=== Rabbitproof: Spam Bot Protection ===
Contributors: rabbitproof
Tags: spam, spam bots, contact form spam, woocommerce, comments
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.52
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Blocks spam bots from your comments, sign-ups, checkout and contact forms. No puzzles for your visitors.

== Description ==

Spam bots fill in website forms by themselves: junk comments, fake sign-ups, fake orders and contact form spam. Rabbitproof blocks them, and your real visitors don't notice a thing. There are no puzzles, no ticks and nothing to click.

Rabbitproof needs a Rabbitproof account. It isn't available for websites in the European Union, Norway, Iceland, Liechtenstein, the United Kingdom or Switzerland. You pay nothing to install it or for your first 5,000 requests, and no payment details are needed to start. To keep using it after that, Rabbitproof is a paid service, with no obligation to continue.

= What it protects =

* Comments
* Sign-ups and lost password
* Sign-ins
* WooCommerce checkout and account sign-ups
* Contact Form 7
* WPForms
* Gravity Forms
* Elementor forms
* Fluent Forms

= Features =

* Off, Log only or Block
* Blocked messages kept, never lost
* Visitor unblocking
* Private file protection
* Requests log
* Works with page caching
* Signed-in administrators never blocked
* Your forms keep working if Rabbitproof can't be reached
* Lock to Rabbitproof (Bot Management for WordPress)
* Geoblock by region or country (Bot Management for WordPress)

== Installation ==

1. Install and activate the plugin.
2. Open Rabbitproof in the WordPress menu and press Connect to Rabbitproof.
3. Sign in to your Rabbitproof account, or make one. You come back to WordPress connected.

== Frequently Asked Questions ==

= Will my visitors notice? =

No. There are no puzzles and nothing to click.

= What happens to a message that was blocked? =

It isn't lost. Comments go to your Spam folder. Contact form messages are kept on your website for 30 days, where you can read them and unblock the sender.

= What if Rabbitproof is down? =

Your forms work as normal and your website keeps running.

= Does it work with page caching? =

Yes.

= Do I have to pay to start? =

No. Installing it and your first 5,000 requests cost nothing, and no payment details are needed. To keep using it after that, it's A$5 a month with 25,000 requests included, and you can stop at any time. See rabbitproof.com.au for details.

= Why is Lock to Rabbitproof only on Bot Management for WordPress? =

The lock makes your server answer only visitors that came through Rabbitproof. Only Bot Management for WordPress sends your visitors through Rabbitproof first, so with the plugin on its own the lock would shut everyone out.

== External services ==

This plugin relies on Rabbitproof, a service run by the plugin's authors at rabbitproof.com.au, to tell real visitors from spam bots. It cannot work without it. Nothing is sent to Rabbitproof, and nothing is loaded from it, until you press Connect to Rabbitproof and your website is connected.

What is sent, and when:

* **On your website's pages:** the plugin loads Rabbitproof's script from https://rabbitproof.com.au/v1/rp.js. In the visitor's browser it sends Rabbitproof technical details about the browser and device (for example the browser's version, the screen size and the time zone) and checks the internet address the visitor connects from, including a connection test to p.rabbitproof.com.au. Rabbitproof answers with a pass, kept in a cookie on your website. This is not loaded on Bot Management for WordPress, where Rabbitproof checks visitors before they reach your website.
* **When a form is sent** (comments, sign-ups, sign-ins, lost password, WooCommerce checkout and the form plugins you switch on): your website sends Rabbitproof the visitor's internet address, the form's address, the kind of form, the visitor's pass, whether the visitor is signed in, and, for a post from a service such as a payment provider, which service it says it is. What the visitor typed is never sent.
* **When someone asks your website for a file no visitor needs**, such as a server configuration file: your website sends Rabbitproof their internet address and the address they asked for, at most once an hour for each internet address.
* **Once a day:** your website sends Rabbitproof a list of its page and form addresses, to set up its protection. Rabbitproof may also visit your website's public pages to find its forms.
* **When you use the plugin's settings page:** your website sends and reads your Rabbitproof settings and your Requests list, using your website's keys.
* **When you connect, deactivate or remove the plugin:** your website tells Rabbitproof, so its dashboard shows whether the plugin is connected.

Rabbitproof runs on Cloudflare's network, which has data centres around the world.

* Terms of service: https://rabbitproof.com.au/terms
* Privacy policy: https://rabbitproof.com.au/privacy
* Compliance, including our Data Processing Agreement: https://rabbitproof.com.au/compliance

== Credits ==

Country flags are from flag-icons by Panayiotis Lipiridis (https://github.com/lipis/flag-icons), under the MIT License. The licence is included in assets/flags/LICENSE.txt.

== Changelog ==

= 1.0.52 =
* Endpoints on the Allow list, on every product: addresses that skip every check, such as a booking system that sends your forms for you. Always let through is now Allow, as in the Rabbitproof dashboard.

= 1.0.0 =
* First release.
