This page explains the advanced network terminology used by frontend generation. It does not apply to a site that uses only after-submission feeds.
Why Public Buttons Need Protection #
A public form may be viewed by anonymous visitors. WordPress nonces are not a durable authorization boundary for cached public pages, so the plugin does not place a reusable generation token in the shortcode HTML.
On each click, the browser requests a fresh, short-lived, single-use token from an uncached endpoint. The token is tied to the requested action, form, feed, session, and client network identity. A successful generation consumes it.
The plugin also rate-limits token issuance and generation. A server-signed HTTP-only visitor cookie distinguishes browsers. Until that cookie exists, a user-agent/language fingerprint supplies a temporary throttle input. A network-level ceiling limits repeated fresh visitor identities.
What A Reverse Proxy Or CDN Changes #
Normally the web server sees a visitor’s address as REMOTE_ADDR. Behind a CDN, load balancer, or reverse proxy, the direct connection may come from that service instead. The service commonly adds X-Forwarded-For to report the original visitor.
If the plugin treated every forwarded header as truthful, a visitor could forge a different address and evade rate limits. It therefore uses X-Forwarded-For only when REMOTE_ADDR belongs to a configured trusted proxy range.
Without correct trusted ranges, generation still does not automatically trust arbitrary headers; however, many visitors may share the proxy’s direct network identity and reach a common network limit sooner.
When To Configure Trusted Proxies #
Configure them only when all of these are true:
- The site offers public frontend generation.
- A known CDN, load balancer, or reverse proxy is directly in front of WordPress.
- The service supplies the original address in
X-Forwarded-For. - You have the service’s current official IPv4/IPv6 addresses or CIDR ranges.
Do not enter the administrator’s address, a visitor address, or an unrestricted internet range. Because provider networks can change, review the service’s published ranges and operational guidance over time.
