Sohay has several limits, and they protect against different things. Knowing which is which saves you tuning the wrong one.
| Limit | Protects against | Where |
|---|---|---|
| Daily site token cap | A runaway bill | AI Settings → Spend protection |
| Daily per-visitor token cap | One visitor consuming the site’s budget | AI Settings → Spend protection |
| Chat message rate limit | Rapid-fire abuse | Code only |
| Guest token mint rate limit | Token-mint amplification | Code only |
The two you set in the admin
Both live under Sohay → AI Settings → Spend protection.
The daily site token cap is the ceiling that matters. Once the day’s total passes it, Sohay stops calling your provider entirely until the ceiling resets at UTC midnight — note that is UTC, not your site’s timezone, so a cap can reset in the middle of your working day.
The daily per-visitor cap stops any single visitor spending the whole site’s budget before anyone else gets a turn.
Setting either to 0 disables that ceiling. Do that deliberately, not by
leaving a field blank and hoping.
Both can also be set in code, which is worth doing on a site where several people can reach the settings screen:
add_filter( 'sohaychat_usage_tracker_options', function ( $opts ) {
$opts['site_cap'] = 5000000;
$opts['actor_cap'] = 25000;
return $opts;
} );
The two that are code-only
The chat message rate limit is requests per rolling window, per visitor:
add_filter( 'sohaychat_rate_limit_options', function ( $opts ) {
$opts['limit'] = 60;
$opts['window'] = 60;
return $opts;
} );
The guest token mint limit is deliberately separate, so amplification protection can be tuned without touching normal chat throughput:
add_filter( 'sohaychat_auth_rate_limit_options', function ( $opts ) {
$opts['limit'] = 5;
$opts['window'] = 60;
return $opts;
} );
If you are behind Cloudflare or another proxy
Per-visitor limits key off the client IP. Behind a reverse proxy every request appears to come from the proxy, so all your visitors share one bucket — and one busy visitor rate-limits everybody.
Turning on proxy-aware detection fixes that:
add_filter( 'sohaychat_rate_limit_options', function ( $opts ) {
$opts['proxy_support'] = true;
return $opts;
} );
Only enable this if your site is reachable exclusively through the trusted
proxy, and that proxy overwrites the CF-Connecting-IP / X-Real-IP /
X-Forwarded-For headers on every request. On an origin that is also
reachable directly, a visitor can forge those headers and sidestep
per-visitor limits entirely. The site-wide daily cap still bounds your total
spend, which is why that one is the ceiling to get right first.
Watching it
Sohay → Diagnostics shows today’s usage live. Check it before a cap starts turning away real visitors — a limit that fires is indistinguishable from an outage from the visitor’s side.
Where to go next
What Sohay costs to run for what drives the number these caps bound.
