WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection

Changelog

3.6.1

• Fixed: with Ultimate Member 2.6.7 or later, every login through an Ultimate Member form was refused once its protection was on. Ultimate Member moved the form’s details to a second argument of its validation hooks; WPBruiser now reads them from there (and still works with older versions). A refused submission shows Ultimate Member’s own error notice. Thanks to Mykyta Synelnikov of the Ultimate Member team for the patch and the pointers.
• Fixed: on a translated site, links to WPBruiser’s screens (on the Checkup screen, in the security report and on the Dashboard widget) led to «Sorry, you are not allowed to access this page». The screens’ addresses were built from their translated names; they now stay the same in every language (wp-bruiser-settings and so on), and old translated addresses redirect to the new ones.
• Fixed: on the Settings screen, the number of days in the log settings and most of the text in the Trusted Proxy Headers box couldn’t be translated.

3.6.0

• New: Checkup screen. One page with everything that needs your attention, every WPBruiser protection grouped by area with whether it’s on and a link to turn it on, and the status of each installed plugin on WordPress.org.
• New: plugin check. Once a week WPBruiser looks up your installed plugins on the WordPress.org plugin directory and warns you about any that were closed (often for a security issue) or haven’t been updated in over two years. Closed plugins no longer get security fixes, and even an inactive one can be a way in. You’ll find them on the Checkup screen, under the plugin on the Plugins screen, in Site Health, on the Dashboard widget and in the security report. Premium and custom plugins that aren’t in the directory are skipped.
• Improved: the security report also says when other plugins have updates waiting.
• New: a Preview email button next to «Send a test report», which opens the report in a new tab.
• For developers: new filters wpbruiser_plugin_health_enabled, to turn the plugin check off, and wpbruiser_checkup_protections, to add to the Checkup screen’s list.

3.5.0

• New: security report email. Once a week or once a month, WPBruiser emails you what it blocked (with the change from the previous period), the forms bots went for, the IP addresses and usernames they used, and anything that needs your attention: Test Mode left on, an active form plugin that isn’t protected, an update waiting or a Pro license about to run out. Choose how often on the Notifications screen, where you can also send a test report. New sites get it weekly; on existing sites it starts off, and a one-time notice offers to turn it on.
• Improved: the attack, administrator sign-in and Test Mode emails have a new, cleaner design that reads well on phones.
• Fixed: the administrator sign-in email greeted «Hi ,» when the account had no first or last name.
• The plugin is now called WPBruiser Security, since it covers login security and WordPress hardening as well as spam. Same plugin, same settings.
• For developers: new filters wpbruiser_report_frequencies, wpbruiser_report_data, wpbruiser_report_checks and wpbruiser_email_recipients, and actions wpbruiser_report_sent and wpbruiser_report_email_sections.

