Security and anti-spam without CAPTCHA. Blocks bots on forms, comments and logins, limits login attempts and hardens WordPress. No outside service.
Download on WordPress.org · Documentation · WPBruiser Pro · Support Forum
Every protected form gets a hidden token, which the visitor's browser requests in the background. A real person never sees it or has to do anything. A bot that posts straight to your login, registration or comment endpoint arrives without a valid token and is turned away before WordPress processes the submission.
sequenceDiagram
participant V as Visitor's browser
participant S as Your WordPress site
V->>S: Opens a page with a protected form
V->>S: Requests a token in the background
S-->>V: Encrypted token for this page view
V->>S: Submits the form with the token
S->>S: Checks the token
Note over S: Valid: the form is processed as usual<br/>Missing or invalid: rejected and logged
Because bad submissions are rejected at the door, they never land in your moderation queue and never create junk user accounts. Everything runs on your own server: no outside scripts or fonts, and no visitor data sent anywhere. The only outside request is the weekly plugin check, which looks your installed plugins up on the WordPress.org plugin directory.
- WordPress forms: login, registration, lost password and comments, with optional character limits for the comment fields
- Free integrations: WPZOOM Forms, Ultimate Member, WP-Members, Login With Ajax, Jetpack contact form, MC4WP: Mailchimp for WordPress, HTML Forms and wpDiscuz
- One-click setup: the Integrations screen shows which supported plugins are active and switches each on with one click; a new install protects everything it finds
- Works with page caching: the token is requested fresh on every page view, so no pages need excluding
- Login lockouts: an IP address is locked out after too many failed logins, and for longer when it keeps coming back. Covers the login form, XML-RPC, application passwords and other plugins' login forms
- Banned usernames: an IP that tries "admin", "root" and similar names nobody on your site uses is locked out at once
- Lockdown mode (optional): during a detected attack, only IP addresses each user logged in from before can log in
- Custom login URL (optional): move the login page to an address only you know;
wp-login.phpandwp-adminshow a "not found" page to visitors - Brute-force detection: spots an attack in progress, emails you, and can block the IPs behind it
- Optional lists of known web attackers and anonymous proxies, including Tor exit nodes
- Stop user enumeration through
/?author=N, oEmbed and the REST API - Restrict the REST API to logged-in users, with an allow list for plugins that need it
- Turn off XML-RPC or just its pingbacks, turn off application passwords, and block PHP in the uploads folder
- Hide the WordPress version and the RSD and Windows Live Writer links
- Blocked attempts per day and per form, a world map, and the content bots tried to send
- A Dashboard widget with the last day, week and month
- IP allow and block lists (IPv4 and IPv6, ranges and CIDR)
- A weekly or monthly security report by email: what was blocked, the usernames bots tried, and anything that needs attention
- A Checkup screen: what needs attention, which protections are on, and a weekly plugin check that warns about installed plugins WordPress.org closed (often for a security issue) or that are abandoned
- Email alerts for attacks and administrator logins
- Test Mode, to check protection before switching it on for real
WPBruiser Pro is an add-on that brings the same invisible check to more plugins and adds a few security extras:
- Form builders: Contact Form 7, WPForms, Elementor Pro, Gravity Forms, Fluent Forms, Forminator, Ninja Forms and Formidable Forms
- eCommerce: WooCommerce (login, registration, reviews and checkout, including the Checkout block) and Easy Digital Downloads, with card-testing protection
- Newsletters: MailPoet
- Country blocking and submission rate limits
- Priority support from the WPZOOM team
- Go to Plugins > Add New in your WordPress admin
- Search for WPBruiser
- Click Install Now, then Activate
- Download the plugin from WordPress.org
- Upload it to
/wp-content/plugins/goodbye-captcha/ - Activate it on the Plugins screen
cd wp-content/plugins
git clone https://github.com/wpzoom/goodbye-captcha.gitThe folder must be named goodbye-captcha, the plugin's slug on WordPress.org. There's no build step.
- Open WPBruiser > Integrations and check that the forms you use are switched on
- Review the login protection on WPBruiser > Security
- Watch blocked attempts arrive on WPBruiser > Reports
The getting started guide walks through every screen.
WPBruiser has a small extension API for protecting forms it doesn't cover yet. Add the token field to your form, then check the submission in your form's own validation:
// Print the hidden token field inside the form.
add_action( 'my_form_fields', function () {
echo wpbruiser_get_token_field_html(); // already escaped
} );
// Reject the submission when the token check fails.
add_filter( 'my_form_is_spam', function ( $is_spam, $fields ) {
return wpbruiser_verify_submission( 'MyModule', 'IsMyFormActivated', $fields ) ? $is_spam : true;
}, 10, 2 );Modules are registered through the wpbruiser_register_modules filter, which is how WPBruiser Pro adds its integrations. Other hooks include wpbruiser_loaded, wpbruiser_reject_reason and wpbruiser_country_id_for_ip. See the developer reference and engine/wpbruiser-extension-api.php.
- WordPress 6.5 or higher
- PHP 7.4 or higher
- JavaScript in the visitor's browser (for the token)
Please report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team helps with verification and CVE assignment, and notifies us.
Contributions are welcome. Please open a pull request against main:
- Fork the repository
- Create a feature branch (
git checkout -b feature/my-change) - Commit your changes
- Push the branch and open a pull request
Releases are deployed to WordPress.org from this repository with GitHub Actions.
Found a bug? Open an issue.
This repository is for development and is not a support channel. For help, please use the support forum on WordPress.org, or the documentation.
WPBruiser was created by Mihai Chelaru. Since version 3.2.0 it's maintained by WPZOOM.
WPBruiser is licensed under the GPL v2 or later.
Links: WordPress.org | WPBruiser Pro | Documentation | WPZOOM