page always shows the current pinned snippet). SRI hashes can't be used with v1.js, since its content changes as new 1.x builds are released.