3.4.0

• New: login lockouts. After 5 failed logins in 12 hours (you choose the number), an IP address is locked out for 20 minutes, and for 24 hours after its 4th lockout in a day. They cover the login form, XML-RPC, application passwords and the login forms of other plugins (WooCommerce, Easy Digital Downloads and any plugin that uses WordPress’ own login). Allow-listed IP addresses are never locked out, nothing is locked out in Test Mode, and the Security screen lists current lockouts with a Release button. On by default, also on existing sites.
• New: banned usernames. An IP address that tries «admin», «administrator», «root» and similar names that no account on your site uses is locked out at once. You can edit the list.
• New, optional: lock out IP addresses that try any username that doesn’t exist, and a lockdown mode that, during a detected brute-force attack, accepts logins only from IP addresses each user has logged in from before.
• New: Reports show lockouts as «Too Many Failed Logins», «Banned Username» and «Login Lockdown».
• New, optional: a custom login URL. wp-login.php and, for visitors who are not logged in, wp-admin show a «not found» page; every login, logout and password reset link follows the new address, and it is emailed to the site admin when you set it. define('WPBRUISER_DISABLE_LOGIN_URL', true); in wp-config.php turns it off.
• New, optional: close the REST API to visitors who are not logged in. oEmbed, Contact Form 7, the WooCommerce Store API, Jetpack, LiteSpeed and Wordfence stay open by default, and you can add other namespaces.
• New, optional: turn off application passwords, and block PHP files in the uploads folder (Apache and LiteSpeed; the rules are removed again when you switch the option off or deactivate WPBruiser).
• Fix: Easy Digital Downloads’ lost password form was rejected while WordPress lost password protection was on, because the form never received WPBruiser’s token. It does now.
• New: an «Upgrade to Pro» item at the bottom of the WPBruiser menu, and every Pro link now leads to a page made for people already using the free plugin. Both disappear once WPBruiser Pro is active.
• New: a Documentation button in the Support box, linking to the new WPBruiser documentation on wpzoom.com.
• New: an Easy Digital Downloads card on the Integrations screen (protected with WPBruiser Pro).
• New: with WPBruiser Pro active, the sidebar shows that your site is protected: which plugins’ forms are checked, attempts blocked in the last 30 days, and whether the Pro license is active. When the license has expired or isn’t activated, the box, the Integrations cards and the Security screen say what is switched off and link to renew or activate it.
• New: the Security screen shows WPBruiser Pro’s country blocking and submission rate limit settings, locked, so you can see what Pro adds there.
• Improved: a lighter look for the settings screens, with underlined tabs, on/off switches instead of checkboxes and more spacing in the lists of accepted IP formats.
• Fix: the WPBruiser Dashboard widget showed its title at the far end of the header, away from its icon.
• Developer: an integration’s form can be marked as opt-in (‘EnableByDefault’ => false), so it is never switched on automatically or by the card’s main switch. When a form ends up with the token field twice, every copy is now filled.

3.3.1

• New: WPZOOM Forms integration, free. Every form is protected whether it is placed as a block, with the [wpzf_form] shortcode or as an Elementor widget; a blocked submission is stopped before any email is sent or entry is stored, and Reports show its fields under their labels.

3.3.0

• New: protection is on from the start. A new install protects WordPress login, registration, lost password and comments, plus every supported plugin that is already active.
• New: a Dashboard widget with blocked attempts for the last day, week and month, and the forms bots target most.
• New: administrators see a small «protected» note under every form WPBruiser covers, so it is easy to check what is protected. Visitors never see it, and it can be hidden in Settings.
• Fix: about one genuine visitor in ten could be rejected on any protected form. On sites without the old mcrypt extension (every PHP 7.2+ site), the bundled cipher library added no padding when the compressed token filled its last block exactly, and then removed real data from the end while decrypting. Tokens now always decrypt; 10,000 test round trips had no failures.
• New: an Integrations screen. Every integration, free and Pro, is a card that shows whether its plugin is active, with a switch to turn protection on or off (and a switch per form where there are several), plus filters and search. It replaces the separate Contact Forms, Membership, eCommerce and Others screens.
• New: an extension API for add-ons such as WPBruiser Pro. An add-on registers its own protection modules through the wpbruiser_register_modules filter and protects a form with wpbruiser_get_token_field_html(), wpbruiser_is_option_enabled() and wpbruiser_verify_submission(). Each add-on loads its own code; WPBruiser still only loads files from its own folder.
• New: the wpbruiser_loaded action, and the wpbruiser_country_id_for_ip filter for supplying your own IP-to-country data.
• New: the wpbruiser_reject_reason filter, which lets an add-on reject a submission that passed every other check (WPBruiser Pro uses it for rate limits), and add-on settings boxes on the Security screen.
• New: wpbruiser_get_token_field_names(), so integrations can keep the token fields out of stored submissions, and a wpbruiser:token browser event fired when a form receives its token, for forms that submit as JSON.
• Fix: Jetpack contact forms. Blocked submissions kept no fields in Reports, current Jetpack versions (which renamed the form class) were not recognised, and older ones could hit a PHP error on a blocked submission.
• Fix: a lost password request that fails the check now shows an error on the form. It used to redirect to the login page, which also broke WooCommerce’s lost password form.
• The Contact Forms, Membership, eCommerce and Others screens now list modules added by add-ons. The eCommerce screen stays hidden until an add-on adds a module to it.
• Removed leftover references to the old paid extensions from the settings screens, the AJAX setup and brute-force login detection.
• New: the WPBruiser ninja, redrawn as a vector icon, on every WPBruiser screen, in the admin menu (tinted to match your admin colour scheme) and in the Dashboard widget.
• New: Settings and Get Pro links on the Plugins screen, and a WPBruiser Pro box in the settings sidebar that lists the Pro integrations and points out which of those plugins are active on your site. Both disappear once WPBruiser Pro is active.

