Strike First. Block Everything. 100% WordPress Security That Strikes First.

The free version includes IP blacklist/whitelist management, login brute-force protection with automatic lockouts, protected username blocking, activity logging, a dashboard widget, and blocking for 3 countries. Pro adds unlimited country blocking, security and identity hardening, progressive escalation, request rate limiting, auto-blacklist promotion, configurable lockout durations, known crawler verification, daily GeoIP updates, and email notifications. Pro is $9.99/year.

ViperBlock tracks failed login attempts per IP address. After a configurable number of failures (default: 5), the IP is temporarily locked out. Repeated lockouts trigger progressively longer blocks. On Pro, progressive escalation can automatically promote repeat offenders from temporary blocks to permanent bans. You can also configure protected usernames (like "admin") - any IP attempting to log in with a protected username is immediately blocked.

Yes. You can manually add individual IP addresses or CIDR ranges (e.g., 192.168.1.0/24) to the blacklist. You can also whitelist trusted IPs that should always be allowed through. Both lists support CSV import and export for bulk management. IPs that trigger blocking rules are also automatically added to a temporary auto-block list.

Yes. ViperBlock functions as an application-level firewall for WordPress. It intercepts and filters incoming requests based on IP address, country of origin, request patterns, and login behavior. The Pro version adds security hardening rules that block common attack vectors like XML-RPC abuse, directory traversal attempts, backdoor probes, sensitive file access, and PHP execution in the uploads directory.

The mu-plugin (must-use plugin) is a small PHP file that WordPress loads very early - before regular plugins, themes, or most of the WordPress core. This lets ViperBlock block malicious requests before they consume server resources loading the full WordPress stack. It is the same approach used by Wordfence and other security plugins. The mu-plugin is installed and removed automatically; you never need to manage it manually.

No. ViperBlock is designed for minimal performance impact. GeoIP lookups use a local database file (1-5ms per lookup) with transient caching, so repeated lookups for the same IP take less than 1 millisecond. Blocked requests are terminated before WordPress fully loads, which actually reduces server load from hostile traffic. The plugin uses only 3 database tables compared to the 24+ tables used by heavier security plugins.

Only when you explicitly consent. On first activation, ViperBlock asks whether you want to start a Pro trial or use the free version. If you choose free, no external connections are made. If you activate a trial or license, the plugin contacts viperblock.com for license validation (every 72 hours) and GeoIP database downloads. The mu-plugin that handles actual request blocking never contacts external servers.

Go to ViperBlock > License in your WordPress admin. You can start a free 30-day Pro trial to test all features, or purchase a license by clicking here.

The plugin gracefully downgrades to the free tier. Pro-only features (unlimited country blocking, security hardening, rate limiting, progressive escalation) are disabled at runtime - no settings are deleted, so everything is restored instantly if you renew. You receive email reminders at 30 days and 7 days before expiration. Country blocking reverts to the 3-country free tier limit, and GeoIP updates switch from daily to every 30 days.