IPScanner – Block Bots, VPNs & Proxies

A CAPTCHA alternative with no puzzle. IPScanner checks each visitor on the server and blocks bots before they reach your forms. What it stops

• Fake signups and spam registrations on WordPress and WooCommerce
• Comment spam and contact form spam
• Card-testing bots on WooCommerce checkout
• Login attacks from bots, Tor and proxies
• VPN and proxy traffic where you don't want it

IPScanner checks each visitor with the IPScanner API and sorts them into one class: human, verified crawler, AI agent, malicious automation, Tor, VPN, proxy, hosting or privacy relay. You choose which classes to block and where. Where it checks

• Login, registration and password reset
• Comments
• WooCommerce checkout (classic and block checkout) and account registration
• Contact Form 7 and WPForms submissions
• The whole front end (optional, off by default)

Forms get an error message. Pages get a short 403 page. How it decides

• Monitor mode records decisions and blocks nothing. Start here.
• Enforce mode blocks the classes you select. The default is malicious automation only.
• With a Site ID from the IPScanner dashboard, mode and per class policy (allow, flag, block) come from the dashboard, and changes apply within 30 seconds.
• Verified search engine and AI crawlers always pass.
• Administrators and the IP addresses or ranges you list are never blocked.

What it costs Each new visitor check uses 2 requests from your IPScanner allowance. A visitor is checked at most once every 10 minutes. Static files, the admin area, AJAX, cron and REST requests are never checked. Fail open If the API is slow (1.5 second timeout by default), unreachable or out of allowance, visitors are allowed and checks pause for a short while. Behind a proxy Choose Cloudflare or X-Forwarded-For under Visitor IP. Proxy headers are only read from trusted proxy addresses (Cloudflare ranges are built in), so visitors cannot fake their address.

1. Install and activate the plugin.
2. Create an API key at ipscanner.io.
3. Go to Settings > IPScanner, paste the key and choose what to protect.
4. Optional: create a site in the IPScanner dashboard and paste its Site ID under Settings.
5. Leave the mode on Monitor for a few days, check the Overview tab, then switch to Enforce.

The key can also be set in wp-config.php with define( 'IPSCANNER_API_KEY', 'pk_live_...' );.

0.1.3

• Plugin renamed to "IPScanner – Block Bots, VPNs & Proxies".

0.1.2

• Overview tab with connection status, the last 24 hours and recent decisions.
• Getting started card for new sites.
• Settings grouped into sections.
• The "Protected by IPScanner" link on the block page is now off by default.

0.1.1

• API key link opens the API keys page.

0.1.0

• First release: visitor checks with monitor and enforce modes, dashboard site policy, login, registration, password reset, comment, WooCommerce, Contact Form 7 and WPForms protection, allowlist, trusted proxies, recent decisions.