3.2.1

• Audited every third-party integration against the plugin directory and removed those whose plugin is gone: ZM Ajax Login & Register (closed 2023), PlanSo Forms (closed 2021), UltraCommunity (30 installs, last updated 2020) and Seamless Donations (last updated 2024, tested only to 6.4). Support for the Epoch comments iframe was removed as well; that plugin has not been updated since 2015. The readme no longer lists Postmatic and WP User Control, both closed, and now lists HTML Forms and WP-Members, which are supported but were never mentioned.
• Bootstrap updated from 3.2.0 to 3.4.1
• Raphaël updated from 2.1.2 to 2.3.0 (minified build). The bundled morris.js was already the project’s final 0.5.1 release under an upstream banner that still read 0.5.0; the banner now states the real version and the file’s provenance.
• The client script is now a static file loaded with wp_enqueue_script() (deferred) and configured with wp_localize_script(). Previous versions printed an inline loader that fetched a PHP-generated script through a ?gdbc-client= parameter handled before WordPress had finished loading, which also required including pluggable.php by hand. The token endpoint is now a registered wp_ajax_nopriv_ action, and a nonce that has expired in a page-cached copy of a page is refreshed by the script through a second registered action, so page caches need no special handling.
• Forms injected by AJAX (Ultimate Member, ZM Ajax Login & Register) are detected with a MutationObserver; the inline «refresh tokens» scripts that used to travel with their markup are gone.
• The brute-force «site under attack» flag is stored as a transient. The plugin no longer writes any files: the file cache (which could fall back to wp-content itself), its .htaccess/index.php guards and seven unused cache back ends were removed.
• Every settings callback registered with register_setting() now runs the submitted values through a whitelist that drops unknown keys and coerces each field by its declared type before any module-specific validation.
• Admin styles that were printed inline from the settings partials and the Reports modal moved into the enqueued stylesheet; the Reports map data is localized instead of printed as an inline script.
• The browser fingerprint posted with each token request is unslashed and validated field by field; nonces are unslashed and sanitised before wp_verify_nonce(); a dead URL helper that read $_SERVER unsanitised was removed.

Fixed
– Made an implicitly nullable constructor parameter explicit and replaced a non-canonical cast, both deprecated by PHP 8.4/8.5.
– Upgrade routines and first-run defaults run on the init action instead of plugins_loaded, which removes the last remaining trigger of the «translation loading was triggered too early» notice on brand-new installs.
– A fresh installation now creates its attempts table, token secret and module defaults on activation. Table creation used to happen only inside the 1.x-to-2.0 upgrade step, which new installs correctly skip, so a brand-new install ended up with no table at all.

3.2.0

Security
– Fixed an unauthenticated PHP Object Injection vulnerability (CVE-2026-65556). The Ultimate Member integration deserialized attacker-controlled POST data (custom_fields) without restricting object instantiation, which could be chained with a POP gadget in WordPress, this plugin or another installed component to perform destructive actions or execute code. Reported via Patchstack.
– Hardened every remaining deserialization call in the plugin so that PHP objects can never be instantiated from stored, submitted or remotely fetched data.
– Removed all outbound requests to the discontinued vendor service, including a license-activation request that was sent with TLS certificate verification disabled. The plugin no longer contacts any external server.
– Removed the external module-loading code path, which searched other installed plugins’ directories and executed PHP files found there. The plugin now only loads code that ships inside its own directory.
– Added direct-access (ABSPATH) protection to all plugin PHP files.
– Escaped all remaining output, including the client user agent shown in test-mode notification emails, which was previously written into the email unescaped.

