Verify a Cloudflare Turnstile token server-side
The widget on the page proves nothing on its own. This is the server check, written to fail closed on every error path.
Anti-Bot and Fraud
Captchas, rate limits, proxy detection, multi-account clustering and proof-of-render.
10 entries
Get the real client IP without trusting a spoofable header
Every per-IP limit you have is only as good as this function. Reading X-Forwarded-For unconditionally hands attackers a free reset on all of them.
A sliding-window rate limiter in MySQL
No Redis, no extension, no cron. One table and one function that caps any action per key within any window, and fails open so an outage never locks the site.
Only count an impression a real browser actually rendered
Crediting on the ad request pays anything that can run curl. A signed nonce plus a beacon that only fires in a visible browser closes it.
Cap what one visitor can earn you in a day
Pay each creative at most once per visitor per day. The ceiling becomes the number of creatives in rotation, which is a number you control.
A cookieless visitor key you can count on
One rotating hash that identifies a visitor for limits and counting, without a cookie to clear and without storing anything that identifies a person.
Detect bots without breaking the page for them
Withhold earnings from obvious automation, never content. Blocking search crawlers is a self-inflicted wound that takes months to notice.
Detect an ad blocker without picking a fight
A bait element and one class toggle. Ask, do not block — a wall costs you the visitor and the search ranking.
Enforce a minimum dwell that a script cannot skip
The countdown belongs to the client, so the client will lie. Bind the timing to a signed server token and check it when the claim arrives.
An admin view that shows you who is farming you
Four queries — earnings concentration, shared visitor keys, signup velocity, payout-to-activity ratio — that surface abuse without a fraud engine.