Bot Protection Overview

QuikForms provides two complementary layers of bot protection:

Getting Turnstile Keys

Before configuring QuikForms, you'll need to obtain API keys from Cloudflare.

Step 1: Create a Turnstile Widget

1. Go to the Cloudflare Turnstile Dashboard
2. Sign in with your Cloudflare account (free account is sufficient)
3. Click Add Site

Step 2: Configure Widget Settings

1. Site Name: Enter a descriptive name (e.g., "QuikForms Production")
2. Domain: Add your Salesforce Site domains:
   • yourorg.my.salesforce-sites.com
   • yourorg.my.site.com
   • Any custom domains
3. Widget Mode: Select Managed (recommended) — Cloudflare will automatically choose the best challenge type
4. Click Create

Step 3: Save Your Keys

After creation, Cloudflare provides two keys:

Copy both keys - you'll need them for the next steps.

Named Credential Setup

QuikForms uses Salesforce Named Credentials to securely store and access your Turnstile Secret Key. QuikForms includes pre-configured Named Credential and External Credential metadata — you only need to add your Secret Key.

Configure External Credential

1. Navigate to External Credentials
   • Setup → Security → Named Credentials
   • Click the External Credentials tab
   • Find Turnstile External Credential
2. Add Principal
   • In the Principals section, click New
   • Parameter Name: Default
   • Authentication Protocol: Password Authentication
   • Username: turnstile (can be any value)
   • Password: Paste your Secret Key from Cloudflare
   • Click Save
3. Grant Guest User Access
   • In the Permission Set Mappings section, click New
   • Permission Set: Select your Site's Guest User permission set
   • Principal: Default
   • Click Save

<?xml version="1.0" encoding="UTF-8"?>
<NamedCredential xmlns="http://soap.sforce.com/2006/04/metadata">
    <allowMergeFieldsInBody>true</allowMergeFieldsInBody>
    <allowMergeFieldsInHeader>true</allowMergeFieldsInHeader>
    <calloutStatus>Enabled</calloutStatus>
    <generateAuthorizationHeader>false</generateAuthorizationHeader>
    <label>Turnstile</label>
    <namedCredentialParameters>
        <parameterName>Url</parameterName>
        <parameterType>Url</parameterType>
        <parameterValue>https://challenges.cloudflare.com/turnstile/v0</parameterValue>
    </namedCredentialParameters>
    <namedCredentialType>SecuredEndpoint</namedCredentialType>
</NamedCredential>

Update QuikForms Settings

After configuring Named Credentials, add your Site Key to QuikForms Custom Metadata.

1. Navigate to Custom Metadata Types
   • Setup → Custom Code → Custom Metadata Types
   • Click Manage Records next to QuikForms Setting
2. Edit Default Settings
   • Click Edit next to the default record
   • Find Turnstile Site Key
   • Paste your Site Key (public key from Cloudflare)
   • Click Save

Per-Form CAPTCHA Control

You can enable or disable Turnstile CAPTCHA on individual forms using the Form Configuration settings.

1. Open your form in QuikForms Manager
2. Navigate to Settings tab
3. Find Disable CAPTCHA checkbox
4. • Unchecked (default): Turnstile CAPTCHA is active
   • Checked: Turnstile CAPTCHA is disabled for this form (honeypot remains active)

Honeypot Protection

Honeypot protection is a transparent anti-bot technique that is always active on all QuikForms forms.

How It Works:

• A hidden field is added to the form that is invisible to human users
• Automated bots that fill in all form fields will populate this hidden field
• Submissions with the honeypot field filled are automatically rejected
• No configuration required — honeypot is enabled by default on all forms

Permission Model

QuikForms follows a strict least-privilege permission model:

Object-Level Security

Configure object permissions through the Guest User Profile or a dedicated Permission Set.

Method 1: Guest User Profile (Recommended)

1. Setup → Users → Profiles
2. Find your Site's Guest User Profile (e.g., "MySite Profile")
3. Click Edit
4. Scroll to Custom Object Permissions
5. Configure permissions as shown in the table above
6. Click Save

[Screenshot: Guest User Profile Object Permissions]

Method 2: Permission Set

1. Setup → Users → Permission Sets
2. Create a new Permission Set: "QuikForms Guest Access"
3. Navigate to Object Settings
4. Configure permissions for each object
5. Assign the Permission Set to the Guest User

Field-Level Security

Guest users need field-level access to create records. Configure this for each field mapped in your forms.

