Requires a Rupt v3 client ID. Your existing client ID keeps working, but settings moved to Settings \u2192 Rupt and you need at least one policy in the Rupt dashboard for challenges to fire.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3744561,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3744561,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3744561,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3744561,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3744561,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["2.1.1"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[257402,22770,132861,1932,600],"plugin_category":[54,58],"plugin_contributors":[286525],"plugin_business_model":[],"class_list":["post-385678","plugin","type-plugin","status-publish","hentry","plugin_tags-account-sharing","plugin_tags-bot-detection","plugin_tags-fraud-prevention","plugin_tags-membership","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_category-user-management","plugin_contributors-ahmedrupt","plugin_committers-ahmedrupt"],"banners":{"banner":"https:\/\/ps.w.org\/rupt-fraud-and-abuse-prevention\/assets\/banner-772x250.png?rev=3744561","banner_2x":"https:\/\/ps.w.org\/rupt-fraud-and-abuse-prevention\/assets\/banner-1544x500.png?rev=3744561","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/rupt-fraud-and-abuse-prevention\/assets\/icon.svg?rev=3744561","icon":"https:\/\/ps.w.org\/rupt-fraud-and-abuse-prevention\/assets\/icon.svg?rev=3744561","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"\n
Rupt is a fraud and abuse prevention platform. It identifies the device, browser, and person behind every account on your site, works out how much you can trust them, and challenges the ones you can't.<\/p>\n\n
WordPress hands you accounts and nothing else. It cannot tell a paying member from a bot, a stolen login from the real owner, or one password quietly making the rounds in a group chat. This plugin closes that gap.<\/p>\n\n
The plugin reports what happens on your site. Your policies, which live in the Rupt dashboard rather than here, decide what to do about it. A policy has a trigger (the event it runs on) and a verdict (allow, challenge, or deny).<\/p>\n\n
Rupt scores every event against the device, browser, IP, email, phone, and behavior behind it. When a policy fires, Rupt runs a challenge (SMS, email, or biometric) and signs the device out if it fails.<\/p>\n\n
access<\/code> on every front-end page view by a signed-in user.<\/li>\nlogin<\/code> on the first page a user loads after signing in.<\/li>\nsignup<\/code> on the first page a newly registered user loads.<\/li>\n- Any custom action you queue from PHP or fire from JavaScript.<\/li>\n<\/ul>\n\n
Custom actions<\/h4>\n\n
Queue an evaluation from PHP and it runs on the next page the user loads:<\/p>\n\n
rupt_evaluate('purchase', ['metadata' => ['order_id' => $order_id]]);\n<\/code><\/pre>\n\nOr run one immediately from JavaScript:<\/p>\n\n
window.rupt.evaluate('purchase', { metadata: { order_id: '1234' } });\n<\/code><\/pre>\n\nFilters<\/h4>\n\n\nrupt_should_run<\/code>: return false to skip Rupt on a request.<\/li>\nrupt_load_for_visitors<\/code>: return true to load the script for signed-out visitors.<\/li>\nrupt_user_metadata<\/code>: change the metadata attached to the signed-in user.<\/li>\nrupt_loader_config<\/code>: change the whole loader config before it is printed.<\/li>\n<\/ul>\n\nExternal services<\/h4>\n\n
This plugin sends data to Rupt, a third-party fraud and abuse prevention service, so that Rupt can identify the devices and people using each account.<\/p>\n\n
The plugin loads a script from cdn.rupt.dev<\/code> on your front end. That script sends the signed-in user's WordPress user ID, email address, display name, roles, optional phone number, page URL, and device and browser characteristics to the Rupt API at ap3.rupt.dev<\/code> (or the API domain you set in Settings \u2192 Rupt<\/strong>) on page views, logins, and registrations.<\/p>\n\nService provided by Rupt: terms of service<\/a>, privacy policy<\/a>.<\/p>\n\n\n\n- Install and activate the plugin.<\/li>\n
- Go to Settings \u2192 Rupt<\/strong> and paste the client ID from your Rupt dashboard<\/a>. Use a production client ID on a live site.<\/li>\n
- Create at least one policy in your policies dashboard<\/a>. Without a policy every evaluation comes back
