What Is Shape Security? – Definition and How It Works
Learn what Shape Security does, why it targets credential abuse, and how its obfuscated telemetry works.
Shape Security is an anti-automation product now part of F5, deployed on high-value transaction flows — logins, payments, account changes — rather than on public content.
1. The Threat It Targets
Shape's focus is not scraping. It is credential stuffing, account takeover, and transaction fraud at large scale, which shapes everything about how it works:
| Property | Consequence |
|---|---|
| Deployed on auth and payment flows | Public pages often unprotected |
| Optimised for high-value decisions | Tolerates more analysis cost per request |
| Heavy client-side telemetry | Large obfuscated scripts |
| Behavioural emphasis | Interaction patterns matter |
So encountering Shape on a login page is expected; encountering it on a product listing is unusual.
2. Heavily Obfuscated Client Telemetry
Shape's distinguishing technical characteristic is a large, aggressively obfuscated JavaScript payload that collects a wide signal set and posts it in an encrypted or encoded form.
The obfuscation is deliberate and rotates, which has a specific consequence: the collection logic is not stable enough to reimplement. Any approach that depends on replicating what the script sends breaks when the script changes, which is frequently.
3. What It Collects
Broadly the full client-side surface:
- Browser and device fingerprint — navigator, screen, hardware, rendering.
- Automation artefacts and environment inconsistencies.
- Input behaviour — timing, movement, keystroke dynamics, focus events.
- Page interaction sequence and dwell times.
- Network and address characteristics.
- Session history across the flow.
Keystroke and pointer dynamics are weighted heavily, because credential stuffing is characterised by inhumanly fast, uniform form completion.
4. Identifying It
| Class | Signal |
|---|---|
| URL | script paths from an F5/Shape telemetry domain |
| Payload | large encoded POST bodies to a telemetry endpoint |
| DOM | injected hidden form fields |
| Content | obfuscated inline script with rotating identifiers |
| Header | vendor-specific request headers on the telemetry call |
Because names and paths rotate, the durable signals are shape rather than exact strings: an unusually large obfuscated script plus an encoded telemetry POST alongside a login form is the recognisable pattern.
5. Detection Without Blocking
Like several fraud-oriented products, Shape often reports rather than blocks. The site decides whether to allow, step up verification, or reject.
The practical consequence is that absence of a visible block is not evidence of success. A session can be scored as automated, permitted, and flagged — and the account can be actioned later.
6. Where This Leaves Legitimate Work
Public data collection is usually unaffected, because Shape guards actions rather than content. The first thing to check is whether the data you want actually sits behind the protected flow — often it does not.
Testing your own application is a coordination problem: whoever owns the F5/Shape integration can provide a test configuration or an allowlisted path. That is the supported route, and automating the real protection is not.
Anything involving other people's credentials is the exact activity the product exists to stop, and is out of scope here.
7. Why It Is Not Worth Fighting
A candid assessment. Shape combines rotating obfuscation, server-side scoring you cannot observe, behavioural signals that require genuine interaction, and consequences that surface after the fact rather than immediately.
For collection purposes it is a boundary, not an obstacle: find the public path, use the official API, or accept the data is out of reach. Effort spent elsewhere returns far more.
8. Summary
Shape Security, now part of F5, protects login, payment, and account flows against credential stuffing and account takeover using a large obfuscated client script that collects fingerprint and behavioural telemetry and posts it encoded.
It typically scores rather than blocks, so no visible rejection does not mean success; its rotating obfuscation makes replication impractical; and because it guards actions rather than content, the productive move is checking whether the data is reachable on a public path or through an official API.