Pretty much, yeah. Unless each site owner creates a custom mapping.

The font must be sent to the browser so it can display the original words. Anyone who downloads it can therefore inspect it and work out the substitutions. That is unavoidable. But our goal is not to stop someone who deliberately targets a specific site. Instead, it is designed to disrupt large-scale automated scraping, which processes many sites without examining each one individually (because that costs money). ShieldFont currently ships with three different word mappings and gives publishers the tools to create their own, so decoding one mapping does not automatically reveal the others.