Add a widget

Add a widget for each form, or each group of forms, that you want Wicket to protect. A widget has a name, the hostnames it works on, a mode, and a site key and a secret key. You add one when you build a form, then put it on your page. How Wicket works explains what the widget does.

• You need the Admin or Technical role on the account. Other roles can read widgets but not add one (Team members).
• Know the hostname of each site that will show the widget, such as example.com. A hostname covers every name under it, and a widget lists at most as many as your plan allows (Wicket limits).
• Your plan holds a number of widgets. The page tells you which widget this one will be, such as Widget 3 of 25 on your plan.

1. In the dashboard, go to Security. On the Wicket card, select Open Wicket.
2. Select Add widget. The Add a widget page opens. You can also reach it from the command palette with Add a Wicket widget.
3. Under Name, enter what the widget is for, such as Sign-up form, in up to 100 characters. Only you see the name.
4. Under Hostnames, enter a hostname and press Enter, or select Add hostname. A space or a comma after a name adds it too, and a pasted list becomes one tag for each name. The count under the field reads 2 of 10 hostnames.
5. Under Mode, choose how much of the check a visitor sees (Widget modes helps you choose):
   • Managed: most visitors see nothing, and a few tick a box. This is the default.
   • Non-interactive: no one ticks a box, and an unclear visitor waits a moment longer.
   • Invisible: no box on the page at all.
6. Under Branding, Show Wicket’s name on the widget is on. Only Business and Enterprise accounts can switch it off. On any other plan the switch is locked, and the page offers the plan that unlocks it.
7. Select Add widget.

The This widget card beside the sections shows the name, the number of hostnames, the mode and whether Wicket's name shows, and says which widget this is on your plan.

The page changes to Widget added and shows the keys once:

• Site key is public and goes in your page.
• Secret key is private and goes on your server. It starts hidden: select Reveal to read it, and the copy button next to it copies it.

Save the secret key before you leave. We keep only a fingerprint of it, so we cannot show it again. If you leave the page with a link first, the dashboard asks Leave without saving the secret key?. A secret key you lose is replaced by rotating it.

Under Add it to your page the page shows the HTML to paste, with your site key already in it. Select Install the widget to open the widget's Install tab, which has the code for your page and your server (Install a widget).

The page reads each hostname as you add it. A name it can tell is wrong keeps its tag, in red, and the sentence under the field says why, such as "example.com/docs" is not a hostname: a hostname has no path, query or fragment. Remove the tag and add the right name. Add widget waits until every tag is clean.

A name the page cannot judge goes to us, and our answer is shown the same way. The tag it names stays in red, the sentence is under the field, and Could not add the widget appears above the buttons. Everything else you entered stays.

When your plan holds as many widgets as you have, the page opens with Your plan has no room for another widget and the next plan's price, and the button reads Upgrade to add more. It opens the plan page. Widgets you already have keep working.

When a widget would list more hostnames than your plan allows, we refuse it and a window names the limit and the plan that raises it. After you choose a plan, come back and add the widget again.

Wicket under Security lists every widget, 24 to a page. A new account sees a card that says No widgets yet instead, with Add widget.

Four tiles are above the list, and the first and last are filters:

• Widgets is how many you have against what your plan holds, such as 6 of 25. Select it to clear the search and the filters.
• Challenges in 24 hours is how many visitors Wicket checked across all your widgets.
• Passed is the share of those checks that passed.
• Needs attention counts the widgets that need a look. It is red above zero, and selecting it lists them.

When a widget needs attention, a strip above the list names it and says why, with the button that fixes it:

The toolbar has a search box that matches a widget's name, site key or hostname, a Show menu (All widgets, Active, Turned off and Needs attention, each with its count) and a Sort by menu: Newest, Oldest, Name, Most challenges and Lowest solve rate. The search, the filter, the sort and the page are in the address, so you can share a filtered list. Clear filters appears while one is on. Cards and Table switch the view, and the dashboard remembers your choice in that browser. A phone always shows cards.

Each card shows the widget's name, which opens its Analytics tab, its mode, its first hostname with +2 more when there are more, its site key with a copy button, the challenges and the solve rate of the last 24 hours, and when it last saw a challenge. The menu on a card has Open, Install, Settings, Copy site key and Delete widget…. Delete widget… asks you to type the widget's name, and the forms that use the widget stop passing checks at once.

Enter a name, such as Sign-up form.

The name is empty. Enter up to 100 characters.

Add the hostname of the site the widget runs on, such as example.com.

A widget needs at least one hostname.

Could not add the widget

The text under it is our reason. The fields keep what you entered, so change what it names and select Add widget again.

Your role cannot add a widget

Only Admin and Technical members add widgets. Ask one of them, or ask for a role change on the Team tab of Settings.

Could not load your widgets

Select Try again. If it keeps failing, contact support.

• How Wicket works
• Change a widget's settings
• Manage widgets with the API
• Wicket limits

• Add Wicket to your site to put the script and the widget on a page.
• Install a widget to copy the code from the widget's Install tab.
• Verify a token on your server so your server checks every form.