Lyxvo Security docs

1. Open the dashboard and sign in

Go to security.lyxvo.ai/dashboard/. Sign in with your Lyxvo account (the same as lyxvo.ai). No account? Click "No account yet? Create one", fill in your name, email and a password (at least 8 characters), then click Create account.

2. Add your site

1. ① Site name: anything, it's just for you. Example: My Shop.
2. ② Domains: your website address without https:// and without slashes. Example: myshop.com. Subdomains (shop.myshop.com) are included. More than one? Separate them with commas.
3. ③ Click Add site.

3. Copy your keys

1. ① Site key: click Copy. Used for the captcha (step 5).
2. ② Secret key: click Show, then Copy. Used to connect your site (step 4).
3. ③ New secret: only if the secret key leaked. The old one stops working at once, so put the new one on your site.

Keep the secret key somewhere safe (a private note). You can see it again any time in the dashboard.

A. WordPress

For a WordPress site on any hosting (cPanel, hPanel, Plesk…).

1. Log in to your hosting panel and open the File Manager.
2. Open public_html (or your site's folder), then wp-content.
3. Inside wp-content, create a new folder called mu-plugins (if it isn't there yet).
4. Inside mu-plugins, create a new file called lyxvo-security.php.
5. Open that file (Edit) and paste all of the code below.
6. Replace lxs_sk_PASTE_YOUR_SECRET_KEY_HERE with your secret key from step 3 (keep the quotes). Save.
7. Back in the Lyxvo dashboard → Mode & rules → untick "Trap probes for secret files…" → Save. (WordPress really has /wp-admin, so that trap must be off.)

<?php
/* Plugin Name: Lyxvo Security */
define('LYXVO_SECRET', 'lxs_sk_PASTE_YOUR_SECRET_KEY_HERE');

function lyxvo_security_check() {
    $ch = curl_init('https://security.lyxvo.ai/api/security/check');
    curl_setopt_array($ch, [
        CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT_MS => 1500,
        CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'Authorization: Bearer ' . LYXVO_SECRET],
        CURLOPT_POSTFIELDS => json_encode([
            'ip' => $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $_SERVER['REMOTE_ADDR'] ?? '',
            'method' => $_SERVER['REQUEST_METHOD'] ?? 'GET',
            'url' => $_SERVER['REQUEST_URI'] ?? '/',
            'headers' => function_exists('getallheaders') ? getallheaders() : [],
        ]),
    ]);
    $v = json_decode((string) curl_exec($ch), true);
    curl_close($ch);
    if (($v['action'] ?? '') === 'block') {
        http_response_code((int) ($v['status'] ?? 403));
        exit('Blocked by Lyxvo Security');
    }
}
lyxvo_security_check();

The mu-plugins folder makes the code run on its own, with nothing to activate in the Plugins menu. To remove it, delete lyxvo-security.php.

B. Cloudflare (any website)

For any site whose domain already uses Cloudflare (not Shopify or Wix).

1. Go to dash.cloudflare.com → Workers & Pages → Create → Create Worker (Hello World) → name it lyxvo-security → Deploy.
2. Click Edit code, delete everything, paste the code below, then click Deploy.
3. Back on that Worker → Settings → Variables and Secrets → Add → type Secret, name LYXVO_SECRET, value your secret key → Deploy.
4. Settings → Domains & Routes → Add → Route → enter myshop.com/* (your domain), pick your domain's zone → Add route. Repeat for www.myshop.com/* if your site uses www.

export default {
  async fetch(request, env) {
    const u = new URL(request.url);
    try {
      const r = await fetch("https://security.lyxvo.ai/api/security/check", {
        method: "POST",
        signal: AbortSignal.timeout(1500),
        headers: { "content-type": "application/json", authorization: "Bearer " + env.LYXVO_SECRET },
        body: JSON.stringify({
          ip: request.headers.get("cf-connecting-ip"), country: request.cf?.country,
          method: request.method, url: u.pathname + u.search, headers: Object.fromEntries(request.headers),
        }),
      });
      const v = await r.json();
      if (v.action === "block") return new Response("Blocked by Lyxvo Security", { status: v.status });
    } catch {}
    return fetch(request);
  },
};

This way Lyxvo guards your whole site, whatever it is built with (WordPress, Laravel, a static site…).

C. You have a developer

For a custom-built site (Laravel, Node.js, Next.js, Python, Go…).

1. Send your developer the link to the "For developers" part below.
2. Give them the secret key privately (not in a group chat). They put it in the server settings as LYXVO_SECRET.
3. It usually takes about 15 minutes. Then do step 6 to check.

5. Add the captcha to a form (optional)

The captcha keeps spam bots out of contact, sign-up and login forms. Paste these two lines inside your form, just before the Send button, and replace lxs_pk_… with your site key. In WordPress: use a "Custom HTML" block in the page editor. The server that receives the form must check the token (developer part: Lyxvo Captcha).

<div class="lyxvo-captcha" data-sitekey="lxs_pk_..."></div>
<script src="https://security.lyxvo.ai/captcha.js" async defer></script>

6. Check that it's connected

1. In the dashboard, Mode & rules → Mode → choose "Monitor only" → Save (so you don't block yourself while testing).
2. Open in your browser: https://myshop.com/?q=<script>alert(1)</script> (your domain). Your site opens as usual.
3. Wait up to 15 seconds on the dashboard: ① a bar appears in the attack chart and ② a row in the Attack log with the action monitor. That means it's connected.
4. Set Mode back to "Block attacks" → Save. Done, your site is protected.

If you test in Block mode, your own IP gets blocked too. Open the dashboard → Blocked IPs → click Unblock.

Mode & rules

1. ① Mode: Block attacks (normal), Monitor only (testing), or Off.
2. ② Trap probes for secret files: keep it on, unless your site is WordPress.
3. ③ Requests per minute: how often one IP may open your site per minute before a 1-hour block. 600 is safe for most sites; 0 = no limit.
4. ④ Always allow: your office IP or payment provider, one per line. These IPs are never blocked.
5. ⑤ Blocked countries: two-letter codes, like RU, KP. Leave empty if your visitors come from anywhere.
6. ⑥ Click Save. Changes apply within seconds.