Title: IPScanner – Block Bots, VPNs & Proxies Author: IPScanner Published: October 14, 2026 Last modified: October 14, 2026 --- Search plugins ![](https://ps.w.org/ipscanner-bot-blocker/assets/banner-772x250.png?rev=3746915) ![](https://ps.w.org/ipscanner-bot-blocker/assets/icon.svg?rev=3746892) # IPScanner – Block Bots, VPNs & Proxies By [IPScanner](https://profiles.wordpress.org/ipscanner/) [Download](https://downloads.wordpress.org/plugin/ipscanner-bot-blocker.0.1.3.zip) * [Details](https://wordpress.org/plugins/ipscanner-bot-blocker/#description) * [Reviews](https://wordpress.org/plugins/ipscanner-bot-blocker/#reviews) * [Installation](https://wordpress.org/plugins/ipscanner-bot-blocker/#installation) * [Development](https://wordpress.org/plugins/ipscanner-bot-blocker/#developers) [Support](https://wordpress.org/support/plugin/ipscanner-bot-blocker/) ## Description A CAPTCHA alternative with no puzzle. IPScanner checks each visitor on the server and blocks bots before they reach your forms. **What it stops** * Fake signups and spam registrations on WordPress and WooCommerce * Comment spam and contact form spam * Card-testing bots on WooCommerce checkout * Login attacks from bots, Tor and proxies * VPN and proxy traffic where you don’t want it IPScanner checks each visitor with the IPScanner API and sorts them into one class: human, verified crawler, AI agent, malicious automation, Tor, VPN, proxy, hosting or privacy relay. You choose which classes to block and where. **Where it checks** * Login, registration and password reset * Comments * WooCommerce checkout (classic and block checkout) and account registration * Contact Form 7 and WPForms submissions * The whole front end (optional, off by default) Forms get an error message. Pages get a short 403 page. **How it decides** * Monitor mode records decisions and blocks nothing. Start here. * Enforce mode blocks the classes you select. The default is malicious automation only. * With a Site ID from the IPScanner dashboard, mode and per class policy (allow, flag, block) come from the dashboard, and changes apply within 30 seconds. * Verified search engine and AI crawlers always pass. * Administrators and the IP addresses or ranges you list are never blocked. **What it costs** Each new visitor check uses 2 requests from your IPScanner allowance. A visitor is checked at most once every 10 minutes. Static files, the admin area, AJAX, cron and REST requests are never checked. **Fail open** If the API is slow (1.5 second timeout by default), unreachable or out of allowance, visitors are allowed and checks pause for a short while. **Behind a proxy** Choose Cloudflare or X-Forwarded-For under Visitor IP. Proxy headers are only read from trusted proxy addresses (Cloudflare ranges are built in), so visitors cannot fake their address. ### External services This plugin connects to the IPScanner API at https://ipscanner.io, run by IPScanner. It is required for the plugin to work. * When a protected form is submitted, or a page is viewed with whole site protection on, the plugin sends the visitor’s IP address, user agent and these request headers: Accept, Accept-Language, Accept-Encoding, Sec-CH-UA and Sec-Fetch headers. It also sends a random request ID and your Site ID when one is set. Endpoint: `POST/ v1/edge/check`. Results are cached on your site for 10 minutes per visitor. * With a Site ID set, the plugin reads the site’s policy (no visitor data) at most every 30 seconds. Endpoint: `GET /v1/sites/{site}/policy`. * When an administrator opens Settings > IPScanner (at most every 5 minutes) or clicks Test connection, the plugin reads the plan and usage of the API key (no visitor data). Endpoint: `GET /v1/usage/summary`. Nothing is sent before an API key is saved. Terms of service: https://ipscanner.io/terms Privacy policy: https://ipscanner. io/privacy Source code: https://github.com/ipscanner/ipscanner-wordpress ## Screenshots [⌊Getting started.⌉⌊Getting started.⌉[ Getting started. [⌊Overview: connection, last 24 hours and recent decisions.⌉⌊Overview: connection, last 24 hours and recent decisions.