WPBruiser

WPBruiser stops automated form submissions before WordPress ever processes them. Every protected form gets a hidden token, which the visitor’s browser requests in the background. A real person never sees it or has to do anything. A bot that posts straight to your login, registration or comment endpoint arrives without a valid token and is turned away. Because bad submissions are rejected at the door, they never land in your moderation queue and never create junk user accounts. You also don’t have to ask visitors to solve a puzzle, which is often the step where real people give up on a form. Everything runs on your own server. WPBruiser does not call remote APIs, does not load outside scripts or fonts and does not send your visitors’ data anywhere. Notice: As of version 3.2.0, it is maintained by WPZOOM. Forms you can protect Turn protection on or off for each form on the WordPress and Integrations screens: WordPress login WordPress registration WordPress lost password WordPress comments, with an optional character limit for the comment, name, email and website fields Free integrations Each integration is a card on the Integrations screen, which shows whether its plugin is active on your site and has one switch to turn protection on. On a new install, protection is switched on for every supported plugin that is already active. Login With Ajax and wpDiscuz need no switch of their own: they are covered by the WordPress login and comment protection. WPZOOM Forms: every form you build with it, placed as a block, a shortcode or an Elementor widget Ultimate Member: login, registration and password reset forms WP-Members: login and registration forms Login With Ajax: its AJAX login, registration and lost password forms Jetpack: the Jetpack contact form MC4WP: Mailchimp for WordPress: every sign-up form you build with it HTML Forms: every form you build with it wpDiscuz: comments posted through its AJAX comment system Using Contact Form 7, WPForms, WooCommerce, Easy Digital Downloads, Elementor Pro, Gravity Forms or another popular form plugin? WPBruiser Pro protects them too. See “WPBruiser Pro” below. Brute-force and hardening tools Limits failed logins: after 5 failed logins (you choose the number) an IP address is locked out for 20 minutes, and for a day if it keeps coming back. Covers the login form, XML-RPC, application passwords and the login forms of WooCommerce, Easy Digital Downloads and other plugins, with a list of current lockouts and a Release button Bans usernames such as “admin” and “root”: an IP address that tries one that no account uses is locked out at once Optional lockdown mode: during a detected attack, accepts logins only from IP addresses each user has logged in from before Moves the login page to an address of your choice, so wp-login.php and wp-admin show a “not found” page to visitors Closes the REST API to visitors who are not logged in, with a list of plugin namespaces that stay open Turns off application passwords, and stops PHP files in the uploads folder from running Detects a login brute-force attack in progress and can email you when one starts Automatically blocks IP addresses that keep hammering your login Optionally rejects login attempts from IP addresses on the bundled lists of known web attackers and anonymous proxies, including Tor exit nodes Stops user enumeration through /?author=N scans, the oEmbed endpoint and the REST API Turns off XML-RPC completely (Jetpack’s own XML-RPC requests are still allowed), or removes only the pingback methods Sends an email whenever an account with administrator rights signs in Hides the WordPress version and removes the RSD and Windows Live Writer header links Hides the website field and the notes text on the comment form IP address management Allow list and block list for single addresses and ranges, IPv4 and IPv6 Finds the visitor’s real IP address behind CloudFlare, Incapsula, Amazon CloudFront, AWS ELB, Rackspace and Sucuri, and lets you register other trusted proxy headers Reports Every blocked attempt is logged to a database table of its own Charts show which forms are attacked most, and a world map shows where attempts come from (the country lookup is done locally) See the submitted content of a blocked attempt (optional, kept for the number of days you choose) Block or unblock an address straight from the reports screen A Dashboard widget with blocked attempts for the last day, week and month, and the forms bots target most Old log entries are deleted automatically after the number of days you choose, or you can turn logging off Everyday details Administrators see a small “protected” note under every form WPBruiser covers, so it is easy to check what is protected (visitors never see it) Test