iClosed Shield is a built-in security feature that automatically fingerprints every visitor on your public booking page and returns real-time risk and integrity signals, before a call is ever booked.
Instead of trusting every visitor equally, iClosed enriches each contact with security signals (such as VPN use, location spoofing, emulator/bot detection, and browser integrity) that you can act on.
Shield is one of the iClosed Data Intelligence features which signals can be used for:
Disqualifying leads that trip your risk criteria (e.g. VPN + location spoofing), or
Conditional routing logic to send suspicious-but-allowed visitors to the right handling
⭐ Shield is available on all plans for Disqualification, but Conditional routing on Shield fields requires the Business plan (Startup and Growth can disqualify on Shield signals, but not route on them). See the full feature and pricing breakdown here.
How Does It Work
Shield fingerprints the visitor's device and network the moment they land on your public booking page, and returns a set of security signals that describe how trustworthy the session is.
For example whether the visitor is on a VPN or proxy, whether their location appears spoofed, whether the session looks like an emulator or bot, and browser/OS integrity details. Those signals become available as criteria inside Disqualification and Conditional Routing, so a visitor can be blocked or routed based on what Shield returns.
Pro Tips
Shield works with no disqualification and conditional routing applied, so we advise you to enable it first, analyze pattern and then disqualify or route to a specific host.
Never block based on just 1–2 leads, but look for a repeated pattern (same email/name pattern across 7–8 bookings, same proxy + country combo).
This way you will prevent blocking the real leads.
When Shield will run
Shield only runs when it is enabled at both levels:
Account level — Shield is turned on for your workspace under Data Intelligence, and
Event level — Shield is toggled on for the specific event.
If the account toggle is off, the event toggle can't be used. If the account is on but the event is off, Shield does not run for that event and no credits are spent, so the visitors will be able to book calls as per other event conditions.
When Shield is unavailable
If Shield cannot return a result, the check is treated as unavailable. The following all count as unavailable:
The provider is blocked or unreachable
The check times out
The feature otherwise can't run
Your wallet is empty (no credits/tokens available)
You control what happens in this case with a "Disqualify when Shield is unavailable" checkbox.
When it's off, the booking is allowed to complete even if Shield didn't run, so a visitor is never falsely disqualified. When it's on, a visitor is disqualified whenever Shield can't produce a result.
Pro Tips
Shield can also be managed from the
Settings → Integrations page.
Shield must be enabled at the account level before the event-level toggle becomes usable. If the toggle appears disabled, enable Shield for your workspace under Data Intelligence first.
Enrichment Requirements
For Shield to run and return signals:
Shield is enabled at both the account and event level
The visitor has loaded your public booking page (Shield fingerprints the session on the page)
Credits/tokens are available in the wallet
Setting it up
Shield is enabled from the event's Data Intelligence section, the same place as the other enrichment features.
Navigate to AI Scheduler → Events and click the event to open its setup
Select the Data Intelligence section in the left-side menu
Click "Browse Enrichment", select iClosed Shield, and turn the toggle ON
After the Shield is turned on, navigate to Disqualification or Conditional routing section for further configuration:
Disqualifying leads that trip your risk criteria (e.g. VPN + location spoofing) along with option to enable "Disqualify when Shield is unavailable" if you want visitors blocked whenever Shield can't return a result
Conditional routing logic to send suspicious-but-allowed visitors to the right handling
Set conditions and confirm by pressing "Save Changes"
Pro Tips
Shield screens every visitor on the public booking page, so it works alongside your form questions, not just after the form is completed.
Keep wallet auto-recharge ON so Shield isn't interrupted mid-campaign (an empty wallet counts as "unavailable").
Shield Signals
Shield returns a set of security and device-integrity signals for each visitor. Each signal is a different way of asking the same underlying question:
is this a genuine prospect, or someone trying to slip a bot, a spoofed device, or a hidden identity past your booking page?
Every signal is available as a criterion in Disqualification and Conditional Routing, as a column and advanced filter in Global Data, and on the contact card's Fingerprint tab.
The signals fall into a few natural groups. Most are simple Yes / No flags, a few return levels (Low / Medium / High) or a small set of categories. Here's the breakdown:
Identity & session context
These describe who and what is on the page.
