About this plugin
TSI Visitor Blocker protects your WordPress site from unwanted visitors, spam, and brute-force attacks.
Who Is This For?
- Website owners who want to stop spam form submissions
- E-commerce stores that want to block fraudulent email addresses
- Agencies managing multiple sites that need consistent blocking rules
- Anyone dealing with spam comments, fake registrations, and bot traffic
Key Features
IP & Subnet Blocking
- Block specific IP addresses (IPv4 and IPv6 support)
- Block entire subnets using CIDR notation (e.g., 192.168.1.0/24)
- Useful for blocking entire hosting ranges from known spam providers
Country Blocking
- Block visitors from specific countries using two-letter ISO codes
- Uses ip-api.com for geolocation (cached for 24 hours for performance)
Email & Domain Blocking
- Block specific email addresses (e.g., [email protected])
- Block entire email domains (e.g., tempmail.com)
- Blocks emails in contact forms, registration forms, and comments
Bot & User-Agent Blocking
- Block known bad bots by user-agent string
- Protects your site from scrapers and crawlers
Rate Limiting
- Limit the number of POST requests per IP address
- Configurable max requests and time window
- Prevents brute-force attacks and automated form submissions
AbuseIPDB Integration
- Optionally check incoming IPs against AbuseIPDB’s reputation database
- Requires a free API key from abuseipdb.com
- Automatically blocks IPs with an abuse confidence score above 50
Form & Comment Blocking
- Block form submissions containing blocked emails or domains
- Prevent comments from blocked email addresses or domains
- Works with any WordPress form plugin (Contact Form 7, WPForms, etc.)
Export & Import Settings
- Export all blocking rules to a JSON file
- Import rules on other sites – useful for managing multiple installations
Security
- All input is sanitized and validated
- Nonce verification for all admin operations
- Logged-in editors and admins are always exempt from blocking
How It Works
- Install & Activate – Get started in seconds
- Enable Features – Toggle on the blocking features you need
- Add Your Block Lists – IPs, emails, domains, user-agents, countries
- Set Rate Limits – Configure max requests per IP
- Optional AbuseIPDB – Add your free API key for automated blocking
External Services
This plugin connects to the following third-party services:
ip-api.com
com to determine their country code. The result is cached for 24 hours using WordPress transients. No data is sent when country blocking is disabled.
- Service: https://ip-api.com
- Terms of Service / Legal: https://ip-api.com/docs/legal
- Privacy Policy: https://ip-api.com/docs/legal
AbuseIPDB
When AbuseIPDB integration is enabled and a valid API key has been entered, the visitor’s IP address is sent to the AbuseIPDB API to check its reputation. The result is cached for 24 hours using WordPress transients. No data is sent when this feature is disabled or no API key is configured.
- Service: https://www.abuseipdb.com
- Terms of Service: https://www.abuseipdb.com/legal
- Privacy Policy: https://www.abuseipdb.com/privacy
Additional Resources
- Plugin Website: https://tsidigitalsolution.com/tsi-visitor-blocker
- Support Forum: https://wordpress.org/support/plugin/tsi-visitor-blocker
Credits
Developed and maintained by TSI Digital Solution.
com