Verify a Cloudflare Turnstile token server-side
The widget on the page proves nothing on its own. This is the server check, written to fail closed on every error path.
Anti-Bot and Fraud
Captchas, rate limits, proxy detection, multi-account clustering and proof-of-render.
15 entries
Get the real client IP without trusting a spoofable header
Every per-IP limit you have is only as good as this function. Reading X-Forwarded-For unconditionally hands attackers a free reset on all of them.
A sliding-window rate limiter in MySQL
No Redis, no extension, no cron. One table and one function that caps any action per key within any window, and fails open so an outage never locks the site.
Only count an impression a real browser actually rendered
Crediting on the ad request pays anything that can run curl. A signed nonce plus a beacon that only fires in a visible browser closes it.
Cap what one visitor can earn you in a day
Pay each creative at most once per visitor per day. The ceiling becomes the number of creatives in rotation, which is a number you control.
A cookieless visitor key you can count on
One rotating hash that identifies a visitor for limits and counting, without a cookie to clear and without storing anything that identifies a person.
Detect bots without breaking the page for them
Withhold earnings from obvious automation, never content. Blocking search crawlers is a self-inflicted wound that takes months to notice.
Detect an ad blocker without picking a fight
A bait element and one class toggle. Ask, do not block — a wall costs you the visitor and the search ranking.
Enforce a minimum dwell that a script cannot skip
The countdown belongs to the client, so the client will lie. Bind the timing to a signed server token and check it when the claim arrives.
An admin view that shows you who is farming you
Four queries — earnings concentration, shared visitor keys, signup velocity, payout-to-activity ratio — that surface abuse without a fraud engine.
Every warning needs a matching data stream
A risk flag that says 'device shared with 5 accounts' and offers nowhere to look is worse than no flag. And if the scorer and the panel key on different fingerprints, they will contradict each other.
Flags that reopen forever
A scan that reruns hourly will reopen the flag you just closed, because the lifetime total it measures is still over the line. Record the magnitude at close and only reopen on something materially worse.
Spot a referral ring by the browser it was made from
A referral you can reach from the referrer's own browser is self-referral. One query separates a farm from a community.
Gate withdrawals on verified ad revenue
Let users earn freely and withdraw only what their verified ad activity actually paid for. Entitlement is spent at request time so pending requests cannot double-spend it.
Presence tracking that stores nothing worth stealing
A live view of who is on the site needs a hashed session id, a page name and two timestamps. No address, no user agent, no history.