/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ WP-Ban

WP-Ban

By Lester Chan

Security & Privacy / Security Scanning & Malware Protection

WP-Ban Review - In-Depth Analysis

WP-Ban allows you to ban users by IP, hostname, user agent, and referrer URL. It displays a custom message for banned visitors and tracks their access attempts.

Performance Overview

WPS Score

6.66/10

User Rating

3.7/5 (based on 27+ reviews)

Active Installations

8,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

3 / 10 (Low Risk) It is calculated using the weighted average of all versions.

What It Does

WP-Ban is a powerful plugin that helps you manage access to your WordPress blog by banning users based on their IP address, hostname, user agent, or referrer URL. When a banned user attempts to visit your site, they will see a custom message indicating that access is denied.

The plugin also allows you to exclude specific IP addresses from being banned, providing flexibility in managing your site's visitors. Additionally, WP-Ban records statistics on how many times banned users try to access your blog, giving you insights into potential unwanted traffic.

With support for wildcard matching, you can easily set up bans that cover a range of IP addresses or patterns. This makes WP-Ban an essential tool for maintaining the security and integrity of your WordPress site.

Comparing to Alternatives

WP-Ban is a straightforward IP banning plugin for WordPress, designed to block unwanted visitors. When compared to other security plugins, it offers basic functionality without advanced features.

Top alternatives

Strengths

Simple and easy to configure IP banning.
Effectively blocks unwanted IP addresses.
Lightweight with minimal setup required.

Weaknesses

Lacks advanced security features found in alternatives.
Reported to cause site slowdowns in some cases.
No active development or updates recently.
Limited compatibility with complex login systems.

User Sentiment Analysis

User feedback on WP-Ban is mixed, with some praising its effectiveness and others reporting issues.

Positive highlights

'It works!' - luckyjo
'Successfully blocked multiple IPs from spamming comments.' - kapaemtarik
'Simple tool for banning unwanted visitors.' - general positive tone

Common complaints

Plugin caused site breakage after update.
Slows down admin operations significantly.
Fails to ban IPs as expected.
Does not work with non-default WordPress login setups.

Weaknesses

Unreliable banning functionality for some users.
Performance issues affecting site speed.
Compatibility problems with customized login pages.

Who Should Use This?

Best for

Users seeking a simple and lightweight IP banning solution without needing advanced security features.

Not ideal for

Those requiring robust login security, frequent updates, or compatibility with customized login systems should consider alternatives.

Pricing & Value

Free version includes

The free version provides basic IP banning capabilities suitable for straightforward blocking needs.

Final Verdict

WP-Ban offers a basic IP banning feature set that can be effective for simple use cases but lacks the robustness and reliability of more actively maintained security plugins.

Users should weigh the risk of potential site slowdowns and compatibility issues against their need for a lightweight banning tool before choosing WP-Ban.

Other Notable Features

Here are a few other notable features of this free WP-Ban plugin.

ban

banned

deny

Screenshots

FAQ

Your site is behind a reverse proxy, a load balancer or a CDN such as Cloudflare, so WordPress sees the proxy’s address on every request rather than the visitor’s.

By default WP-Ban only trusts REMOTE_ADDR, because every other header carrying an IP address is set by the client — trusting them unconditionally means anyone can walk past an IP ban by sending a different value on each request. There are two ways to opt in, narrowest first:

Name the exact header in the Header That Contains The IP field on the Settings tab, for example HTTP_X_FORWARDED_FOR, or HTTP_CF_CONNECTING_IP on Cloudflare. Only that header is trusted, and this is the option to use. Ask your host or your CDN’s documentation which header they set if you are not sure.
Define the constant in wp-config.php, which trusts the usual set of forwarding headers rather than one you choose:

define( 'WP_BAN_TRUST_PROXY', true );

For per-request control, filter it. The filter defaults to the constant, so the constant keeps working and the filter gets the last word:

add_filter( 'wp_ban_trust_proxy', function ( $trust ) {     // Only trust the header when the request really came from your balancer.     return '10.0.0.5' === $_SERVER['REMOTE_ADDR']; } );

Do not enable either of these if there is no proxy in front of WordPress: it makes every IP ban trivial to bypass. Naming the one header your own proxy sets and overwrites is always safer than the constant, which trusts seven headers because it cannot know which one is yours.

That is deliberate as of 2.0.0. The ban page used to be served as 200 OK, which told search engines and caches that the ban page was your site’s real content. It is now 403 Forbidden.

If you need the old behaviour back:

add_filter( 'wp_ban_status_code', function () {     return 200; } );

Contributors and developers

“WP-Ban” is open source software. The following people have contributed to this plugin.

Lester Chan

Free Version Docs

WPS

6.66

Average

Ratings

3.7 out of 5 | 27

Version

2.0.0

Last updated

2 weeks ago

Active installations

8,000+

WordPress version

7.0.4 or higher

PHP version

8.2 or higher

Languages

Other plugins you might like

Wordfence Security – Firewall, Malware Scan, and Login Security

By Mark Maunder

WPS

7.74

Very Good

4.7/5

5k+reviews

5M+

active installation

Tested with

7.1

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

By Really Simple Plugins

WPS

7.78

Very Good

4.9/5

8.9k+reviews

3M+

active installation

Tested with

7.0.4

Jetpack – WP Security, Backup, Speed, & Growth

By Automattic

WPS

7.75

Very Good

3.8/5

2.4k+reviews

3M+

active installation

Tested with

7.0.4

Limit Login Attempts Reloaded – Login Security, Brute Force Protection, Firewall

By WPChef

WPS

7.55

Very Good

4.8/5

1.5k+reviews

1M+

active installation

Tested with

7.0.4

Loginizer

By Softaculous

WPS

7.57

Very Good

4.8/5

1k+reviews

1M+

active installation

Tested with

7.0.4

Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms

By bestwebsoft

WPS

6.78

Average

4.6/5

37+reviews

4k+

active installation

Tested with

6.8.8

WP-Ban Review - In-Depth Analysis

Performance Overview

What It Does

Comparing to Alternatives

User Sentiment Analysis

Who Should Use This?

Pricing & Value

Final Verdict

Other Notable Features

Screenshots

FAQ

Contributors and developers

Ratings

Reviews (27)

Sort by:

Contributors & Developers

Interested in development?

Security Status

Secure

No Unpatched Vulnerabilities

Known Vulnerabilities (2)

Previous Versions

WPS

6.66

Other plugins you might like

Wordfence Security – Firewall, Malware Scan, and Login Security

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Jetpack – WP Security, Backup, Speed, & Growth

Limit Login Attempts Reloaded – Login Security, Brute Force Protection, Firewall

Loginizer

Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms