BotShield

2.3k visualizações Markdown

BotShield watches each form as a whole. While a form stays under its threshold nobody sees a captcha. Once the form receives too many attempts in a short window, it switches into captcha mode. Every visitor of that form is then asked for a captcha for a set time. The captcha disappears again by itself when the pressure stops. Rotating IP addresses does not get an attacker around it.

Opening the Screen

In the left menu, click Settings, then Security. Click BotShield in the tab row.

Address: {admin}/settings/security?general=botShield

What Is on the Screen

The tab opens with a short explanation of how BotShield works. Below it come a master switch, a shared time window and the captcha duration. Below that, a list of protected areas is grouped by category: Account Access, Public Forms, Support and Lookups. Form areas added by active add-ons are listed too, under the name the add-on gives them. Each area shows its current state, a posture selector and the number that actually triggers a captcha.

Account Access

Public Forms

Contact Form, Newsletter Subscription, Client Comment Submission, Blog Comment.

Support

Ticket Creation, Ticket Reply.

Lookups

Domain Name Check, License Verification.

Fields

BotShield Protection

On by default. On: when a form reaches its threshold, every visitor of that form is asked to solve a captcha for the captcha duration. Off: thresholds are ignored, and forms rely on Captcha Security and Process Restriction alone.

Time window

Required. Default: 10. Paired with the unit selector next to it; together they set the window in which a form's attempts, from all visitors combined, are counted.

Time window unit

Required. Default: Minute(s). The unit, such as minutes or hours, for the number next to it.

Captcha duration

Required. Default: 15. Paired with the unit selector next to it; together they set how long a form keeps asking every visitor for a captcha after it reaches its threshold. If attempts keep coming the period starts again; otherwise the captcha lifts by itself. The duration cannot exceed 2 hours: the unit selector offers minutes and hours only, and a longer value is rejected when you save. Not available in 5.0-beta.3 and earlier.

Captcha duration unit

Required. Default: Minute(s). The unit, such as minutes or hours, for the captcha duration next to it.

Threshold

Required for each area. Sets how many attempts, counted across all visitors of that form, switch it into captcha mode. Pick a ready-made posture, Strict (2), Balanced (5) or Relaxed (10), or choose Custom and type any number. 0 leaves that form unguarded.

Tasks

Setting a Custom Threshold for a Form

Open BotShield and make sure the master switch is on.
Find the form's row, for example Sign In, and click Custom in its posture selector.
Type the number of attempts that should trigger a captcha.
Click Save Changes.

Once the form's attempts from any visitors reach that number, it switches into captcha mode. Every visitor is then asked for a captcha until the captcha duration runs out.

Things to Watch

A threshold of 0 leaves a form unguarded

The counter is shared by all visitors of a form, so passing the verification does not reset it. The captcha stays for the whole captcha duration and lifts by itself afterwards. Setting a form's threshold to 0 removes BotShield's protection from it entirely. The Sign In threshold counts the password step and the two-factor code step together. While Sign In is in captcha mode, the code screen shows its own captcha box as well. In 5.0-beta.3 and earlier the counter is kept per visitor IP address, and passing the verification resets it.

Captcha Security can override a row

When a form is set to Always in Captcha Security, that row shows Captcha Always On and its controls become read-only. Every visitor already sees a captcha there, so BotShield's own threshold cannot fire.

Required Privileges

Viewing and saving this tab needs the SECURITY_SETTINGS privilege.

Foi útil?

Obrigado pela sua opinião!

Ainda precisa de ajuda?

A nossa equipa de apoio está disponível a qualquer hora para ajudar com o que não encontrar acima.

Contactar-nos Abrir pedido de suporte