Internationalization
– Every translatable string now passes a literal goodbye-captcha text domain instead of a PHP constant. WordPress.org can only extract strings from literal domains, so previously none of the plugin’s ~356 strings could be translated at all.
– The declared text domain now matches the plugin slug, and bundled translations are loaded from the correct directory. The previous release looked for them in a folder that never existed.
– Replaced concatenated and interpolated translation strings with sprintf() placeholders so they can be translated correctly in every language.

Removed
– The newsletter subscription form, its bundled MailChimp submission library and its AJAX endpoint. The form was already unreachable and pointed at a mailing list that is no longer operated.
– The Extensions and Licenses admin pages, the licensing modules and the self-hosted plugin updater. These supported paid add-ons that are no longer distributed, and every endpoint they used is gone.
– Promotional links to the discontinued vendor website throughout the admin interface, the notification emails and the readme. That domain no longer belongs to the project.

Fixed
– PHP 8 notice: «spl_autoload_register(): Argument #2 ($do_throw) has been ignored». The deprecated argument is no longer passed.
– PHP 8 warning: «The magic method MchGdbcBasePublicPlugin::__wakeup() must have public visibility». The method is now public and throws, which both silences the warning and keeps the class from being rebuilt from serialized data.
– WordPress 6.7 notice: «Translation loading for the wp-bruiser domain was triggered too early». Admin page titles and notice messages are now built on the init action instead of plugins_loaded, so no translation function runs before init.
– The admin stylesheets no longer restyle html and body. Previous versions overrode the WordPress admin font, text colour and background on the plugin’s screens; admin pages now inherit WordPress’ own typography.
– Brute force monitoring now starts on the init action instead of while the plugin file is still loading. It reached the translated settings metadata, which was the remaining cause of the «translation loading was triggered too early» notice on every request carrying POST data.
– Fresh installations no longer run the 1.x to 3.x upgrade routines. The saved version was left unset on a new install, and because an unset version compares lower than every release, every historical migration step ran against a brand new database. This also removes the version_compare(): Passing null deprecation notices on PHP 8.1 and later.
– Fixed the Reports screen crashing when a blocked ZM Ajax Login Register attempt was inspected: the handler was an unfinished debug statement that dumped the raw object and stopped the page.

Coding standards
– The plugin now passes the WordPress Plugin Check with no outstanding errors or warnings. Where a rule genuinely does not apply — inspecting nonce-less public form submissions, querying the plugin’s own custom table, comparing anti-spam tokens byte-for-byte — the exception is annotated in the code with the reason.
– Escaped every remaining output, added the missing translators: comments, and replaced _e() with esc_html_e()/esc_attr_e().
– Replaced discouraged functions: date() with gmdate(), strip_tags() with wp_strip_all_tags(), json_encode() with wp_json_encode(), parse_url() with wp_parse_url(), mt_rand() with wp_rand(), and wp_redirect() with wp_safe_redirect().
– Added wp_unslash() and sanitisation to request data that lacked it, and stopped writing sanitised values back into $_POST.
– Removed leftover debug code, including a print_r() that dumped a raw object and halted the Reports page whenever a blocked ZM Ajax Login Register attempt was viewed.
– Removed hidden files and the superseded client script from the package.

Maintenance
– Declared Requires at least, Requires PHP and the plugin license in the plugin header.
– Raised the minimum supported WordPress version to 4.7, which is what the REST API calls in the brute-force module actually need.
– Raised the minimum supported PHP version to 7.0.
– Updated Tested up to for current WordPress.
– Support links now point to the WordPress.org support forum.