They're rarely a reason to block on their own, but they're the context you combine with risk flags.
Signal | Values | What it means / defends against |
Browser name | Safari, Mobile Safari, Chrome, Mobile Chrome, Firefox, Mobile Firefox, Brave, Opera | The browser the visitor is using. Useful for routing and for spotting odd combinations (e.g. an automation-friendly browser paired with other risk flags). |
User Device OS | Windows, Mac OS X, Linux, Android, iOS | The operating system of the visitor's device. Server/automation setups often surface as Linux where you'd expect consumer OSes. |
User Device Country Code | Any country (searchable, grouped by continent) | The country the device reports. Compare against the visitor's stated location or your target market. |
Continent code | AF, AN, AS, EU, NA, OC, SA | The continent of the device. A coarser version of country code, handy for broad routing or filtering. |
Visitor found | Yes / No | Whether Shield recognized this visitor's fingerprint. "No" means a brand-new/unseen device. |
High activity | Yes / No | Whether this visitor's fingerprint has been unusually active (many sessions/bookings in a short window) — a sign of scripted or repeat abuse. |
Overall risk scores
These are Shield's summarized verdicts — the quickest single signals to build rules on.
Signal | Values | What it means / defends against |
Confidence score | Low (< 0.5) Medium (0.5 to < 0.8) High (≥ 0.8) | Shield's overall confidence that the visitor is genuine. This is an internal health-scoring system that weighs many device and network factors in the background to identify bad actors. Higher = more trustworthy. |
Suspect score | Yes / No | An internal flag raised when the visitor's session looks suspicious across Shield's combined checks. A quick "this one is off" indicator. |
Bot result | Not detected, Good, Bad | Whether the session appears automated. "Bad" indicates a likely malicious bot, "Good" indicates a known benign bot and "Not detected" means it looks human. Your first line of defense against scripted spam bookings. |
Network & location integrity
These catch visitors hiding or faking where they're really connecting from the classic toolkit of spammers and fraudulent bookers.
Signal | Values | What it means / defends against |
VPN detected | Yes / No | The visitor is connecting through a VPN, masking their true network/location. |
VPN confidence | Low / Medium / High | How certain Shield is that a VPN is in use. Pair with VPN detected to avoid acting on weak signals. |
Proxy detected | Yes / No | The visitor is routing through a proxy server to obscure their origin. |
Proxy confidence | Low / Medium / High | How certain Shield is that a proxy is in use. |
Proxy type | Residential, Data center, Unknown | The kind of proxy. Data center proxies are a strong automation/fraud signal; residential proxies are commonly used to look like ordinary home users. |
Tor detected | Yes / No | The visitor is on the Tor anonymity network - a heavy anonymization signal rarely seen from genuine buyers. |
Location spoofing | Yes / No | The device's reported location appears falsified (e.g. GPS/timezone manipulation). |
IP blocklist | Blocked / Not blocked | The visitor's IP address appears on a known-bad blocklist. |
Email spam (blocklist) | Yes / No | The email is associated with spam/abuse blocklists. |
Attack source (blocklist) | Yes / No | The IP/source is associated with known attack infrastructure. |
Device tampering & automation
These detect environments built to fake, script, or manipulate a real device. This is the deepest layer of defense against sophisticated bad actors.
Signal | Values | What it means / defends against |
Emulator detected | Yes / No | The "device" is a software emulator rather than a real phone/computer — a hallmark of automated fraud farms. |
Virtual machine | Yes / No | The session runs inside a virtual machine rather than a physical device. |
Cloned app | Yes / No | The booking app/page is running as a cloned/duplicated instance, often used to run many fake sessions. |
Anti-detect browser | Yes / No | A specialized browser designed to defeat fingerprinting and impersonate many different users. Almost exclusively used by bad actors. |
Tampering detected | Yes / No | The device/session shows signs of manipulation. |
Tampering anomaly score | Less than 0.5, Greater than or equal to 0.5 | A graded measure of how much tampering is detected. ≥ 0.5 = significant tampering. |
Root apps detected | Yes / No | The (Android) device has root/superuser apps installed, giving the user deep control to manipulate the environment. |
Jailbroken | Yes / No | The (iOS) device is jailbroken, removing manufacturer restrictions and enabling tampering. |
Frida detected | Yes / No | The Frida instrumentation toolkit is present — a developer tool used to hook into and manipulate apps at runtime. A strong technical-abuse signal. |
Developer tools | Yes / No | Browser developer tools are open during the session. |
Incognito | Yes / No | The visitor is in private/incognito browsing mode. |
Privacy settings | Yes / No | The browser is in a hardened/restricted privacy state that limits what can be read about the session. |
MITM attack | Yes / No | A man-in-the-middle attack is detected on the connection, meaning traffic may be intercepted. |
Important Notes
The signals available in your account may expand over time as Shield's detection capabilities grow.
