{"id":384781,"date":"2026-10-14T18:03:22","date_gmt":"2026-10-14T18:03:22","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/ipscanner\/"},"modified":"2026-10-25T13:14:18","modified_gmt":"2026-10-25T13:14:18","slug":"ipscanner-bot-blocker","status":"publish","type":"plugin","link":"https:\/\/kab.wordpress.org\/plugins\/ipscanner-bot-blocker\/","author":23584150,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.2.4","stable_tag":"0.2.4","tested":"7.1.3","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"IPScanner \u2013 Block Bots, VPNs & Proxies","header_author":"IPScanner","header_description":"Checks visitors with IPScanner and blocks bots, Tor, VPN and proxy traffic on your site, login, registration, comments and checkout.","assets_banners_color":"748076","last_updated":"2026-10-25 13:14:18","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/wordpress.org\/plugins\/ipscanner-bot-blocker\/","header_author_uri":"https:\/\/ipscanner.io","rating":0,"author_block_rating":0,"active_installs":0,"downloads":286,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.1.3":{"tag":"0.1.3","author":"ipscanner","date":"2026-10-14 18:15:28","revision":3746915},"0.2.0":{"tag":"0.2.0","author":"ipscanner","date":"2026-10-16 23:08:16","revision":3751239},"0.2.1":{"tag":"0.2.1","author":"ipscanner","date":"2026-10-17 07:08:52","revision":3751507},"0.2.2":{"tag":"0.2.2","author":"ipscanner","date":"2026-10-24 08:08:20","revision":3762886},"0.2.3":{"tag":"0.2.3","author":"ipscanner","date":"2026-10-25 09:43:49","revision":3764254},"0.2.4":{"tag":"0.2.4","author":"ipscanner","date":"2026-10-25 13:14:18","revision":3764626}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3746892,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3746892,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3746892,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3746915,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3746915,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.1.3","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3750908,"resolution":"1","location":"assets","locale":"","width":1280,"height":720},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3750908,"resolution":"2","location":"assets","locale":"","width":1280,"height":720},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3750908,"resolution":"3","location":"assets","locale":"","width":1280,"height":960},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3750908,"resolution":"4","location":"assets","locale":"","width":1280,"height":1280},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3750908,"resolution":"5","location":"assets","locale":"","width":1280,"height":720},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3750908,"resolution":"6","location":"assets","locale":"","width":1280,"height":720}},"screenshots":{"1":"Getting started: connect your account, then choose what to protect.","2":"Connect with IPScanner: sign up or sign in, no key to copy.","3":"Overview: connection, last 24 hours and recent decisions.","4":"Settings.","5":"The block page a blocked visitor sees.","6":"A blocked login attempt."}},"plugin_section":[262246],"plugin_tags":[2656,166108,362,212451,151081],"plugin_category":[54],"plugin_contributors":[286798],"plugin_business_model":[],"class_list":["post-384781","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-anti-spam","plugin_tags-bot-protection","plugin_tags-captcha","plugin_tags-registration-spam","plugin_tags-vpn-blocker","plugin_category-security-and-spam-protection","plugin_contributors-ipscanner","plugin_committers-ipscanner"],"banners":{"banner":"https:\/\/ps.w.org\/ipscanner-bot-blocker\/assets\/banner-772x250.png?rev=3746915","banner_2x":"https:\/\/ps.w.org\/ipscanner-bot-blocker\/assets\/banner-1544x500.png?rev=3746915","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/ipscanner-bot-blocker\/assets\/icon.svg?rev=3746892","icon":"https:\/\/ps.w.org\/ipscanner-bot-blocker\/assets\/icon.svg?rev=3746892","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/ipscanner-bot-blocker\/assets\/screenshot-1.png?rev=3750908","caption":"Getting started: connect your account, then choose what to protect."