v1.3.0

• IP Rate Limiting — Configurable rate limiter to block brute-force attacks. Set max attempts and time window per IP. Disabled by default.

• IP Whitelist/Blacklist — Whitelist bypasses captcha entirely (no widget rendered, no verification). Blacklist blocks IPs completely with no captcha option. Supports CIDR notation.

• Failure Log Viewer — Browse failed verification attempts in the admin panel. Filter by page type or IP address. Paginated with 20 records per page.

• CSV Export — Export filtered log data as CSV file for external analysis. Respects active filters.

• Domain Checker Protection — Added captcha for domain search pages (domainchecker, domainregister, cart.php?a=domaincheck).
  a

• REST API — External tools can query verification status via API key authentication.

  • type=status — System health, 24h stats, top IPs
  • type=logs — Filterable log entries with pagination
  • type=ip_check — IP analysis (failures, rate limit, whitelist/blacklist status)

• Enhanced Smarty Function — {display_turnstile} now supports:

  • Auto-detection of page from template context
  • Parameters: page, theme, size, mode, assign
  • Error message display on failed verification
  • Token auto-fill via callback
  • Variable assignment for custom placement

• Nonce Validation — CSRF protection on the API test endpoint. Single-use tokens prevent replay attacks.

Bug Fixes

• API Test Validation — Secret key test now actually validates the key format with Cloudflare instead of always succeeding with empty tokens.

• Login Redirect URLs — Fixed redirect paths for WHMCS 8+ (index.php?rp=/login instead of login.php).

API Endpoints

GET ?module=cloudgate&action=api&key=KEY&type=status
GET ?module=cloudgate&action=api&key=KEY&type=logs&page=login&limit=10
GET ?module=cloudgate&action=api&key=KEY&type=ip_check&ip=1.2.3.4