Mode, which emails you about every check so you can confirm protection works before you rely on it Network admin screens for WordPress Multisite Works with full-page caching: the token is requested fresh on every page view The front-end script is a single small file, loaded deferred so it doesn’t hold up page rendering WPBruiser Pro WPBruiser Pro is an add-on from WPZOOM that brings the same invisible check to the form, shop and newsletter plugins most sites run on. It adds its integrations to the Integrations screen you already know, so there is nothing new to learn, and it keeps every check on your own server. Form builders Contact Form 7: blocked messages are marked as spam, so no email is sent WPForms (Lite and Pro): blocked submissions stop before an entry is saved or a notification goes out, with or without AJAX submission Elementor Pro Form widget, and the Login widget whenever login protection is on Gravity Forms: blocked entries go to the form’s Spam list Fluent Forms, including multi-step forms Forminator forms, with or without AJAX submission Ninja Forms Formidable Forms (Lite and Pro), with or without AJAX submission Shop and newsletters WooCommerce: login (on My Account and at checkout), registration, lost and reset password, product reviews, and account creation at checkout on both the classic checkout and the Checkout block Easy Digital Downloads 3.0+: login, registration and lost password forms, login and account creation at checkout, and optional card-testing protection that checks every purchase MailPoet subscription forms wherever they appear: widgets, blocks, shortcodes, pop-ups, slide-ins, fixed bars and below posts. No subscriber is created and no confirmation email is sent for a blocked sign-up. Security Country blocking: reject submissions from the countries you choose, or accept them only from the countries you choose. Countries are looked up locally with current IP-to-country data that ships with each release, plus Cloudflare’s country header on sites behind Cloudflare. Submissions from unknown countries are never rejected, and the screen warns you if your own country would be blocked. Submission rate limits: limit how many protected forms one IP address can submit in a time window (5 every 10 minutes by default). Administrators and IP addresses on your allow list are never limited, and rejected submissions show up in Reports as “Too Many Submissions”. Also included Every Pro integration is switched on automatically for the plugins you already use, on first activation and after each update Blocked attempts from every integration appear in the same Reports screen and Dashboard widget, with the submitted content when you keep it Updates and priority support from the WPZOOM team, with a 14-day money-back guarantee An active license switches the Pro features on; if it expires, they keep working for 14 more days, then the site keeps the free protection until you renew Compare free and Pro, and see the plans External services WPBruiser does not connect to any external service. It makes no remote API requests, collects no telemetry, runs no license or update checks of its own and loads no third-party fonts or scripts. All detection happens on your server, and the IP reputation and country data it uses ship inside the plugin. Support Found a bug or have a question? Start a topic on the WordPress.org support forum. It helps us a lot if you include your WordPress and PHP versions, the form or plugin involved, and the steps that reproduce the problem. Copyright WPBruiser, Copyright (C) 2014-2018 Mihai Chelaru. Modifications and continued development, Copyright (C) 2026 WPZOOM. WPBruiser (formerly GoodBye Captcha) was originally created by Mihai Chelaru and is distributed under the terms of the GNU General Public License, version 2 or (at your option) any later version. The original author’s copyright notices are kept in the source files. WPBruiser bundles the following third-party resources, each under its own license: phpCrypt, Copyright (C) 2005 Ryan Gilfether (GPLv3 or later) phpseclib 0.3.10 (BigInteger), Copyright Jim Wigginton (MIT) Bootstrap 3.4.1 and Glyphicons Halflings, Copyright Twitter, Inc. (MIT) Flot 0.8.3, Copyright IOLA and Ole Laursen (MIT) flot.tooltip 0.8.5, Krzysztof Urbas and Evan Steinkerchner (MIT) jVectorMap 1.2.2, Copyright Kirill Lebedev (MIT) Raphaël 2.3.0, Copyright Dmitry Baranovskiy (MIT) morris.js 0.5.1, Copyright Olly Smith (BSD-2-Clause) Multiselect 2.2.6, Copyright Adrian Crisan (MIT) The Integrations screen shows the icons the integrated plugins publish on WordPress.org (Gravity Forms: the icon of its official Gravity Forms CLI add-on). Plugin names and logos are trademarks of their owners and are used only to identify the integrations.