Because the verification form is public, the plugin includes built-in protection so no one can hammer it with automated guesses at valid authentication codes.
Rate limiting, in plain terms
The form limits how many attempts a single visitor can make in a short window:
- Verification: up to 30 attempts per 60 seconds from one visitor.
- PDF download (Pro): up to 10 attempts per 60 seconds from one visitor.
A genuine person checking a certificate will never hit these limits — they only stop automated tools trying thousands of codes.
Nothing to configure
Rate limiting is on by default and needs no setup. Visitors aren’t asked to log in, create an account, or solve anything — they simply enter a code and get a result.
For developers
The default limits can be changed with the edcv_rate_limit_max_attempts and edcv_rate_limit_window filters. On trusted hosting, the edcv_rate_limit_visitor_identity filter can supply a server-validated client IP. These are optional and only relevant if you’re customising the plugin.
