# BotShield

https://docs.wisecp.com/de/botshield

BotShield asks for a captcha only from a visitor who retries the same form too many times in a short window. Everyone else submits without any extra step.

## Opening the Screen

In the left menu, click **Settings**, then **Security**. Click **BotShield** in the tab row.

Address: `{admin}/settings/security?general=botShield`

## What Is on the Screen

The tab opens with a short explanation of how BotShield works, followed by a master switch and a shared time window. Below that, a list of protected areas is grouped by category: Account Access, Public Forms, Support and Lookups. Each area shows its current state, a posture selector and the number that actually triggers a captcha.

- **Account Access**: Sign In, Sign Up, Password Reset, JetPass Sign In.
- **Public Forms**: Contact Form, Newsletter Subscription, Client Comment Submission, Blog Comment.
- **Support**: Ticket Creation, Ticket Reply.
- **Lookups**: Domain Name Check, License Verification.

## Fields

- **BotShield Protection**: On by default. On: IP addresses that pass a form's threshold are asked to solve a captcha. Off: thresholds are ignored, and forms rely on Captcha Security and Process Restriction alone.
- **Time window**: Required. Default: 10. Paired with the unit selector next to it; together they set the window used to count a form's attempts.
- **Time window unit**: Required. Default: Minute(s). The unit, such as minutes or hours, for the number next to it.
- **Threshold**: Required for each area. Sets how many attempts from one IP address trigger a captcha for that form. Pick a ready-made posture, Strict (2), Balanced (5) or Relaxed (10), or choose Custom and type any number. 0 leaves that form unguarded.

## Tasks

### Setting a Custom Threshold for a Form

1. Open **BotShield** and make sure the master switch is on.
2. Find the form's row, for example Sign In, and click **Custom** in its posture selector.
3. Type the number of attempts that should trigger a captcha.
4. Click **Save Changes**.

Once retries from one IP address pass that number, the form asks for a captcha.

## Things to Watch

> **A threshold of 0 leaves a form unguarded**
> 
> Passing the verification resets the counter for that IP address. Setting a form's threshold to 0 removes BotShield's protection from it entirely.

> **Captcha Security can override a row**
> 
> When a form is set to Always in Captcha Security, that row shows Captcha Always On and its controls become read-only. Every visitor already sees a captcha there, so BotShield's own threshold cannot fire.

## Required Privileges

Viewing and saving this tab needs the **SECURITY_SETTINGS** privilege.

## Related Articles

- [Security Settings Overview](https://docs.wisecp.com/en/security-settings-overview)
- [Authentication Security](https://docs.wisecp.com/en/authentication-security)
- [Captcha Security](https://docs.wisecp.com/en/captcha-security)
- [Process Restriction](https://docs.wisecp.com/en/process-restriction)