Rupt: Fraud and abuse prevention

Whatever your policies look for. Rupt supplies the signals: how many devices an account touches, whether two of them are active at once, whether the browser is automated, whether the email is disposable, whether the IP is a datacenter or VPN, whether the signup looks like the last twelve signups. You decide which combinations are worth challenging.

Yes. Rupt recognizes the devices behind each account, so when two people use one login it sees concurrent sessions on unrelated devices. A policy on the access trigger challenges the extra viewer and signs the device out if it fails.

Yes. The signup trigger runs before a new account has done anything, with the full fingerprint of the browser that registered it. Policies there catch disposable emails, automated browsers, and people registering their fifth account from the same device.

Yes. The login trigger sees whether the device signing in has ever been on the account before, and where in the world the last session was. A login from an unrecognized device on the other side of the planet is exactly what a policy should challenge.

No. The plugin reads the signed-in WordPress user on its own and hooks into wp_login and user_register.

Yes. Anything that creates a real WordPress user and signs it in is covered, including WooCommerce, MemberPress, Restrict Content Pro, and LearnDash.

The plugin sets DONOTCACHEPAGE on pages it runs on, which every major caching plugin honors. Most caches skip signed-in users anyway.

At your home page, or at the After logout URL you set in Settings → Rupt. Pointing it at a signup or pricing page turns a sign-out into an upgrade prompt.