by
hafenstudios
1 (0 reviews)
Wellenbrecher
Blocks spam in registrations, WooCommerce checkout, comments and eight form builders. Scored on your own server, no cloud and no captcha.
Wellenbrecher ranks #56,420 among WordPress.org plugins with 1+ active installations, is #2,644 of 4,580 in the Security category, a 1/5 rating from 0 reviews, and was last updated Aug 21, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1
v1.3.2
Current Version v1.3.2
Updated 1 month ago
Last Update on 21 Aug, 2026
Refreshed 17 hours ago
Last Refreshed on
#2,644 of 4,580 in Security
Rank
#56,420
—
No change
Active Installs
1+
-66.7%
KW Avg Position
105
—
No change
Downloads
131
+1 today
Support Resolved
0%
—
No change
Rating
20%
Review 1 out of 5
1
(0 reviews)
Next Milestone 10
0+
10+
55,474
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 8 more installs to reach 10+
Rank Changes
Current
#56,420
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
1.0
0 reviews
Overall
20%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.3.2
- Last Updated
- Aug 21, 2026
- Requires WP
- 6.5+
- Tested Up To
- 7.1
- PHP Version
- 8.1 or higher
- Author
- hafenstudios
Support & Rating
- Rating
- ★ ☆ ☆ ☆ ☆ 1
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,758
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,008
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security - Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#17
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#37
Frequently Asked Questions
Common questions about Wellenbrecher
No. Scoring happens entirely on your server. The plugin makes no outbound request at all, so there is nothing to declare in your privacy policy beyond the data it stores locally.
No. There is no captcha, no puzzle and no checkbox. The signals run in the background, and a visitor without JavaScript is never blocked for that reason alone.
It appears in the log with its score and the rules that fired. Release it, and the entry leaves the list; when the stored submission carries an email address, that sender passes freely for the next 90 days. The submitted values stay in the log entry, so nothing is lost while you decide.
Wellenbrecher bakes nothing dynamic into cached pages. The form token is fetched through a small REST route (/wellenbrecher/v1/token) that sends no-cache headers. Exclude that route from full page caching. A missing token is only one signal among many and never blocks on its own. A Forminator submission was held back and I cannot find it in Forminator That is how Forminator handles a spam verdict: it answers with its own error message and does not store the submission at all, so there is nothing in its own spam folder to look at. The submission is in the Wellenbrecher log with its values and can be released from there.
Yes. The honeypot and the field swap need markup this plugin renders itself, so those two signals fall away; all other rules keep working. One case is worth knowing about, because it adds a rule instead of removing one: if another template on the same site does use the standard comment form, the plugin has proof that its fields render somewhere, and a comment from the hand-built form is then charged 30 points for the missing form token. On its own that stays below the quarantine threshold; together with one further signal, a filled-in website field or a link in a short comment, it can reach it. Such a comment is held for moderation, not rejected, and one click releases it. If you would rather not have that trade at all, give the form-token rule less weight in the settings.
Yes. Product reviews are comments and are covered automatically, the checkout has its own channel, and verified buyers get a trust bonus so their reviews are not held back.
Yes, in the settings. Only the pingback.ping and wp.newComment methods are removed; xmlrpc.php itself stays reachable so that apps and services keep working.
Uninstalling removes the plugin's own tables, options and scheduled task. Comments that WordPress moved to its spam folder stay where they are, because they belong to WordPress.
