Rate Limiting

#Overview

The Security tab under Settings > Site Configuration contains rate limiting controls that protect your site from automated abuse. These settings limit how many times a visitor from the same IP address can perform certain actions within a 24-hour period.

Limits are counted per IP address and apply to every visitor.

#Finding Rate Limiting Settings

1. In the admin sidebar, go to Settings > Site Configuration.
2. Click the Security tab.
3. The Rate Limiting section groups these settings together.

#Available Settings

#Form Submissions

Limits how many times a visitor can submit a standard public form per 24 hours. This includes contact forms, event signups, and any other public forms — except testimonial submissions, which are counted separately (see below).

• Default: 3
• Set to 0 to disable (unlimited submissions allowed).

#Testimonial Submissions

Limits how many testimonials a visitor can submit per 24 hours. Testimonials use their own counter, separate from the Form Submissions limit, so you can allow more (or fewer) testimonials than other forms without changing the general form limit.

• Default: 3
• Set to 0 to disable (unlimited testimonial submissions allowed).
• This setting only appears when the Testimonials plugin is installed and activated.

#Payment Attempt Failures

Limits how many failed payment attempts are allowed before the visitor's IP is temporarily locked out. This protects against card-testing attacks where someone tries stolen card numbers on your payment forms.

• Default: 3
• Minimum: 1 (cannot be disabled)
• Maximum: 6

This setting counts failures returned by the payment gateway (e.g., a declined card or a rejected bank account). Errors caught before the payment reaches the gateway — such as missing required form fields — do not count.

Note: This protection applies to server-processed gateways (Authorize.Net, CardPointe, and Paya/ACH). Stripe card declines are handled in the visitor's browser and never reach this lockout — Stripe's own Radar fraud protection covers card-testing on Stripe.

#How the Payment Failure Lockout Works

When a visitor reaches the failure limit, their IP is temporarily locked out. The lockout duration increases with each repeated lockout:

A successful payment resets the failure counter — the visitor is not penalized for past failures.

Tip: If a legitimate customer is locked out, an admin can clear the lockout via the server. Contact your developer for assistance.