If a signal appears in your event's dropdown but not above, treat its label literally. Most are Yes / No flags where Yes means the risk condition is present.
Credits used per Shield check
Shield is a usage-based feature billed from your iClosed wallet. You only pay when a check actually runs.
iClosed Shield = $0.20 (1 token) per check
Shield charges once per potential contact and then caches the result for 7 days.
If the same visitor returns within that window, Shield reuses the cached result and does not charge again. A visitor is re-checked (and charged again) only when:
The 7-day cache window lapses, or
The cache is cleared (e.g. browser data cleared), or
The visitor's device changes
Pro Tips
Have wallet auto-recharge turned ON so Shield is never interrupted. An empty wallet will be treated as "unavailable."
Because results are cached for 7 days, high-traffic events won't be charged repeatedly for the same returning visitor.
Analyzing Shield Results
Shield Logs
The Shield logs page provides an audit trail of every Shield check in your workspace.
For each check you'll typically see the contact, the result (success / failed / cached), credits or tokens consumed, and the timestamp.
Shield also appears as its own line in the credits usage breakdown, and clicking it opens the feature-specific logs.
This is the system-level and billing-level view, ideal for monitoring usage and cost, debugging failed or unavailable checks, and confirming cache behavior.
Global Data
Shield signals are available as Global Data columns and advanced filters, so you can segment and build Smart Views across your leads — for example "Booked on VPN," "Location spoofed," or "Disqualified by Shield."
This is the strategy and optimization view, where patterns live in table view.
Contact Card - Fingerprint tab
The Contact Card includes a Fingerprint tab showing all Shield signals for that specific visitor, and Shield events appear in the contact's journey timeline (success/failure, credits used, and whether the result was served from cache).
This is the decision-making view, optimized for setters and closers during a call.
Shield fields are also surfaced on pipeline cards and are available in Zapier/Make, so downstream automations can act on Shield signals.
Shield with iClosed Disqualification & Conditional Routing
Shield with iClosed Disqualification
Shield with iClosed Disqualification
Disqualification on Shield signals is available if Shield is turned ON in the Event – Data Intelligence section, and applies once Shield returns a result for the visitor (or, if you've enabled it, when Shield is unavailable).
All visitors that meet your criteria will be disqualified as per the Disqualification rules set in your event. Because Shield screens the visitor on page load, it can block a suspicious visitor before they ever take a slot on your calendar — which is the whole point of the feature: keeping bots, spammers, and fraudulent bookers off your closers' schedules.
Disqualification is available on all plans, including Startup and Growth.
Think of Shield disqualification in three tiers of severity:
Hard block (near-certain bad actors)
These signals almost never come from a real buyer, so a single "Yes" is usually enough to disqualify:
Bot result is Bad
Emulator detected, Virtual machine, Cloned app, or Anti-detect browser is Yes
Frida detected, Root apps detected, or Jailbroken is Yes
Tor detected is Yes
MITM attack is Yes
Attack source (blocklist) or IP blocklist is Blocked
Tampering detected is Yes / Tampering anomaly score ≥ 0.5
Soft block or review (suspicious, but not always malicious)
These are better used in combination (see Best Practices) or to redirect rather than hard-block, since legitimate people sometimes trip them:
VPN detected is Yes with VPN confidence High
Proxy detected is Yes with Proxy type Data center
Location spoofing is Yes
Confidence score is Low
Suspect score is Yes
High activity is Yes
Email spam (blocklist) is Yes
Shield unavailable fallback option
Use the "Disqualify when Shield is unavailable" checkbox if you'd rather fail closed than let unscreened visitors book (remember an empty wallet counts as unavailable).
