PHP library — GhostGuard

Installation

Download your pre-keyed PHP client from the Install guide tab in your dashboard. The file has your API key already embedded — no manual configuration required.

Upload the PHP client file to your website root, for example:

/var/www/html/gg-client.php

-- or --

/home/yoursite/public_html/gg-client.php

The file makes outbound HTTPS calls to ghostguard.privacyhash.com. Ensure your server can make outbound cURL requests on port 443. PHP curl extension must be enabled (standard on all shared hosts).

Basic usage

Add these three lines to the very top of any PHP page you want to protect, before any output:

<?php

require_once __DIR__ . '/gg-client.php';

$gg = new GhostGuard('GG-YOUR-API-KEY');

$gg->protect();

That's it. The protect() method checks the visitor's session score and silently exits with HTTP 403 if they are classified as a bot. Real users never notice anything.

Email protection — MailSensor

To score inbound email or contact form submissions, use the MailSensor integration. This requires a Pro or Enterprise plan.

// Record the connection and get a verdict

require_once '/gg-client.php';

$sensor = new GhostGuard\MailSensor($accountId);

$connId = $sensor->record($connectionData, $messageContent);

// Check the verdict before processing

if ($sensor->isBlocked($connId)) {

  // Discard silently

  return;

}

Fail-open behaviour

If GhostGuard is unreachable (network issue, timeout), protect() allows the request through automatically. The client has a 2-second timeout. Your site never goes offline because of GhostGuard.

🛡 Fail-open is not configurable. It is a deliberate safety guarantee. If GhostGuard is unavailable, your site stays online.

Examples

Protect a login page:

<?php

require_once '/gg-client.php';

(new GhostGuard('GG-YOUR-KEY'))->protect();

// Rest of your login.php continues normally for humans

session_start();

// ...

Protect a contact form POST:

<?php

require_once '/gg-client.php';

$gg = new GhostGuard('GG-YOUR-KEY');

$gg->protect();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

  // Process the form — bots never reach here

  mail($_POST['email'], ...);

}