內容簡介
WPBruiser 是一款無 CAPTCHA 的防垃圾郵件與登入保護外掛，能有效阻擋自動化表單提交，透過隱藏的令牌來辨識真實用戶，避免垃圾帳號與不必要的管理工作。
【主要功能】
• 阻擋自動化表單提交，保護登入、註冊及評論表單
• 限制失敗登入次數，防止暴力破解攻擊
• 支援多種常用表單外掛，如 WooCommerce 和 Elementor
• 隱藏登入頁面，增強安全性
• 管理 IP 地址，提供允許名單與封鎖名單功能
外掛標籤
開發者團隊
② 後台搜尋「WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection」→ 直接安裝（推薦）
原文外掛簡介
WPBruiser stops automated form submissions before WordPress ever processes them. Every protected form gets a hidden token, which the visitor’s browser requests in the background. A real person never sees it or has to do anything. A bot that posts straight to your login, registration or comment endpoint arrives without a valid token and is turned away.
Because bad submissions are rejected at the door, they never land in your moderation queue and never create junk user accounts. You also don’t have to ask visitors to solve a puzzle, which is often the step where real people give up on a form.
Everything runs on your own server. WPBruiser does not call remote APIs, does not load outside scripts or fonts and does not send your visitors’ data anywhere.
Notice: As of version 3.2.0, it is maintained by WPZOOM.
Forms you can protect
Turn protection on or off for each form on the WordPress and Integrations screens:
WordPress login
WordPress registration
WordPress lost password
WordPress comments, with an optional character limit for the comment, name, email and website fields
Free integrations
Each integration is a card on the Integrations screen, which shows whether its plugin is active on your site and has one switch to turn protection on. On a new install, protection is switched on for every supported plugin that is already active. Login With Ajax and wpDiscuz need no switch of their own: they are covered by the WordPress login and comment protection.
WPZOOM Forms: every form you build with it, placed as a block, a shortcode or an Elementor widget
Ultimate Member: login, registration and password reset forms
WP-Members: login and registration forms
Login With Ajax: its AJAX login, registration and lost password forms
Jetpack: the Jetpack contact form
MC4WP: Mailchimp for WordPress: every sign-up form you build with it
HTML Forms: every form you build with it
wpDiscuz: comments posted through its AJAX comment system
Using Contact Form 7, WPForms, WooCommerce, Easy Digital Downloads, Elementor Pro, Gravity Forms or another popular form plugin? WPBruiser Pro protects them too. See “WPBruiser Pro” below.
Brute-force and hardening tools
Limits failed logins: after 5 failed logins (you choose the number) an IP address is locked out for 20 minutes, and for a day if it keeps coming back. Covers the login form, XML-RPC, application passwords and the login forms of WooCommerce, Easy Digital Downloads and other plugins, with a list of current lockouts and a Release button
Bans usernames such as “admin” and “root”: an IP address that tries one that no account uses is locked out at once
Optional lockdown mode: during a detected attack, accepts logins only from IP addresses each user has logged in from before
Moves the login page to an address of your choice, so wp-login.php and wp-admin show a “not found” page to visitors
Closes the REST API to visitors who are not logged in, with a list of plugin namespaces that stay open
Turns off application passwords, and stops PHP files in the uploads folder from running
Detects a login brute-force attack in progress and can email you when one starts
Automatically blocks IP addresses that keep hammering your login
Optionally rejects login attempts from IP addresses on the bundled lists of known web attackers and anonymous proxies, including Tor exit nodes
Stops user enumeration through /?author=N scans, the oEmbed endpoint and the REST API
Turns off XML-RPC completely (Jetpack’s own XML-RPC requests are still allowed), or removes only the pingback methods
Sends an email whenever an account with administrator rights signs in
Hides the WordPress version and removes the RSD and Windows Live Writer header links
Hides the website field and the notes text on the comment form
IP address management
Allow list and block list for single addresses and ranges, IPv4 and IPv6
Finds the visitor’s real IP address behind CloudFlare, Incapsula, Amazon CloudFront, AWS ELB, Rackspace and Sucuri, and lets you register other trusted proxy headers
Reports
Every blocked attempt is logged to a database table of its own
Charts show which forms are attacked most, and a world map shows where attempts come from (the country lookup is done locally)
See the submitted content of a blocked attempt (optional, kept for the number of days you choose)
Block or unblock an address straight from the reports screen
A Dashboard widget with blocked attempts for the last day, week and month, and the forms bots target most
A weekly or monthly security report by email: what was blocked, the usernames bots tried, and anything that needs your attention
A weekly check of your plugins against WordPress.org, with a warning for any that were closed (often for a security issue) or abandoned, on the Plugins screen and in Site Health
Old log entries are deleted automatically after the number of days you choose, or you can turn logging off
Everyday details
Administrators see a small “protected” note under every form WPBruiser covers, so it is easy to check what is protected (visitors never see it)
Test Mode, which emails you about every check so you can confirm protection works before you rely on it
Network admin screens for WordPress Multisite
Works with full-page caching: the token is requested fresh on every page view
The front-end script is a single small file, loaded deferred so it doesn’t hold up page rendering
WPBruiser Pro
WPBruiser Pro is an add-on from WPZOOM that brings the same invisible check to the form, shop and newsletter plugins most sites run on. It adds its integrations to the Integrations screen you already know, so there is nothing new to learn, and it keeps every check on your own server.
