WordPress plugin

WordPress plugin to block bots, VPNs and Tor

Checks logins, sign-ups, comments, WooCommerce checkout and contact forms. Starts in monitor mode and blocks nothing until you switch.

Free, GPLv2 or laterWordPress 6.0+, PHP 7.4+

Protected areas

Where it checks

Forms get an error message, pages a short 403 page.

  • Login

    Plus password reset

  • Registration

    WordPress and WooCommerce accounts

  • Comments

    Before a comment is saved

  • WooCommerce checkout

    Classic and block checkout

  • Contact forms

    Contact Form 7 and WPForms

  • Whole site

    Optional, off by default

Setup

Monitor first, then enforce

  1. 1

    Install the plugin

    Upload the zip under Plugins and activate it.

    ipscanner.zip
    1. Plugins
    2. Add New Plugin
    3. Upload Plugin
  2. 2

    Paste your API key and Site ID

    The Site ID links the site to your dashboard. It is optional.

    Settings → IPScanner

    API key

    pk_live_••••••••3f9a

    Site ID

    site_4fQ8nZ2kLm7xR1vT9cBw

    Get a free API key
  3. 3

    Pick the areas, then enforce

    Watch the Overview tab for a few days before you block anything.

    • Login
    • Registration
    • Comments
    • WooCommerce checkout
    • Contact forms
    • Whole site
    MonitorEnforceafter a few days

Sites dashboard

Change the policy without touching WordPress

Allow, flag or block each class from the dashboard. The plugin picks up a change within 30 seconds.

  • Verified search and AI crawlers always pass.
  • Administrators and the IPs you list are never blocked.
  • If IPScanner is slow or down, visitors get through.

Questions

WordPress plugin FAQ

Forms are checked on submit, pages only with whole site protection on. Each visitor is checked at most once every 10 minutes, with a 1.5 second timeout, and goes through if IPScanner does not answer.

Start in monitor mode

Install it, read a week of decisions, then block.