Human Detector¶
Human-Detector (HD) is a Nitrogen's security module that is able to identify if the request has been made by a human or any script. It can also determine if it has been made by malicious intent based on the request-journey. Follow these steps to configure HD on desired URLs. Typical use-cases are:
- wishlist pages
- cart pages
- checkout pages
Note: For demo purpose, we will be using www.nviztest.com
domain as an example. Here, we will be configuring HD on cart page.
Prerequisite¶
- You must have a domain configured on Nitrogen.
- For this example to work, you should have created URL pattern based condition for cart page
^/cart(\?.*)*$
. If not set, you can refer this article for the same.
Steps¶
-
Click on
Security
menu, then selectHuman Detector
tab. Select appropriate domain from the domains dropdown. -
Click on
Learn how to integrate HD in your website.
link at top. You will be shown a popup with instruction to add HD script in your pages. Please add the script in all your pages. -
Click on
Add New
button at top right corner. You will be taken to a screen to provide a URL pattern on which HD will be configured. Provide the required details:-
URL Pattern Group
: Select the pattern on which you wish to set 2FA. Here, for the example, select the URL pattern you had created for WordPress admin panel URLs. -
Mode
: Select the pattern on which you wish to set 2FA.-
REDIRECT
: Requests that fail HD check will be redirected to the home page^/$
-
BLOCK
: Requests that fail HD check will be blocked with HTTP 403 status code. Select this for now. -
LOG ONLY
: Requests that fail HD check are logged in system.
-
-
Click on
Save
button. The configured pattern will be showed inProtected Routes
list.
-
Notes¶
-
These changes will only take effect when deployed. Saving them will only be saving them in draft. Please refer documentation about Deploy process for it..
-
Once requests start flowing through HD, you can see the summary of related blocks in
Human Detector
chart inAnalytics
tab. -
After HD is configured, it will block the requests in following cases :
- If you directly open the configured page - as HD token may not be available for it at that time.
- If you change the device mode in browser (desktop/mobile/tablet etc) - as HD token is generated specific to device (along with many other factors) to make it non-shareable and tamper-proof.
- If somehow your IP changed during the session - as HD token is generated specific to IP (along with many other factors) to make it non-shareable and tamper-proof.