<!DOCTYPE html><html><head><title></title></head><body><div style="font-family:Arial;">Hi Lova,</div><div style="font-family:Arial;"><br></div><div style="font-family:Arial;">Requiring users to log in seems fine to me, but you can use the X-Forwarded-For or CF-Connecting-IP headers to find out the real IP of the client.</div><div style="font-family:Arial;"><br></div><div style="font-family:Arial;">Laurentiu</div><div style="font-family:Arial;"><br></div><div>On Wed, Aug 19, 2026, at 10:07, Lova Andriarimalala via QGIS-Developer wrote:</div><blockquote type="cite" id="qt" style=""><div dir="ltr"><div>Hello everyone,</div><div><br></div><div>Following the plugin rating abuse issue reported at <a href="https://github.com/qgis/QGIS-Plugins-Website/issues/416">https://github.com/qgis/QGIS-Plugins-Website/issues/416</a> and <a href="https://github.com/qgis/QGIS-Plugins-Website/issues/420">https://github.com/qgis/QGIS-Plugins-Website/issues/420</a>, I wonder if someone could help or share some thoughts about it.</div><div><div><br></div><div>We have released some fixes to enforce throttles (<a href="https://github.com/qgis/QGIS-Plugins-Website/pull/418">https://github.com/qgis/QGIS-Plugins-Website/pull/418</a>), reject forged cookies and add a cap votes per address (<a href="https://github.com/qgis/QGIS-Plugins-Website/pull/423">https://github.com/qgis/QGIS-Plugins-Website/pull/423</a>). However, it is not fully working because every IP recorded against a vote is a Cloudflare edge IP, not a real user IP. I checked 100 recent votes against Cloudflare's published ranges: 100 out of 100 match. So the per-IP cap is counting Cloudflare's proxy pool, which rotates per request. So, storing real client IPs would probably require some discussions regarding GDPR and retention angle.<br></div></div></div></blockquote><div style="font-family:Arial;"><br></div></body></html>