},{"src":"https:\/\/ps.w.org\/ipscanner-bot-blocker\/assets\/screenshot-2.png?rev=3750908","caption":"Connect with IPScanner: sign up or sign in, no key to copy."},{"src":"https:\/\/ps.w.org\/ipscanner-bot-blocker\/assets\/screenshot-3.png?rev=3750908","caption":"Overview: connection, last 24 hours and recent decisions."},{"src":"https:\/\/ps.w.org\/ipscanner-bot-blocker\/assets\/screenshot-4.png?rev=3750908","caption":"Settings."},{"src":"https:\/\/ps.w.org\/ipscanner-bot-blocker\/assets\/screenshot-5.png?rev=3750908","caption":"The block page a blocked visitor sees."},{"src":"https:\/\/ps.w.org\/ipscanner-bot-blocker\/assets\/screenshot-6.png?rev=3750908","caption":"A blocked login attempt."}],"raw_content":"<!--section=description-->\n<p>IPScanner checks each visitor on your server and stops bots before they reach your forms. Real people never see a challenge.<\/p>\n\n<p><strong>What it stops<\/strong><\/p>\n\n<ul>\n<li>Fake signups and spam registrations<\/li>\n<li>Comment and contact form spam<\/li>\n<li>Card-testing bots on WooCommerce checkout<\/li>\n<li>Login attacks from bots, Tor and proxies<\/li>\n<li>VPN and proxy traffic where you don't want it<\/li>\n<\/ul>\n\n<p><strong>Where it checks<\/strong><\/p>\n\n<ul>\n<li>Login, registration and password reset<\/li>\n<li>Comments<\/li>\n<li>WooCommerce checkout and account registration<\/li>\n<li>Contact Form 7 and WPForms<\/li>\n<li>The whole front end (optional)<\/li>\n<\/ul>\n\n<p>Verified search engines and AI crawlers always pass. If the API is slow or down, visitors are let in.<\/p>\n\n<p><strong>Pricing<\/strong><\/p>\n\n<p>New accounts get 7 days of Starter from the first check. After that the Free plan keeps 30,000 requests a month in monitor mode, and blocking is on Starter, $19 a month. <a href=\"https:\/\/ipscanner.io\/pricing\">See plans<\/a><\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin connects to the IPScanner API at https:\/\/ipscanner.io, run by IPScanner. It is required for the plugin to work.<\/p>\n\n<ul>\n<li>When a protected form is submitted, or a page is viewed with whole site protection on, the plugin sends the visitor's IP address, user agent and these request headers: Accept, Accept-Language, Accept-Encoding, Sec-CH-UA and Sec-Fetch headers. It also sends a random request ID and your Site ID when one is set. Endpoint: <code>POST \/v1\/edge\/check<\/code>. Results are cached on your site for 10 minutes per visitor.<\/li>\n<li>With a Site ID set, the plugin reads the site's policy (no visitor data) at most every 30 seconds. Endpoint: <code>GET \/v1\/sites\/{site}\/policy<\/code>.<\/li>\n<li>When an administrator opens Settings &gt; IPScanner (at most every 5 minutes) or clicks Test connection, the plugin reads the plan and usage of the API key (no visitor data). Endpoint: <code>GET \/v1\/usage\/summary<\/code>.<\/li>\n<li>Connect with IPScanner opens https:\/\/ipscanner.io\/connect\/wordpress with this site's admin URL, home URL, name, plugin and WordPress versions. After you approve, the plugin exchanges a one-time code for the API key and Site ID. Endpoint: <code>POST \/api\/connect\/wordpress\/token<\/code>.<\/li>\n<li>With \"Send plugin usage stats\" on (Settings &gt; Advanced; turned on when you connect, since the connect window asks for it), the plugin sends usage events with the API key: connected or disconnected, settings changed (which settings, the mode, protected areas and blocked classes), connection tested, the settings page opened (at most twice a day per tab), plugin updated or deactivated, and once a day the last 24 hours' totals (checked, blocked, top class) with the PHP and WordPress versions, locale and whether WooCommerce, Contact Form 7 or WPForms are active. No visitor data. Endpoint: <code>POST \/api\/wordpress\/events<\/code>.