What it does

• Keeps spam and automated bots out of your forms: fake sign-ups, contact form spam and fake orders. Every product
• Spots bots using proxies and VPNs, and remembers the computers behind them, so they are filtered on every Rabbitproof website. Every product
• Shows you why each visitor was blocked, and lets you unblock anyone from your dashboard. Every product
• Refuses scanners looking for your secret files. WordPress Plugin and Bot Management
• Locks your server's back door, so bots cannot go round Rabbitproof. Lock your server Bot Management
• You choose which known bots get in: search engines, link previews, AI crawlers and more. Bot Management
• Geoblock: blocks visitors from the regions and countries you choose, including through proxies and VPNs. Bot Management
• Checks visitors on every page, which helps keep bots from copying your products, prices or listings. Bot Management

Spam a person types in by hand is a different problem: keep your spam filter for that.

Three ways to connect

• Any other website: Bot and Spam Protection. Paste one line into your website. Add Rabbitproof to your website
• On WordPress: the WordPress Plugin. Install it and press Connect to Rabbitproof. Install the WordPress plugin
• Bot Management: protects your whole website, WordPress included, with two records where you manage your domain. Point your address at us

Get going in three steps

1. Make an account on rabbitproof.com.au with your email and a password, then open the link we email you. On WordPress you can skip this: install the plugin and press Connect to Rabbitproof, and you make your account on the way.
2. Add your website and choose a product. The WordPress Plugin starts straight away; the others start once a payment method is set up.
3. Connect it: add the Rabbitproof code to your website, or install the WordPress plugin. On Bot Management, prove the website is yours and point your address at us.

Once it is connected, the Overview tab shows the visitors checked, the bots blocked and the latest requests, Requests lists everything, Protection holds every rule, and the Allow list holds everything you let through.

Way 1: a DNS record

Where you manage your domain name (often where you bought it), add this record. Your dashboard shows your own value under Connect your site.

Then press Check again in your dashboard. If it is not found yet, try again later: changes to your domain usually show within an hour, but can take up to 48 hours.

Add a DNS record

Way 2: point your address at us

On Bot Management, pointing your address at us proves the website is yours and connects it in one step.

1. Download the plugin. It's also under Connect your site in your dashboard.
2. In WordPress, go to Plugins, then Add New, then Upload Plugin. Choose the file, then Install Now and Activate.
3. Open Rabbitproof in the WordPress menu and press Connect to Rabbitproof. Sign in, or make an account if you're new, and you come back to WordPress connected.
4. That is all. The plugin proves the website is yours by itself, and starts on Log only. Switch to Block them under Protection when you are ready.

• It protects comments, sign-ups, sign-ins, contact forms, and WooCommerce checkout and accounts. Choose which on the Forms tab, which also shows the spam each one kept out this week.
• A refused message is never lost. Comments go to your Spam folder, where you can read them and press Not Spam. Messages from WPForms, Elementor forms, Fluent Forms and Contact Form 7 are kept on your own website for 30 days and can be read on the plugin's Requests tab. Unblock the sender and the message is emailed to you, to reply from there. Fluent Forms also puts them in its own spam list. Gravity Forms puts them only in its own spam list, and with the Flamingo plugin installed, Contact Form 7 messages go to Flamingo instead. Nothing a visitor typed is ever sent to us.
• If another spam check on your website already caught something, Rabbitproof leaves it alone, so nothing is checked or counted twice. The plugin's Overview tells you how many spam bots got past your other spam protection this billing period.
• If your own sign-in is ever refused, switch to Log only on your Rabbitproof dashboard, which is not behind your WordPress sign-in, and unblock yourself from its Requests tab.
• It also turns away bots hunting for your website's private files, the ones that hold your settings and passwords, and keeps them out for an hour. Where your server allows it, the plugin also makes sure those files are never sent to anyone, even if they exist. If your server needs a hand with that, the plugin shows a few lines to send to your host. It is on to start with; switch it off under Protection if you need to.
• It counts requests: each time a visitor is checked, the report their browser sends back, and each form sent to your website. What counts
• A$5 a month includes 25,000 requests. No payment method is needed to start: the first 5,000 requests are not billed. Extra goes on your next bill. What it costs.
• If you remove the website from your Rabbitproof account, the plugin says so when you open it, stops checking, and lets your forms through as normal. Press Connect to Rabbitproof to protect it again.