⌉[ Overview: connection, last 24 hours and recent decisions. [⌊Settings.⌉⌊Settings.⌉[ Settings. [⌊The block page a blocked visitor sees.⌉⌊The block page a blocked visitor sees.⌉[ The block page a blocked visitor sees. [⌊A blocked login attempt.⌉⌊A blocked login attempt.⌉[ A blocked login attempt. ## Installation 1. Install and activate the plugin. 2. Create an API key at [ipscanner.io](https://ipscanner.io/dashboard/apikeys). 3. Go to Settings > IPScanner, paste the key and choose what to protect. 4. Optional: create a site in the [IPScanner dashboard](https://ipscanner.io/dashboard/sites) and paste its Site ID under Settings. 5. Leave the mode on Monitor for a few days, check the Overview tab, then switch to Enforce. The key can also be set in wp-config.php with `define( 'IPSCANNER_API_KEY', 'pk_live_...');`. ## FAQ ### Is it a CAPTCHA? No. Visitors never solve a puzzle. The check runs on your server when a form is sent, and blocked visitors get an error message. ### Do I need an account? Yes. The plugin calls the IPScanner API with your API key. Any plan works. On the Free plan, sites managed from the dashboard run in monitor mode. ### Will it block Google or Bing? No. Verified search engine and AI crawlers always pass. ### What happens if IPScanner is down? Visitors are allowed. The plugin waits at most the configured timeout, then pauses checks for 30 seconds. ### I locked myself out. Administrators who log in with the right password are let through while “Always allow administrators” is on. You can also add your IP to Always allow, or deactivate the plugin by renaming its folder. ### Does it work with page caching? Login, registration, comments, checkout and forms are not cached, so those checks always run. Whole site protection only runs for requests that reach WordPress, so pages served from a full page cache are not checked. ### Does it slow my site down? A first visit waits for one API call (usually well under a second). Repeat visits within 10 minutes use the cached result. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “IPScanner – Block Bots, VPNs & Proxies” is open source software. The following people have contributed to this plugin. Contributors * [ IPScanner ](https://profiles.wordpress.org/ipscanner/) [Translate “IPScanner – Block Bots, VPNs & Proxies” into your language.](https://translate.wordpress.org/projects/wp-plugins/ipscanner-bot-blocker) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/ipscanner-bot-blocker/), check out the [SVN repository](https://plugins.svn.wordpress.org/ipscanner-bot-blocker/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/ipscanner-bot-blocker/) by [RSS](https://plugins.trac.wordpress.org/log/ipscanner-bot-blocker/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.1.3 * Plugin renamed to “IPScanner – Block Bots, VPNs & Proxies”. #### 0.1.2 * Overview tab with connection status, the last 24 hours and recent decisions. * Getting started card for new sites. * Settings grouped into sections. * The “Protected by IPScanner” link on the block page is now off by default. #### 0.1.1 * API key link opens the API keys page. #### 0.1.0 * First release: visitor checks with monitor and enforce modes, dashboard site policy, login, registration, password reset, comment, WooCommerce, Contact Form 7 and WPForms protection, allowlist, trusted proxies, recent decisions. ## Meta * Version **0.1.3** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Tags * [anti-spam](https://wordpress.org/plugins/tags/anti-spam/)[bot protection](https://wordpress.org/plugins/tags/bot-protection/) [captcha](https://wordpress.org/plugins/tags/captcha/)[registration spam](https://wordpress.org/plugins/tags/registration-spam/) [vpn blocker](https://wordpress.org/plugins/tags/vpn-blocker/) * [Advanced View](https://wordpress.org/plugins/ipscanner-bot-blocker/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/ipscanner-bot-blocker/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/ipscanner-bot-blocker/reviews/) ## Contributors * [ IPScanner ](https://profiles.wordpress.org/ipscanner/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/ipscanner-bot-blocker/)