Skip to main content

benecaster_follower_signup_throttled

Action Free

Fires when a public [benecaster_follower_signup] submission is silently dropped for exceeding an abuse limit — 3 per email address per show per hour, or 10 per IP per hour, by default.

The submitter is told nothing, and that is the entire design. A throttled submission renders the same success screen as an accepted one, having provisioned nothing and sent nothing. This must not be “improved” into a visible too many requests message. The per-address limit would make such a message an activity oracle: submit victim@example.com, get told you are rate limited, and you have learned that somebody recently submitted that address to this site. That is a strictly worse leak than the address enumeration the identical-response rule exists to close — and it would arrive dressed as a usability fix.

This action is how a site logs or alerts on the refusal instead of displaying it.

Parameters

Name Type Default Description
$show_id int — The show whose follow form was submitted.
$reason string — `address` or `ip` — which limit tripped. `address` wins when both did.

Examples

Log refusals rather than showing them

add_action( 'benecaster_follower_signup_throttled', function ( int $show_id, string $reason ): void {
    error_log( "benecaster: follower signup throttled on show {$show_id} ({$reason})" );
}, 10, 2 );

Notes

Do not echo anything from a callback on this hook. It fires during the form POST, and output here would reintroduce the visible difference the silent drop exists to remove.

A legitimate person who double-submits is unharmed and may well trip this: they already received their email from the first submission, and the screen they see is the one they expected. Treat a single refusal as noise and a pattern as signal.

The limits are applied by the shortcode, so this never fires for programmatic callers — benecaster_follower_signup() and bulk enrolment are not throttled. It also never fires on the signed-in path, which sends no mail and mints no second token.

Related Recipes

Need this built rather than just documented? See our services →