What to paste

In your Rabbitproof dashboard, open Connect your site and press Copy next to your line. It holds your website's own key, so always copy it from there.

Where it goes

• WordPress: Bot and Spam Protection is not for WordPress websites. Install the WordPress plugin instead.
• Wix: Settings, then Custom code, then Add Custom Code. Paste it, choose All pages and Head, then apply.
• Squarespace: Settings, then Advanced, then Code Injection. Paste it into Header and save.
• Shopify: Online Store, then Themes, then the three dots, then Edit code. Open theme.liquid and paste it just before </head>, then save.
• Anything else: ask your web designer to add it to the header of every page.

Then check it

Go back to Connect your site and press Check again. Once we find it, the step shows Found on your home page. That also proves the website is yours, so there is nothing else to do.

Set it up

1. In your dashboard, open Connect your site and press Download the file. Its name starts with rabbitproof-, and it is made for your website only.
2. In your hosting's file manager, open your website's main folder: the one with your home page in it. It is usually called public_html, www or htdocs.
3. Upload the file there. Don't rename it.
4. Back in your dashboard, press Open the installer. It opens on your website and takes you through each step.

What the installer does

• Checks your website first and changes nothing.
• Backs up every file it might change, as a download for your computer. Nothing is copied onto your server.
• Spam and bot protection: a small piece of Rabbitproof code at the top of your website's main file, and of any other file your forms use. Choose Add it for me, or I'll add it myself to paste it in yourself.
• Your pages: the same check on your website's plain pages, so bots are spotted on every page. Add it for you, or paste it in yourself.
• Block vulnerability scans: a few rules in your website's settings file, if your hosting allows it. Your own settings stay as they are.

If the Rabbitproof file is ever deleted, our code does nothing and your website keeps working.

Install it yourself

Rather do it by hand? In Connect your site, choose Install it myself. After the download and the upload, it shows each part to copy:

• One line for the very top of your website's main file, index.php, and of any other file your forms send to. It names those files for you.
• One line for your plain pages, the ones ending in .html, in each page's header. Only if your website has them.
• A few rules for the top of your website's .htaccess file, to block vulnerability scans. If your hosting uses nginx, it gives you a message to send your web host instead.

Then press Check my website. It ticks over once Rabbitproof hears from your website.

If a file needs a developer

Some files can't have anything added at the very top. The installer leaves those alone and tells you which ones. Ask your developer to add our code.

To take it off

In your dashboard, open Connect your site and press Take off. It takes out only what Rabbitproof added and keeps any other changes you made since. If our code is anywhere it can't take out, it tells you where to delete it. Then delete the file.

Wix, Squarespace, Shopify and other builders

They don't let you upload files, and neither does hosting that doesn't run PHP, so paste our code into your website's header instead.

Add this record (your dashboard shows your own value under Connect your site):

• If there is already a record for www, change it rather than adding a second one.
• Your email and everything else stay as they are. Only www changes. Visitors who leave out www still reach your server directly until you lock your server: the lock lines also send them on to www.
• Your hosting control panel, like cPanel, still opens from your web host's own login page or the server address in your hosting welcome email. It won't open through www once it points at us.
• Changing your domain records can briefly interrupt your website, so do it at a quiet time.
• The secure padlock for your website is set up for you. It can take up to an hour.

Add a DNS record

Where to find it

In your hosting control panel

Sign in where you pay for your website's hosting. In cPanel, it is on the right under General Information or Server Information, called Shared IP Address or Dedicated IP Address. In Plesk, open Websites & Domains and look for IP address. Other control panels usually show it on the main page, or under a heading like Server or Account details.

In your welcome email

The email your web host sent when you started hosting often lists it, as IP address or Server IP.

