A CAPTCHA alternative with no puzzle. IPScanner checks each visitor on the server and blocks bots before they reach your forms.<\/p>\n\n
What it stops<\/strong><\/p>\n\n IPScanner checks each visitor with the IPScanner API and sorts them into one class: human, verified crawler, AI agent, malicious automation, Tor, VPN, proxy, hosting or privacy relay. You choose which classes to block and where.<\/p>\n\n Where it checks<\/strong><\/p>\n\n Forms get an error message. Pages get a short 403 page.<\/p>\n\n How it decides<\/strong><\/p>\n\n What it costs<\/strong><\/p>\n\n Each new visitor check uses 2 requests from your IPScanner allowance. A visitor is checked at most once every 10 minutes. Static files, the admin area, AJAX, cron and REST requests are never checked.<\/p>\n\n Fail open<\/strong><\/p>\n\n If the API is slow (1.5 second timeout by default), unreachable or out of allowance, visitors are allowed and checks pause for a short while.<\/p>\n\n Behind a proxy<\/strong><\/p>\n\n Choose Cloudflare or X-Forwarded-For under Visitor IP. Proxy headers are only read from trusted proxy addresses (Cloudflare ranges are built in), so visitors cannot fake their address.<\/p>\n\n This plugin connects to the IPScanner API at https:\/\/ipscanner.io, run by IPScanner. It is required for the plugin to work.<\/p>\n\n Nothing is sent before an API key is saved.<\/p>\n\n Terms of service: https:\/\/ipscanner.io\/terms\nPrivacy policy: https:\/\/ipscanner.io\/privacy<\/p>\n\n Source code: https:\/\/github.com\/ipscanner\/ipscanner-wordpress<\/p>\n\n\n The key can also be set in wp-config.php with No. Visitors never solve a puzzle. The check runs on your server when a form is sent, and blocked visitors get an error message.<\/p><\/dd>\n Yes. The plugin calls the IPScanner API with your API key. Any plan works. On the Free plan, sites managed from the dashboard run in monitor mode.<\/p><\/dd>\n No. Verified search engine and AI crawlers always pass.<\/p><\/dd>\n Visitors are allowed. The plugin waits at most the configured timeout, then pauses checks for 30 seconds.<\/p><\/dd>\n Administrators who log in with the right password are let through while \"Always allow administrators\" is on. You can also add your IP to Always allow, or deactivate the plugin by renaming its folder.<\/p><\/dd>\n Login, registration, comments, checkout and forms are not cached, so those checks always run. Whole site protection only runs for requests that reach WordPress, so pages served from a full page cache are not checked.<\/p><\/dd>\n A first visit waits for one API call (usually well under a second). Repeat visits within 10 minutes use the cached result.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
\n
\n
External services<\/h3>\n\n
\n
POST \/v1\/edge\/check<\/code>. Results are cached on your site for 10 minutes per visitor.<\/li>\nGET \/v1\/sites\/{site}\/policy<\/code>.<\/li>\nGET \/v1\/usage\/summary<\/code>.<\/li>\n<\/ul>\n\n\n
define( 'IPSCANNER_API_KEY', 'pk_live_...' );<\/code>.<\/p>\n\n\n\n
Is it a CAPTCHA?<\/h3><\/dt>\n
Do I need an account?<\/h3><\/dt>\n
Will it block Google or Bing?<\/h3><\/dt>\n
What happens if IPScanner is down?<\/h3><\/dt>\n
I locked myself out.<\/h3><\/dt>\n
Does it work with page caching?<\/h3><\/dt>\n
Does it slow my site down?<\/h3><\/dt>\n
0.1.3<\/h4>\n\n
\n
0.1.2<\/h4>\n\n
\n
0.1.1<\/h4>\n\n
\n
0.1.0<\/h4>\n\n
\n