FortiFi
Paywall hardening
that survives DevTools.
- 01 JWT
- Server validates
- 02 Teaser
- HTML only
- 03 MIT
- Self-host core
Server decides
Full articles load only after JWT validation. The browser never receives paid HTML early.
Teaser by default
Unpaid requests get preview HTML and metadata. CSS cannot reveal what was never sent.
Self-host the core
MIT open source. Express and Fastify middleware plus a drop-in client snippet.
How it works
Teaser first. Full content only with a token.
Traditional paywalls hide content with CSS. FortiFi never sends the full HTML until the server validates a short-lived JWT.
Express, Fastify, or your own Node handler. Redis for rate limits when you enable them.
Problem
Client-side paywalls leak by design.
Typical approach
- Full HTML in the DOM, hidden with CSS
- User toggles display in DevTools
- Paywall is cosmetic, not structural
FortiFi
- Server returns teaser HTML by default
- JWT unlocks the full response body
- Bypass requires a valid token, not a selector
Built for publishers
Hardening toolkit, not a hosted lock icon.
Core packages ship as MIT. Wire middleware, issue tokens, and serve teasers from your stack.
- JWT
Short-lived tokens
Tokens gate the full response. Not a CSS class toggle.
- RL
Rate limits
Redis-backed throttling and IP blocks for scrape patterns.
- WM
Watermarking
Basic PDF and image marks in core. Per-user templates for leak tracing.
- MW
Drop-in middleware
@fortifi/core for Node. Lightweight UMD client for browser unlock.
FortiFi Core is open source.
Clone, self-host, and extend. Managed cloud and enterprise tiers are on the roadmap when you need them.
- Teaser-only HTML for premium routes
- JWT token generation and validation
- Express and Fastify middleware
- Browser client snippet
- Docker Compose for local stack