Skip to main content
Paid AddonPurchase Captcha | Install via your site's addon page or download from your account

Captcha

Dakatar da Bots. Kare Kuɗaɗen Shiga. Babu Wahalar Saita Komai.

Kana gudanar da hanyar sadarwar multisite da custom domains? Ka san wahalar: Google reCAPTCHA da hCaptcha suna bukatar ka yi rajistar kowane domain guda ɗaya a cikin admin console ɗinsu. Ka ƙara sabon shafin abokin ciniki? Sabunta captcha config. Ka haɗa custom domain? Sake sabuntawa. Ba ya ƙarewa.

Ultimate Multisite: Captcha yana sauya komai.

Cap Captcha: Kariyar Self-Hosted Da Ke Aiki Kai Tsaye​

Sabon Cap Captcha provider ɗinmu mai sauya wasa ne ga hanyoyin sadarwar multisite:

  • Babu Saita Komai — Kunna addon ɗin kuma kana da kariya. Babu API keys, babu Google account, babu hCaptcha dashboard, babu domain whitelisting.
  • Yana Aiki a Kowane Domain Ta Atomatik — Subdomains, mapped domains, domains na abokan ciniki—duk suna samun kariya nan take.
  • Self-Hosted & Na Sirri — Bayananka ba sa barin server ɗinka. Cikakken dacewa da GDPR ba tare da bin diddigin ɓangare na uku ba.
  • Proof-of-Work Marar Ganuwa — Masu amfani suna warware lissafin ƙalubale a bango. Babu danna fire hydrants, babu grids na hotuna masu takaici.
  • Mai Sauƙi — Kawai 20KB. Ba zai rage saurin checkout ɗinka ba.

Kariyar Gwajin Kati ta WooCommerce​

Hare-haren gwajin kati suna jawo asarar biliyoyi ga ’yan kasuwa kowace shekara. Masu zamba suna amfani da bots don tabbatar da katunan kuɗi na sata a kan WooCommerce checkout ɗinka—kai ne kake biyan kuɗin sarrafawa, su kuma suna samun lambobin kati masu aiki.

Muna kare inda ya fi muhimmanci:

  • Kariyar Store API — Yana toshe hare-haren bot a kan /wp-json/wc/store/v1/checkout da ke kewaye captchas na fom na gargajiya
  • Ya Dace da PayPal Payments — Yana aiki ba tare da matsala ba da WooCommerce PayPal Payments
  • Kididdiga na Lokaci na Gaskiya — Gani daidai adadin hare-haren da kake toshewa

Har Yanzu Kana Bukatar Google reCAPTCHA ko hCaptcha?​

Mun tanadar maka. Cikakken goyon baya ga:

  • Google reCAPTCHA v2 (Checkbox)
  • Google reCAPTCHA v2 (Invisible)
  • Google reCAPTCHA v3 (Score-based)
  • hCaptcha (Standard)
  • hCaptcha (Invisible)

Sauya tsakanin providers a kowane lokaci daga saitunan hanyar sadarwarka.

An Gina Don Girma​

  • Saitunan dukan hanyar sadarwa tare da overrides na kowane shafi
  • Dashboard na kididdiga don sa ido kan kariya
  • Matakan tsaro masu daidaitawa (Fast, Medium, Maximum)
  • Mai sauƙi ga masu haɓakawa tare da gine-ginen provider mai faɗaɗawa

Shigarwa​

  1. Loda ultimate-multisite-captcha zuwa directory ɗinka na /wp-content/plugins/
  2. Network Activate plugin ɗin
  3. Shi ke nan. Kana da kariya.

Cap Captcha yana kunnawa ta atomatik—babu saitunan da za a daidaita, babu API keys da za a shigar. Kowane endpoint da ake goyon baya a duk hanyar sadarwarka yana da kariya da zarar ka kunna.

