# Add a widget > Add a Wicket widget to your account, list the hostnames it runs on, choose its mode and save the keys it gives you. Source: https://www.coritan.com/docs/wicket/add-a-widget/ In the dashboard: - /dashboard/security/wicket: https://www.coritan.com/dashboard/security/wicket - /dashboard/security/wicket/new: https://www.coritan.com/dashboard/security/wicket/new Add a *widget* for each form, or each group of forms, that you want Wicket to protect. A widget has a name, the hostnames it works on, a mode, and a site key and a secret key. You add one when you build a form, then [put it on your page](/docs/wicket/add-wicket-to-your-site/). [How Wicket works](/docs/wicket/how-wicket-works/) explains what the widget does. ## Before you begin - You need the Admin or Technical role on the account. Other roles can read widgets but not add one ([Team members](/docs/account/team-members/)). - Know the hostname of each site that will show the widget, such as `example.com`. A hostname covers every name under it, and a widget lists at most as many as your plan allows ([Wicket limits](/docs/wicket/limits/#plan-limits)). - Your plan holds a number of widgets. The page tells you which widget this one will be, such as `Widget 3 of 25 on your plan.` ## Add a widget 1. In the [dashboard](https://www.coritan.com/dashboard/security), go to **Security**. On the **Wicket** card, select **Open Wicket**. 2. Select **Add widget**. The **Add a widget** page opens. You can also reach it from the command palette with **Add a Wicket widget**. 3. Under **Name**, enter what the widget is for, such as `Sign-up form`, in up to 100 characters. Only you see the name. 4. Under **Hostnames**, enter a hostname and press Enter, or select **Add hostname**. A space or a comma after a name adds it too, and a pasted list becomes one tag for each name. The count under the field reads `2 of 10 hostnames`. 5. Under **Mode**, choose how much of the check a visitor sees ([Widget modes](/docs/wicket/widget-modes/) helps you choose): - **Managed**: most visitors see nothing, and a few tick a box. This is the default. - **Non-interactive**: no one ticks a box, and an unclear visitor waits a moment longer. - **Invisible**: no box on the page at all. 6. Under **Branding**, **Show Wicket’s name on the widget** is on. Only Business and Enterprise accounts can switch it off. On any other plan the switch is locked, and the page offers the plan that unlocks it. 7. Select **Add widget**. The **This widget** card beside the sections shows the name, the number of hostnames, the mode and whether Wicket's name shows, and says which widget this is on your plan. ## Result The page changes to **Widget added** and shows the keys once: - **Site key** is public and goes in your page. - **Secret key** is private and goes on your server. It starts hidden: select **Reveal** to read it, and the copy button next to it copies it. Save the secret key before you leave. We keep only a fingerprint of it, so we cannot show it again. If you leave the page with a link first, the dashboard asks **Leave without saving the secret key?**. A secret key you lose is replaced by [rotating it](/docs/wicket/widget-settings/#rotate-the-secret-key). Under **Add it to your page** the page shows the HTML to paste, with your site key already in it. Select **Install the widget** to open the widget's **Install** tab, which has the code for your page and your server ([Install a widget](/docs/wicket/install-a-widget/)). ## When a hostname is refused The page reads each hostname as you add it. A name it can tell is wrong keeps its tag, in red, and the sentence under the field says why, such as `"example.com/docs" is not a hostname: a hostname has no path, query or fragment.` Remove the tag and add the right name. **Add widget** waits until every tag is clean. A name the page cannot judge goes to us, and our answer is shown the same way. The tag it names stays in red, the sentence is under the field, and **Could not add the widget** appears above the buttons. Everything else you entered stays. ## When your plan is full When your plan holds as many widgets as you have, the page opens with **Your plan has no room for another widget** and the next plan's price, and the button reads **Upgrade to add more**. It opens the plan page. Widgets you already have keep working. When a widget would list more hostnames than your plan allows, we refuse it and a window names the limit and the plan that raises it. After you choose a plan, come back and add the widget again. ## Read the list of widgets **Wicket** under **Security** lists every widget, 24 to a page. A new account sees a card that says **No widgets yet** instead, with **Add widget**. Four tiles are above the list, and the first and last are filters: - **Widgets** is how many you have against what your plan holds, such as `6 of 25`. Select it to clear the search and the filters. - **Challenges in 24 hours** is how many visitors Wicket checked across all your widgets. - **Passed** is the share of those checks that passed. - **Needs attention** counts the widgets that need a look. It is red above zero, and selecting it lists them. When a widget needs attention, a strip above the list names it and says why, with the button that fixes it: | Reason | What the strip says | Button | | --- | --- | --- | | Our team turned it off | **Turned off by our team** | **Open widget**, which shows the reason | | Your server verifies nothing | **Passed checks, but your server verified none in 24 hours** | **How to verify** | | A refused page | **Asked from a page whose hostname the widget does not list** | **Add the hostname** | The toolbar has a search box that matches a widget's name, site key or hostname, a **Show** menu (**All widgets**, **Active**, **Turned off** and **Needs attention**, each with its count) and a **Sort by** menu: **Newest**, **Oldest**, **Name**, **Most challenges** and **Lowest solve rate**. The search, the filter, the sort and the page are in the address, so you can share a filtered list. **Clear filters** appears while one is on. **Cards** and **Table** switch the view, and the dashboard remembers your choice in that browser. A phone always shows cards. Each card shows the widget's name, which opens its **Analytics** tab, its mode, its first hostname with `+2 more` when there are more, its site key with a copy button, the challenges and the solve rate of the last 24 hours, and when it last saw a challenge. The menu on a card has **Open**, **Install**, **Settings**, **Copy site key** and **Delete widget…**. **Delete widget…** asks you to type the widget's name, and the forms that use the widget stop passing checks at once. ## Troubleshooting `Enter a name, such as Sign-up form.` : The name is empty. Enter up to 100 characters. `Add the hostname of the site the widget runs on, such as example.com.` : A widget needs at least one hostname. **Could not add the widget** : The text under it is our reason. The fields keep what you entered, so change what it names and select **Add widget** again. **Your role cannot add a widget** : Only Admin and Technical members add widgets. Ask one of them, or ask for a role change on the **Team** tab of **Settings**. **Could not load your widgets** : Select **Try again**. If it keeps failing, [contact support](/docs/support/conversations/). ## Related - [How Wicket works](/docs/wicket/how-wicket-works/) - [Change a widget's settings](/docs/wicket/widget-settings/) - [Manage widgets with the API](/docs/wicket/manage-widgets-with-the-api/) - [Wicket limits](/docs/wicket/limits/) ## Next steps - [Add Wicket to your site](/docs/wicket/add-wicket-to-your-site/) to put the script and the widget on a page. - [Install a widget](/docs/wicket/install-a-widget/) to copy the code from the widget's **Install** tab. - [Verify a token on your server](/docs/wicket/verify-tokens/) so your server checks every form.