Form builders
Contact Form 7: blocked messages are marked as spam, so no email is sent
WPForms (Lite and Pro): blocked submissions stop before an entry is saved or a notification goes out, with or without AJAX submission
Elementor Pro Form widget, and the Login widget whenever login protection is on
Gravity Forms: blocked entries go to the form’s Spam list
Fluent Forms, including multi-step forms
Forminator forms, with or without AJAX submission
Ninja Forms
Formidable Forms (Lite and Pro), with or without AJAX submission
Shop and newsletters
WooCommerce: login (on My Account and at checkout), registration, lost and reset password, product reviews, and account creation at checkout on both the classic checkout and the Checkout block
Easy Digital Downloads 3.0+: login, registration and lost password forms, login and account creation at checkout, and optional card-testing protection that checks every purchase
MailPoet subscription forms wherever they appear: widgets, blocks, shortcodes, pop-ups, slide-ins, fixed bars and below posts. No subscriber is created and no confirmation email is sent for a blocked sign-up.
Security
Country blocking: reject submissions from the countries you choose, or accept them only from the countries you choose. Countries are looked up locally with current IP-to-country data that ships with each release, plus Cloudflare’s country header on sites behind Cloudflare. Submissions from unknown countries are never rejected, and the screen warns you if your own country would be blocked.
Submission rate limits: limit how many protected forms one IP address can submit in a time window (5 every 10 minutes by default). Administrators and IP addresses on your allow list are never limited, and rejected submissions show up in Reports as “Too Many Submissions”.
Also included
Every Pro integration is switched on automatically for the plugins you already use, on first activation and after each update
Blocked attempts from every integration appear in the same Reports screen and Dashboard widget, with the submitted content when you keep it
Updates and priority support from the WPZOOM team, with a 14-day money-back guarantee
An active license switches the Pro features on; if it expires, they keep working for 14 more days, then the site keeps the free protection until you renew
Compare free and Pro, and see the plans
External services
All spam and bot detection happens on your server. WPBruiser collects no telemetry, runs no license or update checks of its own and loads no third-party fonts or scripts, and the IP reputation and country data it uses ship inside the plugin. Nothing about your visitors is ever sent anywhere.
The one external service is the WordPress.org plugin directory, for the plugin check:
What is sent: the folder names of the plugins installed on your site (for example “contact-form-7”), one request per plugin, to api.wordpress.org. Plugins with an Update URI pointing somewhere other than WordPress.org are not sent. WordPress itself already sends this list to WordPress.org to check for updates.
When: about once a week per plugin, from the daily WP-Cron event, and when you open WPBruiser’s Checkup screen or Tools > Site Health.
Why: to find plugins that WordPress.org has closed or that haven’t been updated in over two years.
You can turn it off with add_filter( 'wpbruiser_plugin_health_enabled', '__return_false' );.
WordPress.org privacy policy.
Support
Found a bug or have a question? Start a topic on the WordPress.org support forum. It helps us a lot if you include your WordPress and PHP versions, the form or plugin involved, and the steps that reproduce the problem.
Copyright
WPBruiser, Copyright (C) 2014-2018 Mihai Chelaru.
Modifications and continued development, Copyright (C) 2026 WPZOOM.
WPBruiser (formerly GoodBye Captcha) was originally created by Mihai Chelaru and is distributed under the terms of the GNU General Public License, version 2 or (at your option) any later version. The original author’s copyright notices are kept in the source files.
WPBruiser bundles the following third-party resources, each under its own license:
phpCrypt, Copyright (C) 2005 Ryan Gilfether (GPLv3 or later)
phpseclib 0.3.10 (BigInteger), Copyright Jim Wigginton (MIT)
Bootstrap 3.4.1 and Glyphicons Halflings, Copyright Twitter, Inc. (MIT)
Flot 0.8.3, Copyright IOLA and Ole Laursen (MIT)
flot.tooltip 0.8.5, Krzysztof Urbas and Evan Steinkerchner (MIT)
jVectorMap 1.2.2, Copyright Kirill Lebedev (MIT)
Raphaël 2.3.0, Copyright Dmitry Baranovskiy (MIT)
morris.js 0.5.1, Copyright Olly Smith (BSD-2-Clause)
Multiselect 2.2.6, Copyright Adrian Crisan (MIT)
The Integrations screen shows the icons the integrated plugins publish on WordPress.org (Gravity Forms: the icon of its official Gravity Forms CLI add-on). Plugin names and logos are trademarks of their owners and are used only to identify the integrations.
