Strike First. Block Everything. Runs before WordPress. Blocks before your server blinks.

The free version is complete and uncapped: unlimited country blocking, unlimited IP blacklist/whitelist entries, configurable brute-force and login-flood protection, configurable activity logging, a dashboard widget, email notifications, and a DNS-verified known crawler allowlist. It also detects and alerts you to security hardening probes, 404 scanner activity, and username attacks. Pro automatically blocks those detected threats, and adds Allow-only country mode, protected username enforcement (Smart + Strict modes), progressive escalation, request rate limiting, auto-blacklist promotion, page restrict mode, custom block responses, trusted IP management, CSV import/export, Quick Setup presets, and daily GeoIP updates. Pro is $9.99/year.

ViperBlock tracks failed login attempts per IP address. After a configurable number of failures (default: 5), the IP is temporarily locked out for your configured duration. On Pro, progressive escalation lengthens each repeat block and can automatically promote repeat offenders from temporary blocks to permanent bans. On Pro, you can also configure protected usernames (like "admin") - any IP attempting to log in with a protected username is immediately blocked.

Yes. You can manually add individual IP addresses or CIDR ranges (e.g., 192.168.1.0/24) to the blacklist, with no limit on the number of entries. You can also whitelist trusted IPs that should always be allowed through. Pro adds CSV import and export for bulk management. IPs that trigger blocking rules are also automatically added to a temporary auto-block list.

Yes. ViperBlock functions as an application-level firewall for WordPress. It intercepts and filters incoming requests based on IP address, country of origin, request patterns, and login behavior. Both versions detect common attack vectors like XML-RPC abuse, directory traversal attempts, backdoor probes, sensitive file access, and PHP execution in the uploads directory, logging them and alerting you by email. The Pro version blocks them automatically.

The mu-plugin (must-use plugin) is a small PHP file that WordPress loads very early - before regular plugins, themes, or most of the WordPress core. This lets ViperBlock block malicious requests before they consume server resources loading the full WordPress stack. It is the same approach used by other WordPress security plugins. The mu-plugin is installed and removed automatically; you never need to manage it manually.

No. ViperBlock is designed for minimal performance impact. GeoIP lookups use a local database file (1-5ms per lookup) with transient caching, so repeated lookups for the same IP take less than 1 millisecond. Blocked requests are terminated before WordPress fully loads, which actually reduces server load from hostile traffic. The plugin uses only 4 focused database tables, with no scanning infrastructure.

The free version contacts viperblock.com for one thing only: GeoIP database updates, at most once every 90 days, and only after you consent on the setup screen following activation. It sends no license key and no site data - both calls are plain GET requests with an empty body. Pro additionally validates its license key every 72 hours and updates the GeoIP database daily. The mu-plugin that handles actual request blocking never contacts external servers — all blocking decisions happen locally using the GeoIP database on your server. No visitor data, activity logs, or site content is ever transmitted. See our Privacy Policy for full details.

Purchase a license by clicking here. You will receive a download link and a license key. Install the Pro plugin from Plugins > Add New > Upload Plugin in your WordPress admin, then activate it with your key.

Pro features are disabled and the plugin continues running with its free feature set - no settings are deleted, so everything is restored instantly if you renew. You receive email reminders at 30 days and 7 days before expiration. GeoIP updates switch from daily to every 90 days.