| Rate Limiting |
Limit the number of searches per IP address to prevent abuse and bot attacks
>
">
" class="form-control" min="1" max="100">
Maximum searches allowed per time window (1-100)
" class="form-control" min="1" max="1440">
Reset attempts after this duration (1-1440 minutes)
" class="form-control" min="1" max="10080">
How long to block after exceeding limit (1-10080 minutes)
" class="form-control">
Message shown when blocked
>
" class="mt-3">
IPs that bypass rate limiting (supports CIDR notation like 192.168.1.0/24)
|
|---|---|
| Google reCAPTCHA v3 |
How to get keys:
1. Go to reCAPTCHA Admin Console 2. Create a new site with Score based (v3) type 3. Add your domain (e.g., dwindi.com) 4. Copy the Site Key and Secret Key shown after creation Note: If using Google Cloud Console, click "Use Legacy Key" under Integration tab to get the secret key
>
">
" class="form-control" placeholder="6Lc...">
Public key for frontend - shown after creating reCAPTCHA site
" class="form-control" placeholder="Secret key from Google admin console">
Server-side secret from Google reCAPTCHA admin console (required for verification)
" class="form-control" min="0" max="1" step="0.1" >
0.0 (likely bot) to 1.0 (likely human). Recommended: 0.5
" class="form-control" >
Action name for reCAPTCHA tracking (letters only)
>
Hides the "protected by reCAPTCHA" badge. You must add attribution elsewhere on the page.
" class="form-control" placeholder="">
|
| Cloudflare Turnstile |
How to get keys:
1. Go to Cloudflare Turnstile Dashboard 2. Click "Add Widget" and enter your site name 3. Add your domain (e.g., dwindi.com) 4. Choose Widget Mode: Managed (recommended) or Non-interactive 5. Copy the Site Key and Secret Key shown after creation
>
">
" class="form-control" placeholder="0x4AAA...">
Public key for frontend (starts with 0x4AAA...)
" class="form-control" placeholder="0x4AAA...">
Private key for backend verification (starts with 0x4AAA...)
" class="form-control" placeholder="">
|
| Honeypot Protection |
>
">
" class="form-control" placeholder="">
|
| IP Detection Method |
Configure how to detect visitor IP addresses
>
Automatically detect IP through Cloudflare, proxies, and standard headers
>
Only use REMOTE_ADDR (less accurate but more predictable)
|
| Nonce Verification |
WordPress security token to prevent CSRF attacks |
| Security Status |
Security Check: Please configure at least one protection method (Rate Limiting, reCAPTCHA, or Turnstile).
|
|
Security Recommendations:
|
|