Required Field Permissions:

• QuikForms Objects: Read access to all fields on FormDefinition__c, FormConfigVersion__c, and FormField__c
• Target Objects: Edit access (visible + editable) to mapped fields on Case, Lead, or custom objects
• Standard Fields: At minimum, enable access to fields like Status, Origin, Subject, Description

Configuration Steps:

1. In the Guest User Profile or Permission Set, navigate to Field-Level Security
2. For each object, click View
3. For QuikForms objects: Set all fields to Visible
4. For submission objects: Set mapped fields to Visible and Editable
5. Click Save

[Screenshot: Field-Level Security Configuration]

Case.Status          → Visible ✓  Editable ✓
Case.Origin          → Visible ✓  Editable ✓
Case.Subject         → Visible ✓  Editable ✓
Case.Description     → Visible ✓  Editable ✓
Case.SuppliedEmail   → Visible ✓  Editable ✓
Case.SuppliedName    → Visible ✓  Editable ✓
Case.SuppliedPhone   → Visible ✓  Editable ✓
Case.Type            → Visible ✓  Editable ✓
Case.Priority        → Visible ✓  Editable ✓

External Credential Access

For Turnstile CAPTCHA verification to work, the Guest User must have access to the Turnstile External Credential principal.

Grant Access:

1. Setup → Security → Named Credentials
2. Click External Credentials tab
3. Open Turnstile External Credential
4. In Permission Set Mappings, click New
5. Select your Site's Guest User permission set
6. Choose the Default principal
7. Click Save

How Rate Limiting Works

When a form submission is received, QuikForms:

1. Extracts the client's IP address from the HTTP request
2. Checks the Platform Cache for recent submissions from that IP
3. Increments the submission counter
4. If the counter exceeds the configured limit within the time window, the submission is rejected
5. Returns a 429 (Too Many Requests) error to the client

// Check rate limit before processing submission
if (isRateLimited(req.remoteAddress)) {
    // Log rate limit exceeded
    QuikExceptionLogger.logException(
        'API-3002',
        'Rate limit exceeded for IP: ' + req.remoteAddress,
        'QForm',
        'handleFormSubmission'
    );

    result.success = false;
    result.message = 'Too many requests. Please try again later.';
    return result;
}

private static Boolean isRateLimited(String ipAddress) {
    // Get rate limit from Custom Metadata
    List<QuikForms_Setting__mdt> settings = [
        SELECT Rate_Limit_Per_Minute__c
        FROM QuikForms_Setting__mdt
        WHERE DeveloperName = 'default'
    ];

    Integer limitVal = 5; // Default
    if (!settings.isEmpty() && settings[0].Rate_Limit_Per_Minute__c != null) {
        limitVal = (Integer)settings[0].Rate_Limit_Per_Minute__c;
    }

    // Check Platform Cache and enforce limit
    // ... implementation details ...
}

Configure Rate Limits

Rate limits are configured globally in QuikForms Custom Metadata.

Configuration Steps:

1. Setup → Custom Code → Custom Metadata Types
2. Click Manage Records next to QuikForms Setting
3. Click Edit on the default record
4. Set Rate Limit (Per Minute) to your desired value
5. Click Save

[Screenshot: Rate Limit Configuration]

Recommended Values:

Monitoring & Logging

QuikForms logs all rate limit violations to help you identify abuse patterns and adjust settings.

View Rate Limit Exceptions:

1. Open the QuikForms Error Manager app
2. Filter by Error Code: API-3002
3. Review the IP Address and Timestamp columns
4. Look for patterns indicating bot activity

[Screenshot: Rate Limit Exception Logs]

Key Indicators of Abuse:

• Single IP address with 10+ violations in an hour
• Sequential IP addresses (e.g., 192.168.1.1, 192.168.1.2) suggesting bot network
• Violations outside normal business hours
• Identical User-Agent strings across multiple IPs

IP Blocking Strategies

While QuikForms doesn't include built-in IP blocking, you can implement it using Salesforce Site features or external services.

