WPBruiser Pro
by WPZOOM
WPBruiser is a WordPress anti-spam plugin that checks every form submission with an invisible token your visitors never see. Bots that post straight to your forms are turned away. No puzzles, no image challenges, no outside service.
Free tool
Our free WordPress Security Scanner checks any site for exposed usernames, an open XML-RPC, closed or abandoned plugins and more, in about ten seconds.
Real visitors fill in your forms exactly as before. Bots that skip the page and post straight to a form are stopped before WordPress ever sees the submission.
When someone opens a page, their browser quietly asks your site for an encrypted token and adds it to every protected form. Real visitors never notice it. A bot that posts straight to your form has no valid token, so the submission is rejected.
Pick what to protect from one Integrations screen: WordPress login, registration, lost password and comments, plus forms from the plugins you already use. New sites are protected from the moment WPBruiser is activated.
WPBruiser spots login attacks as they happen and can block the IP addresses behind them automatically. Keep your own team on an allow list and known offenders on a block list, with IPv4 and IPv6 addresses and ranges.
Reports show every blocked attempt: which form was targeted, where the bot came from and what it tried to send. The Dashboard widget sums up the last day, week and month, so you always know the protection is working.
Everything runs on your own server. WPBruiser loads no outside scripts or fonts, sets no tracking cookies and sends visitor data to no one, so there is nothing new to add to your privacy policy.
Switch protection on per plugin, or per form, from one Integrations screen. Core WordPress forms and popular plugins are free; the most-used form and shop plugins come with Pro.
WPZOOM Forms
All forms, block, shortcode or Elementor
Free
Jetpack Forms
Contact forms
Free
HTML Forms
All forms
Free
Mailchimp for WP
Sign-up forms
Free
Ultimate Member
Login, registration, password reset
Free
WP-Members
Login, registration
Free
WooCommerce
Login, registration, reviews, checkout
Pro
Easy Digital Downloads
Login, registration, checkout, card testing
Pro
Contact Form 7
All forms
Pro
WPForms
All forms, including AJAX
Pro
Elementor Pro
Form and Login widgets
Pro
Gravity Forms
All forms
Pro
Fluent Forms
All forms, including multi-step
Pro
Forminator
All forms, with or without AJAX
Pro
Ninja Forms
All forms
Pro
Formidable Forms
All forms, with or without AJAX
Pro
MailPoet
Sign-up forms, pop-ups included
Pro
See every integration and what it protects
Plugin names and logos are trademarks of their respective owners.
Always let your own team in and keep known offenders out, with IPv4 and IPv6 addresses and ranges.
Finds the real visitor IP behind Cloudflare, Sucuri, Incapsula, Amazon CloudFront and more.
Hide the WordPress version, switch off XML-RPC and stop user enumeration in a few clicks.
Try everything safely: nothing is blocked, and you get an email for each check WPBruiser makes.
The token is fetched fresh on every page view, so cached pages keep working without exclusions.
Network-wide settings and reports for WordPress Multisite, managed from one place.
Reject submissions from the countries you pick, or accept them only from yours. Uses current DB-IP data and Cloudflare's country header.
Stop anyone from flooding your forms: five submissions per IP every ten minutes by default, and you set the limit.
| Feature | Free | Pro |
|---|---|---|
| WordPress login, registration & comments | Included | Included |
| Brute-force protection | Included | Included |
| Reports & Dashboard widget | Included | Included |
| Allow & block lists | Included | Included |
| WPZOOM Forms New | Included | Included |
| Jetpack Forms, HTML Forms, Mailchimp for WP | Included | Included |
| Ultimate Member & WP-Members | Included | Included |
| WooCommerce login, registration & reviews | Not included | Included |
| WooCommerce Checkout & Checkout block New | Not included | Included |
| Easy Digital Downloads New | Not included | Included |
| Contact Form 7 | Not included | Included |
| WPForms | Not included | Included |
| Elementor Pro Form & Login widgets New | Not included | Included |
| Gravity Forms | Not included | Included |
| Fluent Forms & Forminator New | Not included | Included |
| Ninja Forms & Formidable Forms | Not included | Included |
| MailPoet subscription forms | Not included | Included |
| Country blocking | Not included | Included |
| Submission rate limits New | Not included | Included |
| Premium support | Not included | Included |
| Download Free | Get WPBruiser Pro |
Every plan includes all Pro integrations, regular updates and our excellent support.
We're so confident you'll be happy with WPBruiser Pro that we're offering a 14-day money-back guarantee, so you can purchase risk-free.
A CAPTCHA asks people to prove they are human. WPBruiser asks nothing of them: the check happens in the background, so real visitors fill in your forms exactly as before, and bots that post directly to your forms are rejected.
No. WPBruiser adds one small script, loaded so it never holds up the page, and it doesn't call any outside service.
Yes. The token is requested fresh on every page view, so cached pages keep working without any exclusions.
No. Everything runs on your own server. WPBruiser doesn't load outside scripts or fonts and doesn't send visitor data to anyone.
Yes. WPBruiser Pro by WPZOOM keeps the settings and reports of the original Pro integrations, so the forms you protected stay protected.
Yes. The free version is available on WordPress.org, and every purchase comes with a 14-day money-back guarantee.
How WPBruiser differs from other anti-spam tools, with sources for every detail.