Na zaɓi: Don amfani da Google reCAPTCHA ko hCaptcha maimakon haka, je zuwa Ultimate Multisite → Settings → Captcha kuma zaɓi provider ɗin da ka fi so.

Tambayoyin da Ake Yawan Yi​

Ina bukatar in saita wani abu?​

A'a! Ana kunna Cap Captcha ta atomatik lokacin da ka kunna addon ɗin. Dukkan hanyar sadarwarka tana samun kariya nan da nan—babu saitunan da za a daidaita, babu API keys da za a shigar.

Ina bukatar API keys don Cap Captcha?​

A'a. Cap Captcha gaba ɗaya self-hosted ne. Babu external accounts, babu rajistar domain, babu ciwon kai na configuration.

Shin wannan zai rage saurin checkout ɗina?​

Cap Captcha kawai 20KB ne kuma yana gudanar da ƙalubalen proof-of-work a bango. Abokan cinikinka ba za su lura da wani jinkiri ba.

Shin wannan yana kariya daga hare-haren gwajin kati?​

I! Ba kamar captchas na gargajiya da ke kare fom na HTML kawai ba, haɗin WooCommerce ɗinmu yana shiga kai tsaye cikin Store API don toshe hare-haren bot a matakin API—inda mafi yawan hare-haren gwajin kati ke faruwa.

Zan iya amfani da captcha providers daban-daban a shafuka daban-daban?​

Ana saita captcha provider a matakin dukan hanyar sadarwa, amma za ka iya daidaita saitunan wahala bisa bukatunka.

Shin wannan ya dace da GDPR?​

Cap Captcha 100% self-hosted ne ba tare da aika bayanai zuwa external services ba. Don Google reCAPTCHA da hCaptcha, da fatan za a duba manufofin sirrinsu daban-daban.

Iyakance Yawan Buƙatu​

Ultimate Multisite: Captcha v1.5.0 yana gabatar da rate limiter mai dakatarwa gaba ɗaya wanda ke kare hanyar sadarwarka daga hare-haren brute-force da card-testing.

Yadda Yake Aiki​

Rate limiter yana ƙirga kowane GET da POST request a kan wuraren da captcha ke karewa:

  • WordPress login endpoints — wp-login, register, lost-password, comments
  • WooCommerce checkout — my-account, checkout, pay-for-order
  • Ultimate Multisite — checkout, inline-login

Lokacin da baƙo ya wuce rate limit, plugin ɗin yana amsawa da:

  • HTTP 429 (Too Many Requests) status code
  • Retry-After header da ke nuna lokacin sake gwadawa
  • Randomised tarpit sleep (daƙiƙa 1–5 ta tsohuwa, an ƙuntata da ƙarfi zuwa daƙiƙa 15) don rage saurin maharan

Configuration​

Lokacin Tarpit​

Sarrafa jinkirin randomised da ake amfani da shi ga requests da aka rate-limited:

  • cap_rate_limit_tarpit_min — Mafi ƙarancin lokacin sleep a daƙiƙa (tsohuwa: 1)
  • cap_rate_limit_tarpit_max — Mafi tsawon lokacin sleep a daƙiƙa (tsohuwa: 5, an ƙuntata da ƙarfi zuwa 15)

Ana samun waɗannan saitunan a Ultimate Multisite → Settings → Captcha.

Faɗaɗawa​

IP Whitelist Filter​

Keɓe amintattun zangon IP daga rate limiting:

add_filter( 'wu_cap_rate_limit_whitelist_ip', function( $is_whitelisted, $ip ) {
    // Whitelist your monitoring service
    if ( $ip === '203.0.113.42' ) {
        return true;
    }
    return $is_whitelisted;
}, 10, 2 );

Pre-Block Action​

Gudanar da custom logic nan take kafin a aika da rate-limit block:

add_action( 'wu_cap_rate_limit_will_block', function( $ip, $surface ) {
    // Log the block, notify admins, or update custom metrics
    error_log( "Rate limit triggered for $ip on $surface" );
}, 10, 2 );

