Link

Web3 security

Webgate

Spam bot, brute force & phishing protection.
A block of HTML you paste onto a page. A visitor pays a small amount from Link, the wallet on their own computer. Until that payment is made, the page shows a Continue button and nothing else.

Get Link Home
Windows · needs Link · a published @nexusnode.link paymail

What it is

After the payment, the cover lifts and the page is visible. The payment is one transaction. It pays you, pays a house fee, and writes a signed record of who visited and which page they opened.

When you link a webgated page the first image on the page will show in that preview.

What the visitor needs

Link

Link, running on that computer. Phones, and any other computer, will see “No Link detected”.

A paymail

A published @nexusnode.link paymail in that Link.

Link listens only on that computer.

What you set

data-link-to

Your @nexusnode.link paymail, or a 1… payment address.

data-link-sats

What the visitor pays you. Minimum 200 sats. Maximum 1000.

data-link-message

A short note stored in the on-chain record. Do not use a | character.

data-link-deny

Where to send a visitor who does not have enough funds, or who cancels.

data-link-auto-pay

Off or on. Off is the default.


Link adds a house fee of 500 sats, paid to webgate@nexusnode.link.

If Link is not running, the page says No Link detected and stays there, so the visitor can start Link and press Continue again. If the wallet cannot cover the payment, the page says Not enough funds, waits a moment, and then opens the deny address. A cancelled payment does the same.

If auto-pay is on and the visitor has their Link open, they will go straight to the webpage with Link automatically paying the fee.

The record

The transaction outputs are the amounts: yours, and the 500 sat house fee. The block time is the time. The note in the transaction is short. It contains the type web_gate, the visitor’s handle, the page origin, the page path, your message, a nonce, and a signature. The path does not include a query string.

The nonce in the sample block is a placeholder. That is enough when you only want the page covered. A site that must refuse a repeated payment replaces link_nonce with a new value each time the page is served, and accepts a form only after it has seen that value in the transaction.

A normal page

No plugin is required.

  1. 1Copy the HTML block at the bottom of this page.
  2. 2Set data-link-to, data-link-sats, data-link-message, and data-link-deny.
  3. 3Paste it into a Custom HTML block on the page.
  4. 4Publish the page.

Leave data-link-auto-pay as off when the visitor should press Continue, and then confirm the payment in Link. Set it to on when the page should pay as it loads, with no Continue click and no question in Link, for as long as Link’s own limit allows. That limit is 30 seconds between these payments, 3 a day for one site, and 8 a day across every site. After the limit, Continue returns and Link asks. The page cannot raise the limit.

The WordPress login screen

The address wp-login.php is not a page you can edit. A Custom HTML block cannot be placed on it. The Code Snippets plugin prints this block on that screen. You do not need to rename the login address.

  1. 1In wp-admin, open Plugins, choose Add New, search for Code Snippets, and activate it.
  2. 2Keep a logged-in tab open. Test the login screen in a private window.
  3. 3Open Snippets, then Add New.
  4. 4Title the snippet Webgate login. Leave the type as PHP.
  5. 5At the bottom of the editor, set the scope to Only run on site front-end.
  6. 6Paste the PHP below. The snippet must print only the pay form, then stop, before WordPress prints the password form.
  7. 7Set data-link-to and the other fields. On a login, set data-link-post to 1. Do not leave the username and password fields in the page until the payment checks pass.
  8. 8Click Save Changes and Activate.
  9. 9In a private window, open the login address. You should see Continue, and no username or password fields.

If that window is blank, return to the tab that is still logged in and deactivate the snippet.
Make SURE you do not lock yourself out of the login page before testing. We strongly advise testing on a normal web-page first.

PHP for Code Snippets

Open the snippet with this. Do not add a <?php line of your own above it. Code Snippets already runs as PHP.

				
					add_action('login_footer', function () {
?>

Those two PHP lines only print the form. They do not check the payment. A login must check it on the server, then print the password form. Close the snippet with:

				
					<?php
});

The HTML block

Copy this into a Custom HTML block on a normal page. A login uses the same block with data-link-post set to 1. It is shown as code, so it does not cover this page.

				
					<form method="post" action="/login"
      data-link-to="YOUR_NAME@nexusnode.link"
      data-link-sats="200"
      data-link-message="any message you want"
      data-link-deny="/404"
      data-link-auto-pay="off"> <!-- set to on for seemless access, users Link can override -->
  <input type="hidden" name="link_nonce" value="SERVER_MINTED_NONCE">
  <input type="hidden" name="link_txid" value="">
  <button type="submit">Continue</button>
</form>
<script src="https://dalais.org/webgate.js"></script>

The fields

Set these on the block above.

data-link-to

Your @nexusnode.link paymail, or a payment address starting with 1.

data-link-sats

Sats to you. Minimum 200. Maximum 1000.

data-link-message

A short note on the chain. No | character. 160 bytes.

data-link-deny

Where to send them after Not enough funds, or a cancelled payment.

data-link-auto-pay

Off is the default. The visitor presses Continue, then Link asks. On pays as the page loads.

The limit

30 seconds between silent pays. 3 a day for this site. 8 a day across every site. Past that, Continue comes back.

data-link-post

Set to 1 only when this form must submit after payment, such as a login.

link_nonce

A nonce your server minted for this attempt. 8-64 of letters, numbers, hyphen and underscore. Leave this as it is if you do not know what to do with it.

If Link is not running, the page stays. The word Link opens the download.

Link adds 500 sats to webgate@nexusnode.link. The page cannot remove it.

Your server

When the form must submit, check the transaction. A payment in the mempool counts.

  1. 1The nonce is one you issued, unused, for this session.
  2. 2Fetch the transaction from WhatsOnChain.
  3. 3An output pays your address exactly data-link-sats.
  4. 4An output pays 500 sats to webgate@nexusnode.link.
  5. 5The note is type web_gate, with the handle, origin, path, message, nonce, pubkey and sig.
  6. 6The origin is your site. The nonce matches. The path has no query string.
  7. 7The signature matches that canon, and the pubkey matches the handle.
  8. 8Mark the txid and the nonce used.
  9. 9Only then print the password form.

Canon, handle in lower case and the @ removed:

NN1|web_gate|handle|origin|path|message|nonce