Description
Rupt is a fraud and abuse prevention platform. It identifies the device, browser, and person behind every account on your site, works out how much you can trust them, and challenges the ones you can’t.
WordPress hands you accounts and nothing else. It cannot tell a paying member from a bot, a stolen login from the real owner, or one password quietly making the rounds in a group chat. This plugin closes that gap.
What it protects
- Onboarding. Fake signups, disposable and invalid emails, bots, multi-accounting, and ban evasion, caught at registration.
- Login. Account takeover and credential stuffing, caught when a stranger signs into a real member’s account.
- Content. Account sharing, paywall bypass, and scraping, caught on every page view.
- Payments. Card testing, risky transactions, and coupon abuse, on any checkout action you choose to evaluate.
How it works
The plugin reports what happens on your site. Your policies, which live in the Rupt dashboard rather than here, decide what to do about it. A policy has a trigger (the event it runs on) and a verdict (allow, challenge, or deny).
Rupt scores every event against the device, browser, IP, email, phone, and behavior behind it. When a policy fires, Rupt runs a challenge (SMS, email, or biometric) and signs the device out if it fails.
What the plugin sends
accesson every front-end page view by a signed-in user.loginon the first page a user loads after signing in.signupon the first page a newly registered user loads.- Any custom action you queue from PHP or fire from JavaScript.
Custom actions
Queue an evaluation from PHP and it runs on the next page the user loads:
rupt_evaluate('purchase', ['metadata' => ['order_id' => $order_id]]);
Or run one immediately from JavaScript:
window.rupt.evaluate('purchase', { metadata: { order_id: '1234' } });
Filters
rupt_should_run: return false to skip Rupt on a request.rupt_load_for_visitors: return true to load the script for signed-out visitors.rupt_user_metadata: change the metadata attached to the signed-in user.rupt_loader_config: change the whole loader config before it is printed.
External services
This plugin sends data to Rupt, a third-party fraud and abuse prevention service, so that Rupt can identify the devices and people using each account.
The plugin loads a script from cdn.rupt.dev on your front end. That script sends the signed-in user’s WordPress user ID, email address, display name, roles, optional phone number, page URL, and device and browser characteristics to the Rupt API at ap3.rupt.dev (or the API domain you set in Settings Rupt) on page views, logins, and registrations.
Service provided by Rupt: terms of service, privacy policy.
Installation
- Install and activate the plugin.
- Go to Settings Rupt and paste the client ID from your Rupt dashboard. Use a production client ID on a live site.
- Create at least one policy in your policies dashboard. Without a policy every evaluation comes back
allowand nobody is ever challenged.
FAQ
-
What does this actually catch?
-
Whatever your policies look for. Rupt supplies the signals: how many devices an account touches, whether two of them are active at once, whether the browser is automated, whether the email is disposable, whether the IP is a datacenter or VPN, whether the signup looks like the last twelve signups. You decide which combinations are worth challenging.
-
Does this stop password sharing on WordPress?
-
Yes. Rupt recognizes the devices behind each account, so when two people use one login it sees concurrent sessions on unrelated devices. A policy on the
accesstrigger challenges the extra viewer and signs the device out if it fails. -
Does it stop fake signups and bots?
-
Yes. The
signuptrigger runs before a new account has done anything, with the full fingerprint of the browser that registered it. Policies there catch disposable emails, automated browsers, and people registering their fifth account from the same device. -
Does it stop account takeover?
-
Yes. The
logintrigger sees whether the device signing in has ever been on the account before, and where in the world the last session was. A login from an unrecognized device on the other side of the planet is exactly what a policy should challenge. -
Do I need to change my theme or login form?
-
No. The plugin reads the signed-in WordPress user on its own and hooks into
wp_loginanduser_register. -
Does it work with WooCommerce and membership plugins?
-
Yes. Anything that creates a real WordPress user and signs it in is covered, including WooCommerce, MemberPress, Restrict Content Pro, and LearnDash.
-
Does it work with a page cache?
-
The plugin sets
DONOTCACHEPAGEon pages it runs on, which every major caching plugin honors. Most caches skip signed-in users anyway. -
Where does a signed-out device end up?
-
At your home page, or at the After logout URL you set in Settings Rupt. Pointing it at a signup or pricing page turns a sign-out into an upgrade prompt.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Rupt: Fraud and abuse prevention” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Rupt: Fraud and abuse prevention” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.1.1
- Readme and header updates for the WordPress.org directory: tested up to WordPress 7.1, license header matches the readme (GPLv2 or later), Plugin URI points at the setup guide.
- The loader script URL carries the plugin version so browsers pick up a fresh copy after an update.
- Sign-out redirects use wp_safe_redirect(), with the After logout URL’s host allowed so off-site pricing pages keep working.
2.0.0
- Rewritten for the Rupt v3 API.
- Adds
loginandsignupevaluations alongside page-viewaccess, so the plugin covers account takeover and fake signups, not just account sharing. - Adds custom actions through
rupt_evaluate()in PHP andwindow.rupt.evaluate()in JavaScript. - Moves settings from the General page to their own Settings Rupt page.
- Signs devices out through a nonce-protected endpoint instead of an unguarded URL.
- Adds an API domain setting for sites that proxy Rupt through their own domain.
- Removes the v2
window.Rupt.attach()global. Usewindow.rupt.evaluate()instead.
1.0.1
- Added a phone number meta key setting and a dedicated logout route.
1.0.0
- First release.