With a DNS lookup website

Search for "DNS lookup", enter your website's name without www (like yourwebsite.com) and look at the A record. That number, like 203.0.113.48, is your server IP.

Still not sure?

Ask your web host for "my website's server IP address". It is a common question and they can answer it straight away.

Add or change it

1. Open Connect your site in your dashboard.
2. In the step Tell us your server IP, enter the number (press Show, then Change, if one is already there). A server name your web host gave you works too.
3. Press Save, then enter your password.

We email you whenever it changes, so a change you did not make is noticed straight away.

Already on Cloudflare?

If your website already uses Cloudflare, the address we find is Cloudflare's, not your server's, so we leave it empty for you to add. In Cloudflare, keep your www record as a proxied CNAME to the address shown on Connect your site.

On WordPress

In WordPress, open Rabbitproof, then Protection, and press Lock it for me. The plugin adds the lines, checks your website still opens, and takes them out again by itself if it does not. Unlock takes them off.

On any other website

1. Open Connect your site in your dashboard and press Show me how to lock it.
2. Copy the lines and add them to the top of the .htaccess file in your website's main folder. Not sure where that is? Send the lines to your web host and ask them to add them.
3. Press Test again. Once it works, it shows Locked.

The lines also send visitors who leave out www on to your website.

• Log only counts the bots it finds and lets everyone in. Use it for the first few days. It still learns: bots using a proxy or VPN are remembered, and blocked on every Rabbitproof website, including yours as soon as you switch to Block.
• Block them stops the bots it finds from sending your forms (and, on Bot Management, from opening your pages).
• Off checks nothing.

Before you switch to Block, look at Spam and login protection on the Protection tab, and on Bot Management at Endpoints on the Allow list. If a payment service or another website sends information to yours, let it through first. The dashboard reminds you.

Visitors you unblocked

Everyone you unblock on Requests shows here, with their reference and country. They are allowed for 7 days. Keep allowing removes the 7 days, and Remove checks them again from now.

IP addresses

Add your office, your developer or your own monitoring. Anything from these addresses goes straight through, on every product. An address that changes, like most home internet, will need adding again when it changes.

Known bots Bot Management

Search engines, link previews and other bots confirmed to be who they say get in. Choose which picks the groups. AI crawlers and SEO tools stay out unless you let them in.

Endpoints

Rabbitproof checks everything unless you say otherwise, so this is where you allow an endpoint on your website. On Bot Management: payment services and other websites send information to yours from their own servers, and nobody opens a page first, so let them through. On Bot and Spam Protection: a page here never has its forms held. In the WordPress plugin: use it for a service that sends your forms for you, such as a booking system, or an app that signs in to your website. It is on the plugin's Allow list tab.

When your website is set up, we look for these addresses ourselves and add them to Endpoints on the Allow list, each with a tick. WooCommerce payment notices and the WordPress background tasks are already there.

Some services only show up once they send something. Switch to Log only for a day, then look at Endpoints: anything that would have been blocked shows with a cross and an Allow button. You can also add an endpoint yourself. Changes save straight away.

• Add a region, such as Europe, or a single country. Type in the box to find one.
• A visitor is blocked when they connect from a place on your list, or when their device's clock is set to a time zone there.
• Search engines (unless you turn them off) and your forms that always go through still get in.
• Visitors you unblocked still get in.
• Blocked visitors see a short page saying the website is not available in their region.

It can help show your business does not offer its services in those places. It is not legal advice.

1. Open Requests in your dashboard.
2. Ask them for the Reference shown on their screen, or the time they tried. Visits from the last 7 days can be found. Type either into the search box and press Enter. Their entry is marked.
3. Press Unblock on their entry, then Unblock again to confirm.
4. Ask them to send the form again. We never keep what people type. On WordPress, the plugin keeps their message on your own website, and unblocking them emails it to you.

They are let in for 7 days from the same connection and device, and listed on your Allow list, where Keep allowing removes the 7 days. If they change network (a phone moving from Wi-Fi to mobile data), they may need unblocking again.

Changed your mind? Press Undo on their entry and they are checked again. On WordPress you can also unblock, and Block again, from the plugin's own Requests tab.