The releases below, 3.1.43 and earlier, were published by the plugin’s original author, Mihai Chelaru.

3.1.43

• Fixed PHP 7.4 warnings
• Refreshed Country IPs
• Refreshed WebAttackers IPs
• Refreshed Proxy IPs
• Refreshed Incapsula, Amazon and Cloudflare trusted IPs ranges

3.1.40

Fixes
– Ajax call javascript error

3.1.39

• Refreshed Country IPs
• Refreshed WebAttackers IPs
• Refreshed Proxy IPs
• Refreshed Incapsula, Amazon and Cloudflare trusted IPs ranges

3.1.38

Fixes
– Compatibility with Mailchimp for WordPress
– PHP 7.4 warnings

Improvements
– Refreshed Country IPs
– Refreshed WebAttackers IPs
– Refreshed Proxy IPs
– Refreshed Incapsula, Amazon and Cloudflare trusted IPs ranges

3.1.37

Improvements
– Refreshed Country IPs
– Refreshed WebAttackers IPs
– Refreshed Proxy IPs
– Refreshed Incapsula, Amazon and Cloudflare trusted IPs ranges

3.1.36

Fixes
– Compatibility with latest JetPack Contact Form

3.1.35

Improvements
– Refreshed Country IPs
– Refreshed WebAttackers IPs
– Refreshed Proxy IPs
– Refreshed Incapsula, Amazon and Cloudflare trusted IPs ranges

3.1.34

Improvements
– Refreshed Incapsula, Amazon and Cloudflare trusted IPs ranges

3.1.33

Fixes
– The plugin does not have a valid header issue

3.1.32

Improvements
– Refreshed Incapsula, Amazon and Cloudflare trusted IPs ranges

3.1.31

Improvements
– Refreshed Country IPs
– Refreshed WebAttackers IPs
– Refreshed Proxy IPs
– Refreshed Incapsula, Amazon and Cloudflare trusted IPs ranges

3.1.30

• Fixed fatal error when using PHP 5.3.x

3.1.29

Refreshed Incapsula, Amazon and Cloudflare trusted IPs ranges

3.1.28

Fixes
– Fixed ajax compatibility with Ultra Community – User Profiles & Membership Plugin

Improvements
– Introducing new Extension – WPBruiser WPForms Protection

3.1.27

Improvements
– Refreshed Incapsula, Amazon and Cloudflare trusted IPs ranges

3.1.26

Improvements
– Refreshed Country IPs
– Refreshed WebAttackers IPs
– Refreshed Proxy IPs
– Compatibility with WordPress 5.1

3.1.22

• Fixed compatibility with version 2.x of Ultra Community – User Profile & Membership Plugin

3.1.21

Improvements
– Refreshed Country IPs
– Refreshed WebAttackers IPs
– Refreshed Proxy IPs

3.1.19

• Fixed compatibility with UM 2.X

3.1.18

• Fixed PHP 7.1.x warnings and compatibility with PHP 7.2

3.1.15

Fixes
– Fixed the incompatibility with Gravity Forms Extension

3.1.14

Improvements
– Integrated with HTML Forms Plugin

3.1.12

Fixes
– PHP7 warnings

Improvements
– Refreshed Country IPs
– Refreshed WebAttackers IPs
– Refreshed Proxy IPs

3.1.11

• Fixed the PHP notice issue reported by @devonostendorf[https://wordpress.org/support/topic/php-notice-wpdbprepare-was-called-incorrectly-generated-in-wp-core-v4-8-3/]

3.1.9

• Added integration with MailChimp Top Bar

3.1.6

Improvements
* Added integration with Ultra Community Membership plugin

Fixes
– A plugin vulnerability reported by Wordfence team

3.1.4

Fixes
– PHP7 warnings

Improvements
– Refreshed Country IPs
– Refreshed WebAttackers IPs
– Refreshed Proxy IPs

3.1.3

Improvements
– Prevent oEmbed and WP Rest API user enumeration.

