Menu

Documentation

Getting started

Everything you need to go from install to protected forms. Allow about 15 minutes, plus time to test checkout on staging.

1. Install and license

  1. Download the latest ZIP from your account.
  2. In WordPress, open Plugins → Add New → Upload Plugin, choose the ZIP and activate it on the individual site. Network activation isn’t supported.
  3. Open Settings → Gate House → License, paste your license key and choose Activate. This turns on automatic updates; protection works with or without a license.

2. Connect your provider

On the Provider tab, choose Cloudflare Turnstile, Google reCAPTCHA (v2 checkbox or v3) or hCaptcha. Register your site’s exact hostname with the provider and copy the matching site key (public) and secret key (server only). For reCAPTCHA, use a key that works with SiteVerify, not a Google Cloud API key.

Save, then run the connection test. It completes a real challenge in your browser and verifies it from your server. It doesn’t place orders, send email or change stock.

3. Review coverage, then choose rules

Coverage lists every supported form on your site and what’s been verified. On Rules, each action has two independent settings: provider verification (Disabled, Observe or Enforce) and local rate limits (Observe or Enforce). Everything starts in Observe mode, and saving your keys never turns on blocking.

4. Test on staging, then enforce

On a staging copy of your site, complete each form you plan to protect, including a real checkout with your payment gateway in sandbox mode. Submit once with a passing challenge and once with a failing one. When both behave as expected, switch those actions to Enforce.

5. Watch activity

Activity shows each decision without storing passwords, tokens or addresses. Mark false positives there, and use Diagnostics if your provider starts failing.

If you’re locked out

Add this line to wp-config.php to put every action back into Observe mode, then remove it after fixing your provider settings:

define('USP_RECOVERY_MODE', true);

If you have server access, you can also use wp usp status and wp usp recover. There is deliberately no public bypass URL.

Keys in configuration

To keep credentials out of the database, use constants or environment variables: USP_SITE_KEY, USP_SECRET_KEY and USP_LICENSE_KEY.

Upgrading from Unified Site Protection

Upload the new ZIP and choose Replace current with uploaded. Don’t uninstall the old version first; uninstalling can delete plugin data if that option is enabled. The internal folder stays unified-site-protection so your settings carry over.