security - Meteor Site Under attack. Help Using Sikka -

my site under attack. created users directory automatically puts last logged in people on top. whoever loads home page gets placed on top.

i have 1 user (at least 1 that's logged in, not sure if there more logged off) refreshing page non stop , slowing site. site uses lots of images it's become slower now.

i installed sikka: https://github.com/meteorhacks/sikka

but having issues it. particularly 3 major issues:

1. i set package, , doesn't seem stop attacks. still see user reloading no matter what.

2. i run local server (localhost:3000), , there works well, in fact won't let me anything. load page , take me captcha page no matter what. keep taking me there right after click. can't work on site package installed.

3. i had turn feature 'onlyforhumans'. asks users confirm not robots, huge inconvenience. not expire , keep asking. has stopped attack, can't leave site this. affect signup rate etc.

can me configuration? rate limits, appropriate setting per ip? have @ defaults, without 'onlyforhumans' setting on, doesn't anything, , bad, goes haywire locally.

any appreciated!

    "sikka": {     "captcha": {       "sitekey": "google key here",       "secret": "google key here"     },     "ratelimits": {       "perip": 20,       "perhuman": 20,       "persession": 20     },     "times": {       "blockipfor": 120000,       "humanlivesupto": 3600000     },     "onlyforhumans": true   }