Security & bot protection

Public forms attract bots: fake bookings that make your mail server send confirmations to strangers, junk orders in the kitchen, review spam. Next Restaurant defends against that in two layers.

Always-on rate limits cap how fast any one visitor can submit. They need no setup.
Cloudflare Turnstile adds a bot check to the forms you choose. It is optional and off until you configure it.

Both live under Settings → Security, together with the setting that makes them work behind Cloudflare: trusted proxies.

Always-on rate limits

Every guest-facing write is budgeted per visitor, over a rolling 15 minutes:

What	Limit
Table bookings	10 per IP address
Online orders (checkout)	20 per IP address
Reviews	5 per IP address
Gift card balance lookups	10 per IP address
Table QR orders	20 per table session

The budgets are generous for a real guest — a family on one connection, someone fixing a typo — and hopeless for a flood. A visitor who runs out sees "Too many attempts from your connection. Please wait a few minutes and try again."

QR ordering is limited per table session rather than per IP on purpose: every table in the room shares the venue wifi's public address, so an IP limit would throttle the whole dining room at once.

Staff credentials have their own, stricter throttles — PIN lockout, terminal activation and admin re-login. See Terminals.

Cloudflare Turnstile

Turnstile is Cloudflare's CAPTCHA replacement. Most visitors never see it: it decides in the background, and only asks for a click when a request looks automated. It is free, and your site does not have to be proxied through Cloudflare to use it.

Getting keys

In the Cloudflare dashboard, open Turnstile → Add widget.
Add your site's hostname and choose the Managed widget mode.
Copy the site key and the secret key.

Switching it on

Settings → Security:

Turn on Use Cloudflare Turnstile.
Paste the Site key and the Secret key.
Tick the forms to protect, then Save.

Nothing is enforced until the switch is on and both keys are set, so a half-filled form can never lock guests out — the tab warns you while a key is missing.

The secret key is write-only. After saving, the field is empty and a Configured badge shows it is stored; leave it blank on later saves to keep it. It is never sent to a browser.

What you can protect

Each form is switched on separately, so you can shield bookings without putting a check in front of table ordering.

Group	Form
Public website	Table booking
	Online ordering checkout
	Reviews
	Gift card balance lookup
Table QR ordering	Ordering, paying and cancelling from the table
Staff	Signing back in after a session expires
	Terminal PIN sign-in and clock in/out
	Activating a new terminal

How it behaves

Invisible by default. The check runs when a protected form is submitted. If Cloudflare wants a click, a small card appears at the bottom of the screen.
Nothing loads until it's needed. Cloudflare's script is fetched on the first protected submit, never on page load, so pages you don't protect are untouched.
One pass, one form. A pass is single-use and tied to the form it was solved on; it cannot be replayed against another form.
Cloudflare outages don't take you down. If Cloudflare cannot be reached, the request goes through and the event is written to administrator/logs/com_nextrestaurant.security.php. A definite no from Cloudflare is always a refusal.

A visitor who fails the check sees "Please complete the verification and try again."

Content-Security-Policy

If your site sends a Content-Security-Policy header (for example from Joomla's HTTP Headers plugin), allow https://challenges.cloudflare.com in both script-src and frame-src. Otherwise the check cannot load and protected forms cannot be submitted. The Security tab reminds you once a form is protected.

Testing before you go live

Cloudflare publishes test keys that always pass, useful on a staging copy:

Key	Value
Site key	`1x00000000000000000000AA`
Secret key	`1x0000000000000000000000000000000AA`

Replace them with your real keys before going live — a site running on test keys accepts everything.

Trusted proxies

Every limit on this page, and every staff throttle, counts per visitor IP address. Behind Cloudflare, the address your server sees is a Cloudflare edge, not the visitor — without care, all your visitors would share one budget.

Next Restaurant handles Cloudflare automatically. It reads the visitor's real address from the CF-Connecting-IP header, but only when the connection itself comes from one of Cloudflare's published address ranges. Anyone else sending that header is ignored, so it cannot be used to dodge a limit.

Add addresses under Trusted proxies only when something else sits in front of the site and passes CF-Connecting-IP along:

a Cloudflare Tunnel (cloudflared) on the same server — add 127.0.0.1, ::1
a reverse proxy you run yourself — add its address

Entries are IP addresses or CIDR ranges (10.0.0.0/8), separated by commas or spaces. A malformed entry is refused on save rather than silently ignored.

List only proxies you control. A trusted address can claim to be any visitor.