A new open-source font poisons AI scrapers with fake words they cannot detect

Key points

• ShieldFont, an open-source project from Amsterdam studio Seneda & Abrucio, replaces roughly a quarter of content words in raw HTML with plausible substitutes that look correct to human readers.
• The font uses a glyph-substitution system, a standard feature baked into OpenType fonts that swaps characters or words automatically, to display real text on screen while hiding altered text in the underlying code.
• Three separate word-swap dictionaries ship with the project, and users can build their own to make reverse-engineering harder.
• ShieldFont carries real trade-offs: it can hurt search engine rankings, break copy-paste, and cause problems for screen readers used by visually impaired people.
• The project is live today as a free demo, a React component, and CSS/CDN integration, though the creators describe it as version 0/alpha.

If you publish original writing online, you've probably wondered whether AI companies are quietly harvesting your words for training data. A robots.txt file can be ignored. Server-side blocking takes real technical skill. Now a small Amsterdam design studio thinks it has a third option, and it works at the font level. We covered the scraper-blocking beat when Patreon moved from polite requests to active enforcement on 17 July; ShieldFont takes a different angle entirely.

The project is called ShieldFont. First reported by The Register AI, it was built by Isaque Seneda and Gabriel Abrucio of Seneda & Abrucio, in partnership with Copenhagen typography company Playtype.

How does it actually work?

ShieldFont exploits a standard feature inside OpenType fonts called GSUB, short for glyph substitution, the built-in rule that tells your computer to automatically swap certain character combinations for tidier versions. The classic example is the letters "fi" merging into a single clean character so the top of the F does not bump into the dot of the i.

ShieldFont extends that same swapping logic to whole words. Type "daughter" into a page using a ShieldFont typeface and your visitors see "daughter." The raw HTML that a scraper reads, however, might say "journalist."

The swap is not random. The team built around 250 word pools, each grouped by part of speech and sense category. A plural abstract noun about communication only ever gets replaced by another plural abstract noun about communication. The result is text that sounds odd but not obviously broken, which matters for the strategy: the goal is not rejection but ingestion of bad data.

"We wanted a mechanism with actual consequences," Seneda and Abrucio explained. "Scrape without asking, and you can't tell if what you took was real."

What are the real costs of using this?

ShieldFont is not a clean fix. The same raw HTML that fools a scraper is what Google reads to rank your page, so using it could push your site down the rankings. Copy-paste pulls from the raw code too, meaning a reader who copies a sentence gets the scrambled version. Screen readers, which visually impaired people rely on to hear web pages read aloud, also struggle with it, though the team has built in a slower fallback to help.

Targeted bots that download the ShieldFont files directly and run through all three dictionaries can decode the swaps. A screenshot fed through OCR, software that reads text from images, sidesteps the trick entirely.

The creators are open about the limits. "Its purpose is not to stop a determined actor," they wrote, "but to slow unauthorized mass scraping by adding cost and uncertainty."

Honest verdict: ShieldFont is worth a careful experiment if you publish original content and want bulk scraping to cost bots more. Test it on one section of your site first and watch what happens to search traffic. The free demo encoder on the ShieldFont website lets you paste in any text and see exactly what the raw HTML would look like before you commit.