IPScanner – Block Bots, VPNs & Proxies
IPScanner checks each visitor on the server and blocks bots before they reach your forms. Real people never see a challenge. What it stops Fake signups and spam registrations on WordPress and WooCommerce Comment spam and contact form spam Card-testing bots on WooCommerce checkout Login attacks from
About this tool.
IPScanner checks each visitor on the server and blocks bots before they reach your forms. Real people never see a challenge.
What it stops
- Fake signups and spam registrations on WordPress and WooCommerce
- Comment spam and contact form spam
- Card-testing bots on WooCommerce checkout
- Login attacks from bots, Tor and proxies
- VPN and proxy traffic where you don’t want it
IPScanner checks each visitor with the IPScanner API and sorts them into one class: human, verified crawler, AI agent, malicious automation, Tor, VPN, proxy, hosting or privacy relay. You choose which classes to block and where.
Where it checks
- Login, registration and password reset
- Comments
- WooCommerce checkout (classic and block checkout) and account registration
- Contact Form 7 and WPForms submissions
- The whole front end (optional, off by default)
Forms get an error message. Pages get a short 403 page.
How it decides
- Monitor mode records decisions and blocks nothing. Start here.
- Enforce mode blocks the classes you select. The default is malicious automation only.
- With a Site ID from the IPScanner dashboard, mode and per class policy (allow, flag, block) come from the dashboard, and changes apply within 30 seconds.
- Verified search engine and AI crawlers always pass.
- Administrators and the IP addresses or ranges you list are never blocked.
What it costs
Each new visitor check uses 2 requests from your IPScanner allowance. A visitor is checked at most once every 10 minutes. The whole front end check skips static files, the admin area, AJAX, cron and REST requests. Logins, forms and checkout are still checked when they are sent that way, including the WooCommerce block checkout (Store API).
Fail open
If the API is slow (1.5 second timeout by default), unreachable or out of allowance, visitors are allowed and checks pause for a short while.