Gano IP na Client & Amintattun Proxies​

Ultimate Multisite: Captcha v1.5.0 yana gabatar da gano client-IP mai jure spoofing. Hanyar Captcha_Core::get_client_ip() yanzu ita ce tushen gaskiya guda ɗaya don danganta IP na baƙo a duk:

  • Maɓallan bucket na rate-limit
  • Mai samar da Captcha remoteip (reCAPTCHA, hCaptcha siteverify)
  • Hashes na IP na ƙididdiga

Samfurin Amincewa​

Plugin ɗin yana tilasta tsayayyen tsarin matakan amincewar IP:

  1. REMOTE_ADDR — Ana amincewa da shi koyaushe (IP na abokin haɗin kai tsaye)
  2. CF-Connecting-IP — Ana girmama shi ne kawai idan:
    • Abokin haɗin kai tsaye yana cikin kewayon IP na Cloudflare na yanzu
    • An kunna cap_trust_cloudflare_headers (tsoho: A KASHE)
  3. X-Forwarded-For — Ana girmama shi ne kawai idan:
    • Abokin haɗin kai tsaye yana cikin jerin trusted-proxy da admin ɗinka ya saita
    • Ana karanta header ɗin daga dama zuwa hagu, ana tsallake hops na trusted/Cloudflare

Saiti​

Amincewar Header na Cloudflare​

Kunna amincewa da header na Cloudflare CF-Connecting-IP:

  • cap_trust_cloudflare_headers — Saita zuwa ON don zaɓar shiga amincewar CF-Connecting-IP
    • Tsoho: OFF (a kashe)
    • Plugin ɗin yana zuwa da snapshot na Cloudflare CIDR a haɗe
    • Ana sabunta kewayon CIDR kowane mako ta wp-cron
    • Ana amfani da fallback ɗin da aka haɗa idan sabuntawar ta gaza

Saitin Trusted Proxy​

Ƙayyade proxies da load-balancers na gaba-gaba:

  • cap_trusted_proxies — Textarea na CIDRs ko IPs tsirara (ɗaya a kowane layi)
    • Ana yarda da sharhi (layukan da ke farawa da #)
    • Ba tare da wannan saitin ba, ana watsi da X-Forwarded-For ko da an kunna rate limiter
    • Misali: 
      # Our load balancer
      192.0.2.0/24

      # Backup proxy
      198.51.100.50

Gano Kai-tsaye Lokacin Kunna Farko​

Lokacin da ka fara kunna rate limiter, plugin ɗin yana gano yiwuwar matsayin Cloudflare da proxy ɗinka sannan ya nuna sanarwar admin ta danna-ɗaya "Aiwatar da saitunan da aka gano".

  • Plugin ɗin ba ya taɓa sake rubutawa ƙimomin da ka adana
  • Idan zirga-zirgar baya ta nuna cewa config ɗinka ba ya ƙara dacewa da gaskiya (misali, Cloudflare ya canza kewayon CIDR), sanarwar rashin daidaito da ba za a iya rufewa ba tana fito da sabuntawar da aka ba da shawara

Me Ya Sa Wannan Ke Da Muhimmanci​

Tsayayyen samfurin amincewar IP yana rufe muhimmin hanyar yaudara: buƙatun uwar-garken asali kai tsaye da ke ɗauke da ƙirƙirarren header CF-Connecting-IP a baya da an saka su cikin bucket ta IP ɗin da aka ƙirƙira maimakon ainihin abokin haɗin. Wannan yana da muhimmanci musamman ga:

  • Rate limiting — Mahara ba za su iya kauce wa iyakoki ta hanyar ƙirƙirar IPs ba
  • Ƙididdiga — Ma'aunin harinka yana nuna ainihin IPs na baƙi, ba na ƙirƙira ba
  • Tabbatar da Captcha — Masu samarwa suna karɓar madaidaicin IP na baƙo don kimanta haɗari