Ngăn chặn các cuộc tấn công mua lại tài khoản (Miễn phí, Pro và Doanh nghiệp) Stop account takeover attacks (Free, Pro, and Business) កាត់បន្ថយការជួញដូរគណនី (ដោយឥតគិតថ្លៃ, Pro និង Business)

<form id="login-form">

  <input type="text" id="username" placeholder="Username" required />

  <input type="password" id="password" placeholder="Password" autocomplete="off" required />

  <div class="cf-turnstile" data-sitekey="<YOUR-SITE-KEY>"></div>

  <button type="submit">Log in</button>

</form>


<script

  src="https://challenges.cloudflare.com/turnstile/v0/api.js"

  async

  defer

></script>

const SECRET_KEY = "<YOUR-SECRET-KEY>";


async function validateTurnstile(token, remoteip) {

  try {

    const response = await fetch(

      "https://challenges.cloudflare.com/turnstile/v0/siteverify",

      {

        method: "POST",

        headers: {

          "Content-Type": "application/json",

        },

        body: JSON.stringify({

          secret: SECRET_KEY,

          response: token,

          remoteip: remoteip,

        }),

      },

    );


    const result = await response.json();

    return result;

  } catch (error) {

    console.error("Turnstile validation error:", error);

    return { success: false, "error-codes": ["internal-error"] };

  }

}

http.request.uri.path eq "/login" and http.request.method eq "POST" and http.response.code in {401 403}

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/leaked-credential-checks" \

  --request POST \

  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \

  --json '{

    "enabled": true

  }'

resource "cloudflare_leaked_credential_check" "zone_lcc_example" {

  zone_id = var.cloudflare_zone_id

  enabled = true

}

(cf.client.bot) or (ip.src eq 198.51.100.1)

(http.request.uri.path eq "/login" and http.request.method eq "POST" and len(http.user_agent) eq 0)

http.request.uri.path eq "/login" and http.request.method eq "POST" and cf.waf.credential_check.password_leaked