allow<\/code> and nobody is ever challenged.<\/li>\n<\/ol>\n\n\n\nWhat does this actually catch?<\/h3><\/dt>\nWhatever your policies look for. Rupt supplies the signals: how many devices an account touches, whether two of them are active at once, whether the browser is automated, whether the email is disposable, whether the IP is a datacenter or VPN, whether the signup looks like the last twelve signups. You decide which combinations are worth challenging.<\/p><\/dd>\n
Does this stop password sharing on WordPress?<\/h3><\/dt>\nYes. Rupt recognizes the devices behind each account, so when two people use one login it sees concurrent sessions on unrelated devices. A policy on the access<\/code> trigger challenges the extra viewer and signs the device out if it fails.<\/p><\/dd>\nDoes it stop fake signups and bots?<\/h3><\/dt>\nYes. The signup<\/code> trigger runs before a new account has done anything, with the full fingerprint of the browser that registered it. Policies there catch disposable emails, automated browsers, and people registering their fifth account from the same device.<\/p><\/dd>\nDoes it stop account takeover?<\/h3><\/dt>\nYes. The login<\/code> trigger sees whether the device signing in has ever been on the account before, and where in the world the last session was. A login from an unrecognized device on the other side of the planet is exactly what a policy should challenge.<\/p><\/dd>\nDo I need to change my theme or login form?<\/h3><\/dt>\nNo. The plugin reads the signed-in WordPress user on its own and hooks into wp_login<\/code> and user_register<\/code>.<\/p><\/dd>\nDoes it work with WooCommerce and membership plugins?<\/h3><\/dt>\nYes. Anything that creates a real WordPress user and signs it in is covered, including WooCommerce, MemberPress, Restrict Content Pro, and LearnDash.<\/p><\/dd>\n
Does it work with a page cache?<\/h3><\/dt>\nThe plugin sets DONOTCACHEPAGE<\/code> on pages it runs on, which every major caching plugin honors. Most caches skip signed-in users anyway.<\/p><\/dd>\nWhere does a signed-out device end up?<\/h3><\/dt>\nAt your home page, or at the After logout URL<\/strong> you set in Settings \u2192 Rupt<\/strong>. Pointing it at a signup or pricing page turns a sign-out into an upgrade prompt.<\/p><\/dd>\n\n<\/dl>\n\n\n2.1.1<\/h4>\n\n\n- Readme and header updates for the WordPress.org directory: tested up to WordPress 7.1, license header matches the readme (GPLv2 or later), Plugin URI points at the setup guide.<\/li>\n
- The loader script URL carries the plugin version so browsers pick up a fresh copy after an update.<\/li>\n
- Sign-out redirects use wp_safe_redirect(), with the After logout URL's host allowed so off-site pricing pages keep working.<\/li>\n<\/ul>\n\n
2.0.0<\/h4>\n\n\n- Rewritten for the Rupt v3 API.<\/li>\n
- Adds
login<\/code> and signup<\/code> evaluations alongside page-view access<\/code>, so the plugin covers account takeover and fake signups, not just account sharing.<\/li>\n- Adds custom actions through
rupt_evaluate()<\/code> in PHP and window.rupt.evaluate()<\/code> in JavaScript.<\/li>\n- Moves settings from the General page to their own Settings \u2192 Rupt<\/strong> page.<\/li>\n
- Signs devices out through a nonce-protected endpoint instead of an unguarded URL.<\/li>\n
- Adds an API domain setting for sites that proxy Rupt through their own domain.<\/li>\n
- Removes the v2
window.Rupt.attach()<\/code> global. Use window.rupt.evaluate()<\/code> instead.<\/li>\n<\/ul>\n\n1.0.1<\/h4>\n\n\n- Added a phone number meta key setting and a dedicated logout route.<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- First release.<\/li>\n<\/ul>","raw_excerpt":"Know which users and agents you can trust. Stop fake accounts, bots, account takeover, and account sharing on your WordPress site.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/385678","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=385678"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/ahmedrupt"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=385678"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=385678"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=385678"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=385678"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=385678"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=385678"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}