Fundations uses multiple layers to prevent automated and abusive donation submissions: nonce verification, a honeypot field, IP-based rate limiting, reCAPTCHA v3, and CleanTalk integration. This is a free feature.
Why use this
Donation forms attract automated bots. A single bot campaign can flood the donations table with fake records and distort fundraising totals. Multiple protection layers reduce this risk without adding friction for real donors.
What it does
Layer 1: Nonce verification
Every donation submission must include a valid WordPress nonce (get_fund_donation_nonce). If the nonce is missing or invalid, the request is rejected with a JSON error. The nonce is generated per-session in the block output.
Layer 2: Honeypot field
The donation form includes a hidden field named get_fund_hp. Bots that fill in all fields will set this value. If the field is non-empty on submission, the plugin silently returns a success response (the bot believes it succeeded) without processing the donation.
Layer 3: Rate limiting
Submissions are tracked per IP address using a WordPress transient (gf_submit_{md5_of_ip)}). The limit defaults to 5 submissions per 15-minute window. When exceeded, the submission is rejected with an error message.
The limit is configurable via the get_fund_submission_rate_limit filter.
Layer 4: reCAPTCHA v3
reCAPTCHA v3 can be configured from Fundations > Settings > Security. When enabled, the donation form includes the reCAPTCHA script and submits a token. The token is verified server-side before processing.
Layer 5: CleanTalk
CleanTalk integration can be enabled from settings. A test AJAX handler (get_fund_test_cleantalk_connection) is available to verify the API key.
Wizard protection
The wizard AJAX endpoints also verify a nonce (get_fund_wizard_nonce) on all five AJAX actions. Guest and registered submissions both require a valid nonce.
How to use it
Rate limiting (automatic)
Rate limiting is active by default. No configuration is needed.
reCAPTCHA v3
- Register a reCAPTCHA v3 site at google.com/recaptcha.
- Go to Fundations > Settings > Security.
- Enter your Site Key and Secret Key.
- Save settings. The donation form will now include reCAPTCHA verification.
CleanTalk
- Sign up for a CleanTalk account and obtain an API key.
- Go to Fundations > Settings > Security.
- Enter your Access Key.
- Click Test Connection to verify.
- Save settings.
Settings and options
| Filter | Default | Description |
|---|---|---|
get_fund_submission_rate_limit | 5 | Submissions per IP per 15-minute window |
What you can and cannot do
You can raise or lower the rate limit per environment using the filter. All five protection layers can be active at the same time, and reCAPTCHA and CleanTalk can be used independently of each other.
You cannot whitelist specific IP addresses from rate limiting without custom code. Nonce verification cannot be disabled; it is hardcoded in the AJAX handler.
Troubleshooting
Legitimate donors are being rate limited. If multiple donors share an IP (e.g., corporate proxy or event venue WiFi), the rate limit may be reached. Increase the limit with the get_fund_submission_rate_limit filter, or implement IP-based exemptions using the same filter.
Donations from bots still getting through. Honeypot fields are invisible to humans, but a sophisticated bot may skip hidden fields entirely. Enable reCAPTCHA v3 as an additional layer.
reCAPTCHA fails for real users. Ensure the domain registered in the reCAPTCHA admin console matches the domain where the form is served. Wildcard domains and subdomains are treated as separate entries.
CleanTalk blocks legitimate donors. CleanTalk uses shared reputation data. A legitimate user with a previously flagged email or IP may be blocked. Review CleanTalk’s moderation queue and whitelist affected addresses.
Developer reference
Filters
| Hook | Arguments | Description |
|---|---|---|
get_fund_submission_rate_limit | int $limit | Maximum submissions per IP per 15-minute window. Default: 5. |