WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection

Using Contact Form 7, WPForms, WooCommerce, Easy Digital Downloads, Elementor Pro, Gravity Forms or another popular form plugin? WPBruiser Pro protects them too. See “WPBruiser Pro” below.

Brute-force and hardening tools

• Limits failed logins: after 5 failed logins (you choose the number) an IP address is locked out for 20 minutes, and for a day if it keeps coming back. Covers the login form, XML-RPC, application passwords and the login forms of WooCommerce, Easy Digital Downloads and other plugins, with a list of current lockouts and a Release button
• Bans usernames such as “admin” and “root”: an IP address that tries one that no account uses is locked out at once
• Optional lockdown mode: during a detected attack, accepts logins only from IP addresses each user has logged in from before
• Moves the login page to an address of your choice, so wp-login.php and wp-admin show a “not found” page to visitors
• Closes the REST API to visitors who are not logged in, with a list of plugin namespaces that stay open
• Turns off application passwords, and stops PHP files in the uploads folder from running
• Detects a login brute-force attack in progress and can email you when one starts
• Automatically blocks IP addresses that keep hammering your login
• Optionally rejects login attempts from IP addresses on the bundled lists of known web attackers and anonymous proxies, including Tor exit nodes
• Stops user enumeration through /?author=N scans, the oEmbed endpoint and the REST API
• Turns off XML-RPC completely (Jetpack’s own XML-RPC requests are still allowed), or removes only the pingback methods
• Sends an email whenever an account with administrator rights signs in
• Hides the WordPress version and removes the RSD and Windows Live Writer header links
• Hides the website field and the notes text on the comment form

IP address management

• Allow list and block list for single addresses and ranges, IPv4 and IPv6
• Finds the visitor’s real IP address behind CloudFlare, Incapsula, Amazon CloudFront, AWS ELB, Rackspace and Sucuri, and lets you register other trusted proxy headers

Reports

• Every blocked attempt is logged to a database table of its own
• Charts show which forms are attacked most, and a world map shows where attempts come from (the country lookup is done locally)
• See the submitted content of a blocked attempt (optional, kept for the number of days you choose)
• Block or unblock an address straight from the reports screen
• A Dashboard widget with blocked attempts for the last day, week and month, and the forms bots target most
• A weekly or monthly security report by email: what was blocked, the usernames bots tried, and anything that needs your attention
• A weekly check of your plugins against WordPress.org, with a warning for any that were closed (often for a security issue) or abandoned, on the Plugins screen and in Site Health
• Old log entries are deleted automatically after the number of days you choose, or you can turn logging off

Everyday details

• Administrators see a small “protected” note under every form WPBruiser covers, so it is easy to check what is protected (visitors never see it)
• Test Mode, which emails you about every check so you can confirm protection works before you rely on it
• Network admin screens for WordPress Multisite
• Works with full-page caching: the token is requested fresh on every page view
• The front-end script is a single small file, loaded deferred so it doesn’t hold up page rendering

WPBruiser Pro

WPBruiser Pro is an add-on from WPZOOM that brings the same invisible check to the form, shop and newsletter plugins most sites run on. It adds its integrations to the Integrations screen you already know, so there is nothing new to learn, and it keeps every check on your own server.

Form builders

• Contact Form 7 : blocked messages are marked as spam, so no email is sent
• WPForms (Lite and Pro): blocked submissions stop before an entry is saved or a notification goes out, with or without AJAX submission
• Elementor Pro Form widget , and the Login widget whenever login protection is on
• Gravity Forms : blocked entries go to the form’s Spam list
• Fluent Forms , including multi-step forms
• Forminator forms, with or without AJAX submission
• Ninja Forms
• Formidable Forms (Lite and Pro), with or without AJAX submission

Shop and newsletters

• WooCommerce : login (on My Account and at checkout), registration, lost and reset password, product reviews, and account creation at checkout on both the classic checkout and the Checkout block
• Easy Digital Downloads 3.0+: login, registration and lost password forms, login and account creation at checkout, and optional card-testing protection that checks every purchase
• MailPoet subscription forms wherever they appear: widgets, blocks, shortcodes, pop-ups, slide-ins, fixed bars and below posts. No subscriber is created and no confirmation email is sent for a blocked sign-up.

Security

• Country blocking : reject submissions from the countries you choose, or accept them only from the countries you choose. Countries are looked up locally with current IP-to-country data that ships with each release, plus Cloudflare’s country header on sites behind Cloudflare. Submissions from unknown countries are never rejected, and the screen warns you if your own country would be blocked.
• Submission rate limits : limit how many protected forms one IP address can submit in a time window (5 every 10 minutes by default). Administrators and IP addresses on your allow list are never limited, and rejected submissions show up in Reports as “Too Many Submissions”.

Also included

• Every Pro integration is switched on automatically for the plugins you already use, on first activation and after each update
• Blocked attempts from every integration appear in the same Reports screen and Dashboard widget, with the submitted content when you keep it
• Updates and priority support from the WPZOOM team, with a 14-day money-back guarantee
• An active license switches the Pro features on; if it expires, they keep working for 14 more days, then the site keeps the free protection until you renew

Compare free and Pro, and see the plans

External services

All spam and bot detection happens on your server. WPBruiser collects no telemetry, runs no license or update checks of its own and loads no third-party fonts or scripts, and the IP reputation and country data it uses ship inside the plugin. Nothing about your visitors is ever sent anywhere.

The one external service is the WordPress.org plugin directory, for the plugin check:

• What is sent: the folder names of the plugins installed on your site (for example “contact-form-7”), one request per plugin, to api.wordpress.org. Plugins with an Update URI pointing somewhere other than WordPress.org are not sent. WordPress itself already sends this list to WordPress.org to check for updates.
• When: about once a week per plugin, from the daily WP-Cron event, and when you open WPBruiser’s Checkup screen or Tools > Site Health.
• Why: to find plugins that WordPress.org has closed or that haven’t been updated in over two years.
• You can turn it off with add_filter( 'wpbruiser_plugin_health_enabled', '__return_false' ); .
• WordPress.org privacy policy .

Support

Found a bug or have a question? Start a topic on the WordPress.org support forum . It helps us a lot if you include your WordPress and PHP versions, the form or plugin involved, and the steps that reproduce the problem.

Copyright

WPBruiser, Copyright (C) 2014-2018 Mihai Chelaru. Modifications and continued development, Copyright (C) 2026 WPZOOM.

WPBruiser (formerly GoodBye Captcha) was originally created by Mihai Chelaru and is distributed under the terms of the GNU General Public License, version 2 or (at your option) any later version. The original author’s copyright notices are kept in the source files.

WPBruiser bundles the following third-party resources, each under its own license:

• phpCrypt, Copyright (C) 2005 Ryan Gilfether (GPLv3 or later)
• phpseclib 0.3.10 (BigInteger), Copyright Jim Wigginton (MIT)
• Bootstrap 3.4.1 and Glyphicons Halflings, Copyright Twitter, Inc. (MIT)
• Flot 0.8.3, Copy