Rabbitproof: Spam Bot Protection

Spam bots fill in website forms by themselves: junk comments, fake sign-ups, fake orders and contact form spam. Rabbitproof blocks them, and your real visitors don’t notice a thing. There are no puzzles, no ticks and nothing to click.

What it protects

• Comments
• Sign-ups and lost password
• Sign-ins
• WooCommerce checkout and account sign-ups
• Contact Form 7
• WPForms
• Gravity Forms
• Elementor forms
• Fluent Forms

Features

• Form spam protection
• Comment spam protection
• Brute force login protection
• Fake account protection
• Automated browser detection
• Proxy and VPN detection
• Multi-connection device detection
• Repeat offender blocking
• Shared bot blocklist
• Direct POST protection
• Scanner and private file blocking

Rabbitproof needs a Rabbitproof account, which you make when you connect. Installing it and your first 5,000 requests cost nothing, with no payment details needed. After that it’s a paid service, and you can stop at any time.

Need more? Bot Management for WordPress checks every visitor before they reach your website, with geoblocking, content scraping protection and origin protection.

External services

This plugin relies on Rabbitproof, a service run by the plugin’s authors at rabbitproof.com.au, to tell real visitors from spam bots. It cannot work without it. Nothing is sent to Rabbitproof, and nothing is loaded from it, until you press Connect to Rabbitproof and your website is connected.

What is sent, and when:

• On your website’s pages: the plugin loads Rabbitproof’s script from https://rabbitproof.com.au/v1/rp.js. In the visitor’s browser it sends Rabbitproof technical details about the browser and device (for example the browser’s version, the screen size and the time zone) and checks the internet address the visitor connects from, including a connection test to p.rabbitproof.com.au. Rabbitproof answers with a pass, kept in a cookie on your website. This is not loaded on Bot Management for WordPress, where Rabbitproof checks visitors before they reach your website.
• When a form is sent (comments, sign-ups, sign-ins, lost password, WooCommerce checkout and the form plugins you switch on): your website sends Rabbitproof the visitor’s internet address, the form’s address, the kind of form, the visitor’s pass, whether the visitor is signed in, the browser’s name and brand details it sent with the form (its user agent and client hints), and, for a post from a service such as a payment provider, which service it says it is. What the visitor typed is never sent.
• When someone asks your website for a file no visitor needs, such as a server configuration file: your website sends Rabbitproof their internet address and the address they asked for, at most once an hour for each internet address.
• Once a day: your website sends Rabbitproof a list of its page and form addresses, to set up its protection. Rabbitproof may also visit your website’s public pages to find its forms.
• When you use the plugin’s settings page: your website sends and reads your Rabbitproof settings and your Requests list, using your website’s keys.
• When you connect, deactivate or remove the plugin: your website tells Rabbitproof, so its dashboard shows whether the plugin is connected.

Rabbitproof runs on Cloudflare’s network, which has data centres around the world.

• Terms of service: https://rabbitproof.com.au/terms
• Privacy policy: https://rabbitproof.com.au/privacy
• Compliance, including our Data Processing Agreement: https://rabbitproof.com.au/compliance

Credits

Country flags are from flag-icons by Panayiotis Lipiridis (https://github.com/lipis/flag-icons), under the MIT License. The licence is included in assets/flags/LICENSE.txt.