by WPZOOM 4.6 (213 reviews)

WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection

Name: WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection
Rating: 4.6 (213 reviews)
Author: WPZOOM

Security and anti-spam without CAPTCHA. Blocks bots on forms, comments and logins, limits login attempts and hardens WordPress. No outside service.

WPBruiser Security ranks #1,794 among WordPress.org plugins with 10,000+ active installations, is #64 of 2,958 in the Discussion & Community category, a 4.6/5 rating from 213 reviews, and was last updated Oct 24, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v3.6.2 Current Version v3.6.2

Updated 1 week ago Last Update on 24 Oct, 2026

Refreshed 18 hours ago Last Refreshed on

#64 of 2,958 in Discussion & Community Top 5% by installs Downloads -88.6% this week Actively maintained

View on WordPress.org

Rank

#1,794

— No change

Active Installs

10K+

-38.1%

KW Avg Position

22.2

0.2 worse

Downloads

721.3K

+23 today

Support Resolved

80%

— No change

Rating

92%

Review 4.6 out of 5

4.6 (213 reviews)

Next Milestone 20K

Total Progress 52.3%

10K+ 20K+

391

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 4,775 more installs to reach 20K+

Rank Changes

Current #1,794

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.6

213 reviews

Overall 92%

189 (89%)

1 (0%)

5 (2%)

3 (1%)

15 (7%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

80%

Resolution Rate

Security History

Source: WPVulnerability

1 known vulnerability on record · 1 in the last 24 months · checked 1 week ago

Aug 5, 2026 UNPATCHED

WPBruiser – No CAPTCHA Anti-Spam & Login Protection [goodbye-captcha] <= 3.1.43 (unfixed + closed)

CVE-2026-65556 · No fix released

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 3.6.2
Last Updated: Oct 24, 2026
Requires WP: 6.5+
Tested Up To: 7.1.4
PHP Version: 7.4 or higher
Author: WPZOOM

Support & Rating

Rating: ★ ★ ★ ★ ★ 4.6
Reviews: 213
Support Threads: 5
Resolved: 80%

Keywords

Brute Force anti-spam captcha limit login attempts security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

Akismet Anti-spam: Spam Protection

5M+ installs

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Jetpack – AI Agents & MCP, Security, Backup & Analytics

WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

View all Discussion-and-community plugins

TL;DR

AI summary of the plugin's readme

WPBruiser is for WordPress site owners and administrators who want to stop spam and brute force attacks without using captchas. It solves the problem of spam-bot signups, spam comments, and brute force login attempts by identifying bots automatically instead of relying on annoying human-verification challenges.

Login form integration
Register form integration
Forgot Password form integration
Comments form integration
Automatically block IP addresses
Brute force attack detection
Disable XML-RPC service
Compatible with WordPress Multisite

Frequently Asked Questions

Common questions about WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection

No. There is nothing to click, type or solve. The check runs quietly in the browser while the form is on screen.

Yes. The token that proves a submission came from a real browser is generated by a small script. Visitors who have JavaScript turned off will not be able to submit the forms you protect.

Turn on Test Mode in the plugin settings. While it is on, nothing is blocked. Instead, the notification address receives an email for each checked submission, so you can try your own forms and see the result. Turn Test Mode off afterwards. From then on, the Reports screen lists every attempt that was blocked.

No. The script requests a fresh token on every page view. If a cached copy of a page carries an expired security key, the script gets a new one first, so you don't have to exclude any pages from your cache.

The common proxies and CDNs are recognised automatically. For anything else, add the proxy's HTTP header on the proxy headers settings screen. Otherwise every visitor may appear to have the proxy's IP address.

If you mistyped your password too many times, wait for the lockout to end (20 minutes by default) or log in from another connection and press Release on the Security screen. If you moved the login page and lost its address, add define('WPBRUISER_DISABLE_LOGIN_URL', true); to wp-config.php to use wp-login.php again; the address was also emailed to the site admin when you set it. To avoid both, add your own IP address to the allow list. Allowed addresses skip all checks, including the block list. If you can't reach the dashboard, rename the wp-content/plugins/goodbye-captcha folder over FTP or with your host's file manager to deactivate the plugin. Then sign in, rename it back and add your address to the allow list.

Protection for Contact Form 7, WPForms, Elementor Pro forms, Gravity Forms, Fluent Forms, Forminator, Ninja Forms, Formidable Forms, WooCommerce, Easy Digital Downloads and MailPoet, plus country blocking, submission rate limits and priority support. See "WPBruiser Pro" in the description, or the WPBruiser Pro page.

Yes. WPBruiser Pro is an add-on: it adds integrations and security features to this plugin, which keeps doing the checking, the logging and the reports.

Only for the license (activation and a daily check) and updates, which come from wpzoom.com. Every check still runs on your server, and the IP-to-country data ships inside the add-on.

Nothing about your visitors, ever. The only outside request is the weekly plugin check, which sends the names of your installed plugins to the WordPress.org plugin directory, as WordPress itself does for updates. See "External services" in the description. (The optional WPBruiser Pro add-on contacts wpzoom.com for its license and updates, and, only if you set them up, Slack, Telegram or your webhook for the report.)