Method 1: Experience Cloud IP Restrictions

1. Setup → Digital Experiences → All Sites
2. Click Builder for your site
3. Settings → Security → IP Address Restrictions
4. Add IP ranges to block or allow

Method 2: Custom Apex IP Blocking

Implement custom validation in the IQuikFormsSubmissionHandler plugin:

public class IPBlockerPlugin implements IQuikFormsSubmissionHandler {

    // Blocked IP addresses or ranges
    private static final Set<String> BLOCKED_IPS = new Set<String>{
        '192.168.1.100',
        '10.0.0.50'
    };

    public void beforeSubmit(QuikFormsSubmissionContext context) {
        String clientIP = context.request.remoteAddress;

        if (BLOCKED_IPS.contains(clientIP)) {
            context.addError('Your IP address has been blocked. Contact support.');
            context.result.success = false;
        }
    }

    public void afterSubmit(QuikFormsSubmissionContext context) {
        // Not needed for IP blocking
    }
}

Method 3: CloudFlare or CDN

If you use a custom domain with CloudFlare or similar CDN:

• Configure firewall rules to block malicious IPs
• Enable bot protection and challenge pages
• Use rate limiting at the CDN level before traffic reaches Salesforce

Input Validation

All user input is validated before processing:

Validation Layers:

1. Client-Side Validation: JavaScript validates format, length, and patterns in real-time
2. Server-Side Validation: Apex re-validates all input (never trust client validation alone)
3. Regex Validation: Custom patterns defined in FormField__c.Validation_Regex__c
4. Type Validation: Ensures data types match field definitions (email, phone, number)
5. Length Validation: Enforces maximum length based on Salesforce field limits

Email:    ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
Phone:    ^\+?[1-9]\d{1,14}$
ZIP Code: ^\d{5}(-\d{4})?$
URL:      ^https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b
Alphanumeric: ^[a-zA-Z0-9\s]+$

Field-Level Validation Configuration:

1. In QuikField Library, edit a field
2. Navigate to the Validation tab
3. Enter a Validation Regex pattern
4. Set a custom error message
5. Save the field

Output Encoding & Escaping

Salesforce automatically escapes output in Visualforce and Lightning Web Components to prevent XSS attacks.

Automatic Escaping:

customHTML Field Security

QuikForms supports customHTML field types for rich content. These fields require special security considerations.

Security Rules for customHTML:

1. Admin-Only Creation: Only administrators should create customHTML fields
2. No User Input: Never populate customHTML from user submissions
3. Static Content Only: Use for logos, disclaimers, formatting - not dynamic data
4. Review Before Publishing: Audit all HTML for malicious scripts before activating forms

Safe customHTML Examples:

<div class="disclaimer">
    <p>
        <strong>Privacy Notice:</strong> Your information will be handled in
        accordance with our <a href="/privacy">Privacy Policy</a>.
    </p>
</div>

<!-- DANGEROUS - NEVER DO THIS -->
<div>
    Welcome back, {! userInputName }!
</div>

<!-- If userInputName = "<script>alert('XSS')</script>"
     this creates a vulnerability -->

SOQL Injection Prevention

QuikForms uses parameterized queries and binding to prevent SOQL injection attacks.

Safe Query Patterns:

// Safe - uses bind variable
String formId = req.formId;
List<FormDefinition__c> forms = [
    SELECT Id, Name
    FROM FormDefinition__c
    WHERE Id = :formId
];

// Safe - uses escapeSingleQuotes
String searchTerm = String.escapeSingleQuotes(userInput);
String query = 'SELECT Id FROM Case WHERE Subject LIKE \'%' + searchTerm + '%\'';
List<Case> results = Database.query(query);

// DANGEROUS - NEVER DO THIS
String userInput = req.getParameter('search');
String query = 'SELECT Id FROM Case WHERE Subject = \'' + userInput + '\'';
List<Case> results = Database.query(query);

// If userInput = "test' OR '1'='1"
// Query becomes: SELECT Id FROM Case WHERE Subject = 'test' OR '1'='1'
// Returns all records!

Plugin Class Validation

Before instantiating any plugin, QuikForms validates the class to ensure it's safe.

Validation Checks:

1. Blocked Patterns: Prevents instantiation of dangerous system classes
2. Interface Implementation: Ensures class implements IQuikFormsPlugin
3. Class Existence: Verifies class exists in the org
4. Instantiation Test: Attempts to create an instance to catch constructor errors

Blocked Class Patterns:

public static Boolean isValidPluginClass(String className) {
    if (String.isBlank(className)) {
        return false;
    }

    // Check blocked patterns
    String upperClassName = className.toUpperCase();
    for (String pattern : BLOCKED_PATTERNS) {
        if (upperClassName.startsWith(pattern.toUpperCase())) {
            System.debug(LoggingLevel.WARN, 'Blocked plugin class: ' + className);
            return false;
        }
    }

    // Validate class exists
    Type classType = Type.forName(className);
    if (classType == null) {
        System.debug(LoggingLevel.WARN, 'Plugin class not found: ' + className);
        return false;
    }

    // Validate implements IQuikFormsPlugin
    try {
        Object instance = classType.newInstance();
        if (!(instance instanceof IQuikFormsPlugin)) {
            System.debug(LoggingLevel.WARN, 'Class does not implement IQuikFormsPlugin');
            return false;
        }
    } catch (Exception e) {
        System.debug(LoggingLevel.WARN, 'Failed to instantiate: ' + e.getMessage());
        return false;
    }

    return true;
}

Configuration Sanitization

Plugin configurations are stored as JSON. QuikForms sanitizes this JSON to prevent prototype pollution and other JavaScript-based attacks.

