Strike First. Block Everything. Runs before WordPress. Blocks before your server blinks.

The free version includes IP blacklist/whitelist management (20 entries per list), login brute-force protection with automatic lockouts, activity logging (7-day retention, 200 entries), a dashboard widget, email notifications, DNS-verified known crawler allowlist, and country blocking for 3 countries. Pro adds unlimited country blocking, protected username blocking (Smart + Strict modes), security and identity hardening, progressive escalation, request rate limiting, auto-blacklist promotion, configurable lockout durations, custom crawler patterns, daily GeoIP updates, and CSV import/export. Pro is $9.99/year.

ViperBlock tracks failed login attempts per IP address. After a configurable number of failures (default: 5), the IP is temporarily locked out. Repeated lockouts trigger progressively longer blocks. On Pro, progressive escalation can automatically promote repeat offenders from temporary blocks to permanent bans. On Pro, you can also configure protected usernames (like "admin") - any IP attempting to log in with a protected username is immediately blocked.

Yes. You can manually add individual IP addresses or CIDR ranges (e.g., 192.168.1.0/24) to the blacklist, up to 20 entries per list on Free (unlimited on Pro). You can also whitelist trusted IPs that should always be allowed through. Pro adds CSV import and export for bulk management. IPs that trigger blocking rules are also automatically added to a temporary auto-block list.

Yes. ViperBlock functions as an application-level firewall for WordPress. It intercepts and filters incoming requests based on IP address, country of origin, request patterns, and login behavior. The Pro version adds security hardening rules that block common attack vectors like XML-RPC abuse, directory traversal attempts, backdoor probes, sensitive file access, and PHP execution in the uploads directory.

The mu-plugin (must-use plugin) is a small PHP file that WordPress loads very early - before regular plugins, themes, or most of the WordPress core. This lets ViperBlock block malicious requests before they consume server resources loading the full WordPress stack. It is the same approach used by other WordPress security plugins. The mu-plugin is installed and removed automatically; you never need to manage it manually.

No. ViperBlock is designed for minimal performance impact. GeoIP lookups use a local database file (1-5ms per lookup) with transient caching, so repeated lookups for the same IP take less than 1 millisecond. Blocked requests are terminated before WordPress fully loads, which actually reduces server load from hostile traffic. The plugin uses only 6 focused database tables instead of the 20+ that bloated security plugins create.

ViperBlock contacts viperblock.com only for two things: license validation (if you activate a trial or Pro license — every 72 hours) and GeoIP database updates (every 30 days on Free, daily on Pro). The mu-plugin that handles actual request blocking never contacts external servers — all blocking decisions happen locally using the GeoIP database on your server. No visitor data, activity logs, or site content is ever transmitted. See our Privacy Policy for full details.

Go to ViperBlock > License in your WordPress admin. You can start a free 30-day Pro trial to test all features, or purchase a license by clicking here.

The plugin gracefully downgrades to the free tier. Pro-only features (unlimited country blocking, security hardening, rate limiting, progressive escalation) are disabled at runtime - no settings are deleted, so everything is restored instantly if you renew. You receive email reminders at 30 days and 7 days before expiration. Country blocking reverts to the 3-country free tier limit, and GeoIP updates switch from daily to every 30 days.