So Outside Technology Security CMS
AnQiCMS
Online Demonstration

How to configure content security audit on the corporate website, how to configure AnQiCMS's sensitive word filtering and reCAPTCHA?

📅 2026-11-01 👁️ 0

How to configure AnQiCMS's sensitive word filtering and reCAPTCHA to prevent malicious content and robot submissions? Both functions operate at different levels: sensitive word filtering belongs to content security settings, working with keyword replacement and content review to intercept problematic text at the storage and publishing stages; reCAPTCHA is placed before form submission, blocking robots before they can write. Adding built-in JWT authentication and defense against SQL injection and XSS, forming three barriers before submission, before storage, and at the account level.

The first gate: reCAPTCHA verification code is integrated before the form

The typical path for a robot to submit is through留言, comments, and registration forms being bulk-filled by scripts. AnQiCMS supports form integration with reCAPTCHA: fill in the site credentials in the background, then enable it on the forms that need protection, and the captcha determines whether it is human or machine at the time of submission. The recommended configuration order is to first cover the external form entry (留言 and registration), and then expand to comments if there are many comments; if the site has multiple language versions, all entries share the same credential. You can check if it is effective by going through the submission process in a stealth window to verify whether the verification steps appear.

The second gate: sensitive word filtering and keyword replacement

In the content security settings, sensitive word filtering is responsible for directly blocking or prompting content that matches the word list, and keyword replacement then modifies the risk expression into a compliant statement, suitable for sites with blurred boundaries of industry terminology (such as replacing exaggerated efficacy expressions with neutral expressions). The word list maintenance suggestion is to fill in real violation cases: for each complaint or platform reminder, add the feature words into the library, which is more useful than copying a general word list all at once. Both types of rules apply to the full station content入库, editing and collecting papers also go through.

The third gate: content review process

Filtering is a mechanical determination, review is a human judgment. Content review is suitable for two types of scenarios: one is the selection of external submissions and comments, which enter the review queue first and are then released by editors; the other is the key pages during sensitive periods, which require an additional review before publication. Accompanied by the document status flow (draft, pending publication, formal), content that has not passed the review stops at the pending publication level and will not be prematurely exposed online.

Account and interface layer: JWT authentication and injection defense

At the fundamental level, the system is built-in with JWT authentication to protect login states and API calls,配合 input validation to defend against SQL injection and XSS attacks; the anti-capture interference code then protects the content from being bulk-collected. This layer generally does not require daily configuration, but there are two check actions to be done: confirm that the site has been upgraded to a version that fixes injection issues (v3.6.6 fixed two high-risk issues of list sorting parameter SQL injection and login credentials being forgeable), and rotate the password and token of the background account on a regular basis.

Security checklist before going online

Check items one by one: Whether the captcha is enabled on the external form; The last update time of the sensitive word library; Whether the keyword replacement rules cover the current business words; Whether comments and submissions enter the review queue; Whether the version is the current version containing security fixes; Whether the administrator and editor account permissions are divided according to roles. After the list is run, the common paths of malicious content and robot submissions basically have gates.

Common questions

Is it okay to only install reCAPTCHA without sensitive word filtering?Can it block robots, but the manual content that is allowed to pass does not have a word list to control, the two types of risk sources are different, and it is recommended to open both.

Will the keyword replacement change the wrong thing?There may be incorrect replacements, the rules should be narrow rather than broad, and regular inspections of replacement records should be conducted after going online.

Will the review process slow down the release?It can be set according to categories whether to force review, regular self-operated columns can be directly through, and external content goes through the queue.

Related articles

Practical configuration of static URL and 301 redirection

The static page makes the dynamic page accessible with a standard and readable address, and the 301 redirect converges the old addresses left by the revised or changed column to the new page. This article explains in order how to configure it in AnQiCMS: first, enable the static page rules in the background and unify the address style, and then use the 301 redirect to manage old links, and provide troubleshooting methods for common problems such as circular redirection and rule failure.

2026-11-01

Use anchor text management to enhance on-site SEO weight transmission

Anchor text is the segment of text within an internal link, which determines how a search engine understands the theme of the page being pointed to. This article explains how to establish a keyword library, automatically add anchor text links to in-site keywords, control duplicate anchor text and link density, let the weight pass along with content relevance, and provide the steps and self-checking method for over-optimization of AnQiCMS anchor text management.

2026-11-01

Why Static URL and 301 Redirect are the Infrastructure of Enterprise SEO That Cannot Be Neglected

Static URL determines how the URL looks and whether it can be reliably indexed, while 301 redirect determines the weight of the old link and whether visitors will lose after the address changes. Enterprises consider these two items as infrastructure because once the address rules change after the growth of columns and articles, the impact is the entire site rather than a single page. It is recommended to first define the static URL rules, then converge the historical addresses, and finally check whether the sitemap and push are synchronized.

2026-11-01

BaoTa one-click deployment AnQiCMS: from Docker image to production environment

AnQiCMS provides four available deployment options: Baota panel one-click deployment, overseas version aaPanel, traditional LNMP command deployment, and directly pulling the Docker image anqicms/anqicms. The program listens on port 8001 by default, with the 80 and 443 ports forwarded by the reverse proxy. When choosing, mainly look at three things - whether there is already a panel hosting environment, whether containerized publishing is needed, and who is responsible for backups and rollbacks.

2026-11-01

After the background style is changed, the front-end is messed up, and you should first check which layer for template changes and static files.

After the template is modified in the background, the front-end style is disordered, but the background is normal. The fault is basically in the presentation layer rather than the data layer. The troubleshooting sequence is to first locate the specific template modification, then check the path and missing static resources, and finally verify whether the site-wide replacement has mistakenly damaged the style references. The smaller the rollback range, the safer it is: if you can only roll back the template, don't touch the backup. Confirm that the backup contains static files before moving the backup.

2026-11-01

After the background login credentials are forged, what to rotate first and what to change next.

The certificate can be forged does not mean the password is guessed. AnQiCMS v3.6.6 fixes the site switching login issue, replacing the long-term valid jump ticket with a one-time ticket valid for 120 seconds, and requiring in the upgrade prompt to first rotate the signature keys of each site, and then change all administrator passwords. This article gives the handling sequence and judgment basis after discovering such problems.

2026-11-01

How to arrange the update rhythm of scheduled release, and whether it will affect the collection time of content

The scheduled release solves the stability of the update rhythm, not to make the content be indexed faster. This article explains the actual role of the time factor, the three principles of scheduling, what to check in the pending release status, and why the timeliness of new content indexing depends on the active push of links rather than waiting for crawling.

2026-11-01

Before going online, run the online experience station first, and what should be configured separately for the formal site?

The online experience station is suitable for confirming the boundaries of functions and the feel of operation, but it does not bear the data and domain environment of the formal site. Before going online, it is necessary to implement separately the deployment form, content structure, crawling and inclusion settings, notification links, and backup recovery. This article lists the configuration items and check sequence to be confirmed item by item before going online, according to the differences between the experience station and the formal site.

2026-11-01