/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ WP-Ban

WP-Ban

By Lester Chan

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

WP-Ban Review - In-Depth Analysis

WP-Ban allows you to ban users by IP, hostname, user agent, and referrer URL. It displays a custom message for banned visitors and tracks their access attempts.

Performance Overview

WPS Score

6.66/10

User Rating

3.7/5 (based on 27+ reviews)

Active Installations

8,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

3 / 10 (Low Risk) It is calculated using the weighted average of all versions.

What It Does

WP-Ban is a powerful plugin that helps you manage access to your WordPress blog by banning users based on their IP address, hostname, user agent, or referrer URL. When a banned user attempts to visit your site, they will see a custom message indicating that access is denied.

The plugin also allows you to exclude specific IP addresses from being banned, providing flexibility in managing your site's visitors. Additionally, WP-Ban records statistics on how many times banned users try to access your blog, giving you insights into potential unwanted traffic.

With support for wildcard matching, you can easily set up bans that cover a range of IP addresses or patterns. This makes WP-Ban an essential tool for maintaining the security and integrity of your WordPress site.

Comparing to Alternatives

WP-Ban is a plugin designed to block unwanted visitors by banning IP addresses, but it faces competition from several other plugins offering similar or enhanced security features.

Top alternatives

Strengths

Simple and straightforward IP banning functionality
Effective at blocking unwanted robot users and spam comments as noted by users
No cost as it does not have a paid version
Lightweight with minimal features for users wanting basic banning
Has addressed past security vulnerabilities with updates

Weaknesses

Some users report the plugin does not work as expected for banning IP ranges
Recent updates have caused site breakage for some users
Performance issues reported, including slowing down admin operations
Limited features compared to more advanced security plugins

User Sentiment Analysis

With a 3.7 out of 5 rating based on 27 reviews, WP-Ban receives mixed feedback. While a majority of users rate it positively, a significant minority report issues affecting usability and reliability.

Positive highlights

'It works!' - luckyjo
'Nice tool to block robot users and advertising comments' - kapaemtarik
'Love your hardwork!' - luckyjo

Common complaints

Plugin fails to ban IP ranges effectively
Does not work unless default WordPress login is used
Website broke after recent update
Slows down admin operations significantly

Weaknesses

Inconsistent banning functionality
Compatibility issues causing site breakage
Performance degradation when active

Who Should Use This?

Best for

Users seeking a free, simple IP banning plugin without advanced features, and who are comfortable troubleshooting potential issues.

Not ideal for

Sites requiring robust, reliable security with advanced features or those unable to tolerate potential site breakage or performance slowdowns.

Pricing & Value

Free version includes

The free version offers basic IP banning capabilities sufficient for blocking unwanted visitors and spam bots.

Final Verdict

WP-Ban provides basic IP banning functionality that works well for some users, especially those looking for a free and straightforward solution. However, it suffers from inconsistent performance, occasional site breakage after updates, and limited features compared to other security plugins.

Given the presence of known vulnerabilities in past versions and mixed user experiences, users should carefully consider their needs and possibly explore more robust alternatives if reliability and advanced security are priorities.

Other Notable Features

Here are a few other notable features of this free WP-Ban plugin.

ban

banned

deny

Screenshots

FAQ

Your site is behind a reverse proxy, a load balancer or a CDN such as Cloudflare, so WordPress sees the proxy’s address on every request rather than the visitor’s.

By default WP-Ban only trusts REMOTE_ADDR, because every other header carrying an IP address is set by the client — trusting them unconditionally means anyone can walk past an IP ban by sending a different value on each request. There are two ways to opt in, narrowest first:

Name the exact header in the Header That Contains The IP field on the Settings tab, for example HTTP_X_FORWARDED_FOR, or HTTP_CF_CONNECTING_IP on Cloudflare. Only that header is trusted, and this is the option to use. Ask your host or your CDN’s documentation which header they set if you are not sure.
Define the constant in wp-config.php, which trusts the usual set of forwarding headers rather than one you choose:

define( 'WP_BAN_TRUST_PROXY', true );

For per-request control, filter it. The filter defaults to the constant, so the constant keeps working and the filter gets the last word:

add_filter( 'wp_ban_trust_proxy', function ( $trust ) {     // Only trust the header when the request really came from your balancer.     return '10.0.0.5' === $_SERVER['REMOTE_ADDR']; } );

Do not enable either of these if there is no proxy in front of WordPress: it makes every IP ban trivial to bypass. Naming the one header your own proxy sets and overwrites is always safer than the constant, which trusts seven headers because it cannot know which one is yours.

That is deliberate as of 2.0.0. The ban page used to be served as 200 OK, which told search engines and caches that the ban page was your site’s real content. It is now 403 Forbidden.

If you need the old behaviour back:

add_filter( 'wp_ban_status_code', function () {     return 200; } );

Contributors and developers

“WP-Ban” is open source software. The following people have contributed to this plugin.

Lester Chan

Free Version Docs

WPS

6.66

Average

Ratings

3.7 out of 5 | 27

Version

2.0.0

Last updated

2 months ago

Active installations

8,000+

WordPress version

7.0.7 or higher

PHP version

8.2 or higher

Languages

Other plugins you might like

Limit Login Attempts Reloaded – Login Security, Brute Force Protection, Firewall

By WPChef

WPS

7.5

Very Good

4.8/5

1.5k+reviews

1M+

active installation

Tested with

7.1.3

Limit Login Attempts

By Automattic

WPS

7.15

Very Good

4.6/5

202+reviews

300k+

active installation

Tested with

6.2.14

WP fail2ban – Advanced Security

By invisnet

WPS

6.73

Average

4.2/5

71+reviews

60k+

active installation

Tested with

7.1.3

Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms

By bestwebsoft

WPS

6.73

Average

4.6/5

37+reviews

4k+

active installation

Tested with

6.8.11

IP Ban

By Sandor Kovacs

WPS

6.77

Average

4/5

9+reviews

2k+

active installation

Tested with

4.7.38

Banhammer – Monitor Site Traffic, Block Bad Users and Bots

By Jeff Starr

WPS

6.66

Average

4.4/5

19+reviews

1k+

active installation

Tested with

7.1.3

WP-Ban Review - In-Depth Analysis

Performance Overview

What It Does

Comparing to Alternatives

User Sentiment Analysis

Who Should Use This?

Pricing & Value

Final Verdict

Other Notable Features

Screenshots

FAQ

Contributors and developers

Ratings

Reviews (27)

Sort by:

Contributors & Developers

Interested in development?

Security Status

Secure

No Unpatched Vulnerabilities

Known Vulnerabilities (2)

Previous Versions

WPS

6.66

Other plugins you might like

Limit Login Attempts Reloaded – Login Security, Brute Force Protection, Firewall

Limit Login Attempts

WP fail2ban – Advanced Security

Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms

IP Ban

Banhammer – Monitor Site Traffic, Block Bad Users and Bots