Learn More about Invitee Disqualification & Redirection for how to build disqualification conditions.
Shield with iClosed Conditional Routing
Shield with iClosed Conditional Routing
Conditional routing on Shield signals is available if Shield is turned ON in the Event – Data Intelligence section, and applies once Shield returns a result for the visitor.
All visitors that meet your criteria will be routed to specific closers as per the Conditional Routing rules set in your event. Routing is the softer companion to disqualification: instead of blocking a flagged-but-allowed visitor, you send them somewhere appropriate.
Conditional routing on Shield fields requires the Business plan. On Startup and Growth, Shield signals are available for disqualification but not for routing.
Common ways teams route on Shield signals:
Clean, high-trust sessions (Confidence score High, no VPN/proxy, Bot result Not detected) → route to your best closers, since these are your most legitimate prospects.
Flagged-but-allowed sessions (e.g. VPN detected Yes but Confidence score Medium/High) → route to a senior rep or a verification step, so someone experienced can confirm identity on the call rather than turning the lead away outright.
Geographic routing (User Device Country Code or Continent code) → route by real device location to the right regional team, independent of what the visitor typed on the form.
Device-based routing (User Device OS or Browser name) → e.g. send mobile visitors to reps who specialize in mobile-first conversations.
Learn more about Conditional Routing for how to build routing conditions.
Best Practices - Combining Signals
Best Practices - Combining Signals
No single signal tells the whole story. Real buyers occasionally trip one flag (a privacy-conscious user on a VPN, someone in incognito mode), while sophisticated bad actors try to look clean on the surface.
The reliable approach is to cross-check signals — look for a risk flag confirmed by a second, independent one before you block.
The rule of thumb:
one soft signal = watch;
two independent soft signals = act.
Hard signals (emulator, Frida, cloned app, MITM, anti-detect browser) can stand alone.
High-confidence bad-actor combinations
These pairings rarely occur together for a genuine buyer, so they make strong disqualification rules:
Combination | Why it's a strong signal |
VPN detected = Yes AND VPN confidence = High | A confirmed VPN (not a weak guess). Someone deliberately masking their network. |
Proxy detected = Yes AND Proxy type = Data center | Data-center proxies are for servers and automation, not home users. Classic bot infrastructure. |
Location spoofing = Yes AND VPN/Proxy = Yes | Faking location and masking the network — deliberate concealment, not coincidence. |
Confidence score = Low AND Suspect score = Yes | Shield's two summary verdicts agreeing that the session is off. |
Bot result = Bad AND High activity = Yes | An automated session that's also hammering your scheduler — a spam run in progress. |
Emulator detected = Yes AND User Device OS = Android/iOS | A "mobile" visitor whose device is actually emulated — a fake device pretending to be a phone. |
Incognito = Yes AND Developer tools = Yes AND Confidence score = Low | Private browsing plus open dev tools plus a low trust score — a tinkerer probing your page, not a buyer. |
Tampering detected = Yes AND Tampering anomaly score ≥ 0.5 | The flag is confirmed by the graded score, so it's significant manipulation, not noise. |
Signals that are safe to act on alone
These are strong enough that a single "Yes" justifies a hard block, because they almost never appear for legitimate visitors:
Frida detected, Cloned app, Anti-detect browser, MITM attack
Attack source (blocklist), IP blocklist = Blocked
Bot result = Bad
Root apps detected / Jailbroken (use with a little more care — some power users root/jailbreak their own devices; pair with another signal if you serve a technical audience)
Signals to use as context, not as a block by themselves
These are common enough among real people that blocking on them alone will cost you good leads. Use them to confirm another flag, or to route rather than disqualify:
Incognito, Privacy settings, Developer tools — privacy-conscious real users trip these constantly.
VPN detected (alone, low/medium confidence) — plenty of legitimate people always run a VPN.
Browser name, User Device OS, Continent code — descriptive context, best for routing.
Worked example — a balanced starter policy
A sensible starting configuration for a high-ticket scheduler:
Hard-disqualify if any of:
Bot result = BadEmulator = YesVirtual machine = YesCloned app = YesAnti-detect browser = YesFrida = YesMITM attack = YesAttack source = YesIP blocklist = Blocked.
Disqualify on confirmed concealment:
VPN detected = YesANDVPN confidence = HighorProxy type = Data centerorLocation spoofing = YesAND (VPN = YesORProxy = Yes)
Disqualify on agreeing summary scores:
Confidence score = LowANDSuspect score = Yes
Route, don't block:
VPN detected = YeswithConfidence score = Medium/High→ send to a senior rep for a quick identity check.
Leave everything else to book normally, so you don't sacrifice genuine leads to over-aggressive filtering.
Pro Tips
If you recognize "a real lead got blocked," check the Fingerprint tab on that contact. Usually it's a single soft signal (VPN or incognito) being used as a standalone hard block, and the fix is to require a second confirming signal, per the cross-check approach above.
Shield with Multi-Booking
Shield with Multi-Booking
Shield does not change the logic of the Multi-Booking feature.
The event's Disqualification or Conditional Routing conditions take priority when turned on.
FAQs
Where can I see usage for my Shield checks?
Where can I see usage for my Shield checks?
Shield usage appears as its own line in the tokens/credits usage breakdown, and clicking it opens the Shield logs with per-check results, credits/tokens consumed, and timestamps.
What happens if I don't have enough credits in my wallet?
What happens if I don't have enough credits in my wallet?
An empty wallet counts as Shield being unavailable. If "Disqualify when Shield is unavailable" is off, bookings still complete (without a Shield result); if it's on, visitors are disqualified until the wallet is topped up.
Turn on auto-recharge in Settings → Billing to avoid interruptions.
Will the same visitor be charged every time they visit?
Will the same visitor be charged every time they visit?
No. Shield charges once per visitor and caches the result for 7 days.
Within that window a returning visitor reuses the cached result at no additional charge. A re-check (and new charge) only happens if the 7-day window lapses, the cache is cleared, or the visitor's device changes.
Does Shield work on all booking pages?
Does Shield work on all booking pages?
Shield screens visitors on your public booking page, including Lift.
It runs when enabled at both the account and event level.
What is Shield actually protecting me from?
What is Shield actually protecting me from?
Bots, spammers, and fraudulent bookers.
Shield fingerprints each visitor's device and network to spot the tools bad actors use to fake being a real prospect — automated bots, emulators and virtual machines, VPNs/proxies and Tor, spoofed locations, tampered or jailbroken devices, and known-bad IPs.
You can then block those sessions before they take a slot on your closers' calendars.
What is the Confidence score, exactly?
What is the Confidence score, exactly?
It's Shield's overall internal health-scoring system. Behind the scenes it weighs many device and network factors together to judge how likely the visitor is to be genuine.
It's expressed as Low (< 0.5), Medium (0.5 to < 0.8), or High (≥ 0.8) — higher means more trustworthy.
Use it as a quick summary signal, ideally cross-checked with Suspect score or Bot result.
A real lead got disqualified by Shield — why?
A real lead got disqualified by Shield — why?
Almost always this is a single "soft" signal being used as a standalone block — most often VPN detected, Incognito, or Privacy settings, all of which privacy-conscious real people trigger routinely.
Open that contact's Fingerprint tab to see which signal fired. The fix is to require a second, confirming signal before disqualifying (see Best Practices — Combining Signals) rather than blocking on one soft flag alone.
Do "Yes" and "High" mean risky?
Do "Yes" and "High" mean risky?
For the Yes/No flags, Yes means the risk condition is present (e.g. VPN detected = Yes means a VPN is in use).
For the confidence-style levels it depends on the signal: for VPN confidence / Proxy confidence, High means Shield is very sure that VPN/proxy is present (riskier).
But for the overall Confidence score, High means the visitor is very likely genuine (safer).
When in doubt, check the Shield Signals table above.
What are the priority signals I should watch?
What are the priority signals I should watch?
The five to watch:
Bot detection
Tampering
VPN
Proxy
Country
example case: VPN + Country
You're a US business and your ICP is US based only - spam isolated to VPN-on bookings from a specific set of countries → they blocked VPN + those countries together.