<\/li>\n<\/ul>\n\n<p>Nothing is sent before you connect or save an API key.<\/p>\n\n<p>Terms of service: https:\/\/ipscanner.io\/terms\nPrivacy policy: https:\/\/ipscanner.io\/privacy<\/p>\n\n<p>Source code: https:\/\/github.com\/ipscanner\/ipscanner-wordpress<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate the plugin.<\/li>\n<li>Go to Settings &gt; IPScanner and click Connect with IPScanner.<\/li>\n<li>Choose what to protect. Tor and bot scripts are blocked from the start.<\/li>\n<\/ol>\n\n<p>You can also paste an API key from <a href=\"https:\/\/ipscanner.io\/signup?next=%2Fdashboard%2Fapikeys\">ipscanner.io<\/a> or set it in wp-config.php: <code>define( 'IPSCANNER_API_KEY', 'pk_live_...' );<\/code><\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"is%20it%20a%20captcha%3F\"><h3>Is it a CAPTCHA?<\/h3><\/dt>\n<dd><p>No. Visitors never solve a puzzle. Blocked visitors get an error message or a short 403 page.<\/p><\/dd>\n<dt id=\"will%20it%20block%20google%20or%20bing%3F\"><h3>Will it block Google or Bing?<\/h3><\/dt>\n<dd><p>No. Verified search engines and AI crawlers always pass.<\/p><\/dd>\n<dt id=\"what%20if%20ipscanner%20is%20down%3F\"><h3>What if IPScanner is down?<\/h3><\/dt>\n<dd><p>Visitors are let in. The plugin waits at most 1.5 seconds, then pauses checks for 30 seconds.<\/p><\/dd>\n<dt id=\"i%20locked%20myself%20out.\"><h3>I locked myself out.<\/h3><\/dt>\n<dd><p>Administrators are let through while \"Always allow administrators\" is on. You can also add your IP to Always allow, or rename the plugin folder.<\/p><\/dd>\n<dt id=\"my%20site%20is%20behind%20cloudflare%20or%20a%20proxy.\"><h3>My site is behind Cloudflare or a proxy.<\/h3><\/dt>\n<dd><p>Choose Cloudflare or X-Forwarded-For under Visitor IP. Proxy headers are only read from trusted proxy addresses.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20page%20caching%3F\"><h3>Does it work with page caching?<\/h3><\/dt>\n<dd><p>Logins, forms and checkout are never cached, so they are always checked. Pages served from a full page cache are not.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.2.0<\/h4>\n\n<ul>\n<li>Connect with IPScanner: sign up or sign in in a popup instead of copying an API key. Connecting also adds the site to your IPScanner dashboard.<\/li>\n<li>Disconnect button under Settings.<\/li>\n<li>Optional usage stats (Settings &gt; Advanced).<\/li>\n<\/ul>\n\n<h4>0.1.3<\/h4>\n\n<ul>\n<li>Plugin renamed to \"IPScanner \u2013 Block Bots, VPNs &amp; Proxies\".<\/li>\n<\/ul>\n\n<h4>0.1.2<\/h4>\n\n<ul>\n<li>Overview tab with connection status, the last 24 hours and recent decisions.<\/li>\n<li>Getting started card for new sites.<\/li>\n<li>Settings grouped into sections.<\/li>\n<li>The \"Protected by IPScanner\" link on the block page is now off by default.<\/li>\n<\/ul>\n\n<h4>0.1.1<\/h4>\n\n<ul>\n<li>API key link opens the API keys page.<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>First release: visitor checks with monitor and enforce modes, dashboard site policy, login, registration, password reset, comment, WooCommerce, Contact Form 7 and WPForms protection, allowlist, trusted proxies, recent decisions.<\/li>\n<\/ul>","raw_excerpt":"A CAPTCHA alternative with no puzzle. Stops fake signups, spam registrations, form spam and card-testing bots, plus VPN, proxy and Tor traffic.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/384781","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=384781"}],"author":[{"embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/ipscanner"}],"wp:attachment":[{"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=384781"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=384781"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=384781"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=384781"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=384781"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=384781"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}