Dangerous Keys Removed:

• __proto__
• constructor
• prototype
• __defineGetter__
• __defineSetter__

public static Map<String, Object> sanitizeConfiguration(String configJson) {
    if (String.isBlank(configJson)) {
        return new Map<String, Object>();
    }

    try {
        Map<String, Object> config =
            (Map<String, Object>) JSON.deserializeUntyped(configJson);

        // Remove dangerous keys
        config.remove('__proto__');
        config.remove('constructor');
        config.remove('prototype');
        config.remove('__defineGetter__');
        config.remove('__defineSetter__');

        return config;
    } catch (Exception e) {
        System.debug(LoggingLevel.WARN, 'Failed to parse configuration: ' + e.getMessage());
        return new Map<String, Object>();
    }
}

HTML Sanitization Methods

QuikFormsPluginSecurity provides utility methods for HTML sanitization and URL validation.

Available Methods:

// Escape HTML entities
String userInput = '<script>alert("XSS")</script>';
String safe = QuikFormsPluginSecurity.escapeHtml(userInput);
// Result: &lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;

// Sanitize HTML (remove dangerous tags)
String userHtml = '<p>Hello</p><script>alert("XSS")</script>';
String sanitized = QuikFormsPluginSecurity.sanitizeHtml(userHtml);
// Result: <p>Hello</p> (script removed)

// Validate safe URLs
Boolean safe1 = QuikFormsPluginSecurity.isValidUrl('https://example.com');
// Result: true

Boolean safe2 = QuikFormsPluginSecurity.isValidUrl('javascript:alert("XSS")');
// Result: false (blocked)

Boolean safe3 = QuikFormsPluginSecurity.isValidUrl('data:text/html,<script>...');
// Result: false (blocked)

sanitizeHtml() Protections:

• Removes <script> tags and content
• Removes <iframe>, <object>, <embed> tags
• Removes <style> tags (can contain malicious CSS)
• Strips event handlers (onclick, onload, etc.)
• Removes javascript: URLs
• Removes data: URLs

Plugin Security Best Practices

Follow these guidelines when developing custom QuikForms plugins:

1. Input Validation

• Validate all configuration parameters in the plugin constructor
• Use sanitizeConfiguration() for JSON configs
• Fail safely - return sensible defaults if configuration is invalid

2. Output Encoding

• Use escapeHtml() for all user-provided content
• Never use innerHTML or unescaped bindings with user input
• Validate URLs with isValidUrl() before rendering links

3. Least Privilege

• Request only necessary permissions in plugin documentation
• Use without sharing only when absolutely required
• Never query sensitive objects (User, Profile, PermissionSet) without business justification

4. Error Handling

• Catch and handle all exceptions gracefully
• Log errors using QuikFormsExceptionLogger
• Never expose stack traces or internal errors to users

5. Testing

• Test plugins with malicious input (XSS payloads, SQL injection attempts)
• Verify plugins work correctly with Guest User permissions
• Test rate limiting and timeout scenarios

public class SecureExamplePlugin implements IQuikFormsPlugin {

    private Map<String, Object> config;

    public SecureExamplePlugin() {
        // Initialize with safe defaults
        this.config = new Map<String, Object>();
    }

    public void configure(String configJson) {
        // Sanitize configuration
        this.config = QuikFormsPluginSecurity.sanitizeConfiguration(configJson);

        // Validate required parameters
        if (!config.containsKey('requiredParam')) {
            throw new IllegalArgumentException('Missing required parameter: requiredParam');
        }
    }

    public String render(Map<String, Object> data) {
        try {
            // Escape all user input
            String userValue = (String) data.get('userInput');
            String safeValue = QuikFormsPluginSecurity.escapeHtml(userValue);

            // Build safe HTML
            return '<div class="plugin-output">' + safeValue + '</div>';

        } catch (Exception e) {
            // Log error and return safe fallback
            QuikExceptionLogger.logException(
                'PLUGIN-001',
                'Plugin render error: ' + e.getMessage(),
                'SecureExamplePlugin',
                'render'
            );
            return '<div class="plugin-error">Content unavailable</div>';
        }
    }
}