3.1.1

Fixes
– Compatibility with MailChimp for WP version 4.0.4 and up.

3.1

Fixes

• Compatibility with MailChimp for WP version 4.0.6 and up
• Compatibility with WordPress MU Domain Mapping plugin
• Fixed Password reset protection for WooCommerce
• Refreshed Country IPs

3.0.15

Improvements

• Compatibility with Avada theme
• Refreshed Country IPs
• Refreshed WebAttackers IPs
• Refreshed Proxy IPs

3.0.14

Fixes

• Fixed the issue when protection for WooCommerce registration form was conflicting with protection for Standard WordPress registration

3.0.12

• Refreshed Country IPs
• Refreshed WebAttackers IPs
• Refreshed Proxy IPs

Improvements

• Improved loading speed
• Improved detection algorithm

3.0.11

Improvements
– Improved proxy detection feature

3.0.10

• Refreshed Country IPs
• Refreshed WebAttackers IPs
• Refreshed Proxy IPs

Additions

• Ability to register trusted proxy headers
• Email Notification when a user with Admin Capabilities has signed in

New Premium Extensions

• Country Blocking Extension
• Easy Forms for MailChimp Extension
• Easy Digital Downloads Extension
• AffiliateWP

3.0.9

Fixing repository issues

3.0.7

• Refreshed Country IPs
• Refreshed WebAttackers IPs
• Refreshed Proxy IPs

3.0.6

Fixed corrupted files from WordPress Repository

3.0.5

• Fixed JavaScript error –
  Uncaught TypeError: Cannot read property ‘call’ of undefined
  Thanks to James Revillini

3.0.4

Fixes
– W3TC refresh cache notice – reported by Todd and roxchou
– bbPress menu disappear when WPBruiser is active – reported by N3k0

Additions
– Integration with wpDiscuz
– WooCommerce Extension

3.0.3

Fixes
– Compatibility with Query Monitor plugin
– Block Web Attackers IPs and Block Anonymous Proxy IPs options are getting deactivated
– Refreshed WebAttackers IPs
– Refreshed Proxy IPs

3.0.2

• Removed jQuery dependency
• Added protection for Ultimate Member Modal Login
• Compatibility with WordPress 4.5 for Max Comments Fields Length
• Refreshed Country IPs
• Refreshed WebAttackers IPs
• Refreshed Proxy IPs

3.0.1

Improvements

• Ability to set up the Fields Maximum Length for each comment form field
• Added Extensions page
• Added languages folder to support translations
• Added a new filter wpbruiser-scripts-in-head – to explicitly render WPBruiser’s script in head or footer

3.0

• Added IPv4 to country lookup

Introducing premium extensions

• Contact Form 7
• Gravity Forms
• Ninja Forms
• Formidable Forms
• Fast Secure Contact Form
• BuddyPress
• MemberPress

2.2.2

• Removed the MaxMind GeoIP Databases due to the licensing terms violation

2.2.1

• Fixed MySql error reported by WHSajid

2.2.0

• Fixed issue when WPBruiser blocks post requests from some Amazon proxy servers
• Fixed blocked content extra slashes
• Improved Brute Force attacks detection
• Refreshed dangerous IPs lists

2.1.0

• Now GoodByeCaptcha is WPBruiser
• Fixed Disable Trackbacks/Pingbacks issue reported by sixer
• Added compatibility with WP Deferred JavaScripts plugin
• Fixed warning notice reported by Sucuri

2.0.1

Fixes
– Compatibility with Login With Ajax plugin
– Compatibility with Google Apps Login plugin
– Compatibility with WP-Rocket plugin
– Compatibility with Autoptimize plugin
– Compatibility with Theme My Login plugin

2.0

Additions
– New admin interface
– Network admin interface
– Brute-Force protection
– White-list IPs
– Black-list IPs
– WordPress tweaks