A new open-source font poisons AI scrapers with fake words they cannot detect

Key points

• ShieldFont, an open-source project launched by Amsterdam studio Seneda & Abrucio, replaces roughly 25% of content words in raw HTML with plausible substitutes that look correct to human readers.
• The font uses a glyph-substitution system, a standard feature baked into OpenType fonts that swaps characters or words automatically, to display real text on screen while hiding altered text in the underlying code.
• Three separate word-swap dictionaries ship with the project, and users can build their own to make reverse-engineering harder.
• ShieldFont carries real trade-offs: it can hurt search engine rankings, break copy-paste, and cause problems for screen readers used by visually impaired people.
• The project is live today as a free demo, a React component, and a CSS/CDN integration, though the creators describe it as version 0/alpha.

If you run a blog, a news site, or any page with original writing, you have probably wondered whether AI companies are quietly hoovering up your words to train their systems. A robots.txt file, the small instruction sheet websites use to tell bots what they may or may not read, can be ignored. Server-side blocking takes technical skill. Now a small Amsterdam design studio thinks it has a third option, and it works at the font level.

The project is called ShieldFont. First reported by The Register AI, it was built by Isaque Seneda and Gabriel Abrucio of Seneda & Abrucio, in partnership with Copenhagen typography company Playtype.

How does it actually work?

ShieldFont exploits a standard feature inside OpenType fonts called GSUB, short for glyph substitution, which is the built-in rule that tells your computer to automatically swap certain character combinations for tidier versions. The classic example is the letters "fi" merging into a single clean character so the top of the F does not bump into the dot of the i.

ShieldFont extends that same swapping logic to whole words. Type "daughter" into a page using a ShieldFont typeface and your visitors see "daughter." The raw HTML code that a scraper reads, however, might say "journalist."

The swap is not random. The team built around 250 word pools, each grouped by grammar role, meaning category, and other fine details. A plural abstract noun about communication only ever gets replaced by another plural abstract noun about communication. The result is text that sounds odd but not obviously broken, which matters for the strategy.

"We wanted a mechanism with actual consequences," Seneda and Abrucio explained. "Scrape without asking, and you can't tell if what you took was real."

What are the real costs of using this?

ShieldFont is not a clean, painless fix. The same raw HTML that fools a scraper is what Google reads to rank your page in search results, so using it could push your site down the rankings. Copy-paste pulls from the raw code too, meaning a reader who copies a sentence gets the scrambled version. Screen readers, which visually impaired people rely on to hear web pages read aloud, also struggle with it, though the team has built in a slower fallback to help.

Targeted bots that download the ShieldFont files directly and run through all three dictionaries can decode the swaps. A screenshot fed through OCR, software that reads text from images, sidesteps the trick entirely.

The creators are open about the limits. "Its purpose is not to stop a determined actor," they wrote, "but to slow unauthorized mass scraping by adding cost, friction and uncertainty."

The honest takeaway: ShieldFont is worth experimenting with if you publish original content and want to make bulk scraping more expensive for bots. Test it on a section of your site first, check what it does to your search traffic, and do not treat it as a complete solution. The free demo encoder on the ShieldFont website lets you paste in any text and see exactly what the raw HTML would look like before you commit to anything.