• Automated browsers: automated and headless browsers.
• Same device, many connections: the same machine arriving from different internet connections within seconds.
• Detect proxies and VPNs: bots using proxies and VPNs.
• Bots seen on other websites: machines already caught as bots on other websites Rabbitproof protects are blocked on yours too.
• Keep out repeat offenders: a connection blocked twice in a day is kept out for 24 hours.
• Remember real visitors for: a real visitor is not checked again for 1, 7 or 30 days. 7 to start with.
• Block vulnerability scans Bot Management: bots hunting for the files that hold your settings and passwords, for known weak spots, and for unsecured ways into your server are turned away. On Bot and Spam Protection, Your server can do this on your own server.
• Pages to check Bot Management: every page, or only some. You can also name pages that are never checked.
• Device check Bot Management: the colours of the quick check a new visitor may see on Bot Management: white, black, or matching their device.
• Protect your numbered pages Bot Management: bots that jump through your page numbers are sent back to page 1.
• Honeypot link Bot Management: a hidden link real visitors never see. Bots that follow it are blocked. It needs Protect your numbered pages.

• It blocks all traffic to your website, before anything reaches your server. Your website is offline for everyone, including you, your customers and search engines.
• Visitors see a short "very high traffic" page instead of your website. Search engines treat it as temporary.
• While it is on, no requests are counted towards your monthly allowance, so an attack doesn't add to your bill.
• It stays on until you turn it off. The dashboard shows how many requests it has blocked, so you can see when the flood has died down.

Turn it on or off

1. Open Protection in your dashboard. Flood mitigation is the last card.
2. Turn it on, read the warning, tick that you understand and enter your password.
3. When the blocked requests have dropped back to almost nothing, press Turn off flood mitigation. Your website comes back for everyone within a minute.

Use it only when your website can't cope. For everyday bots, Block them is the right setting.

What counts

Every product counts requests. Each product's exact terms are under Pricing information on its page.

• WordPress Plugin: each time a visitor is checked, the report their browser sends back, and each form sent to your website. Scanners turned away are never counted.
• Bot and Spam Protection: each time Rabbitproof checks a visitor on your website, and the report their browser sends back.
• Bot Management: each time a page, picture, script, file or form goes through Rabbitproof.

Prices

How billing works

• Each website has its own billing period, from the day its billing started. The product is charged in advance at the start of each period.
• Extra requests are added to the next bill, charged for exactly what you used. Included requests do not roll over.
• Moving up (Bot and Spam Protection to Bot Management, or the WordPress Plugin to Bot Management for WordPress) happens at once, charged for the days left until your next bill. Moving down happens when the billing period ends, or today if you choose. Stopping happens when the billing period ends. No refunds. Products and billing
• If a payment fails, Stripe tries the card again. If it still cannot be paid, the product stops and nothing is checked.

Budget alerts

• On the Billing tab, we can email you when 85% of your included requests are used, when all of them are used, and when extra requests in a billing period pass an amount you choose (any whole amount from A$1 to A$1,000, starting at A$20). All three are on to start with, and show once billing is running.
• They are alerts only: Rabbitproof keeps protecting your website and the extra keeps counting.
• The top of the Requests tab shows the requests used this billing period. The Billing tab shows this billing period as a bill: the monthly fee, the included requests, the extra and what it costs so far.

• WordPress Plugin: keeps spam and automated bots out of your WordPress forms and refuses scanners looking for your secret files, on your own server.
• Bot and Spam Protection: paste one line into any website you can add a line to, except WordPress websites. It checks every visitor and keeps bots out of your forms.
• Bot Management: protects your whole website, WordPress included. It needs your www record pointed at us, so it is not for websites hosted on Wix, Squarespace or Shopify, which need that record pointed at them. On a WordPress website it is called Bot Management for WordPress. It checks visitors on every page and form, and adds geoblocking, locking your server's back door and protection for your numbered lists.

Bot Management checks visitors before they reach your website, so it covers your whole website, not just the pages people open.

Each product includes requests each billing period; extra goes on your next bill. What it costs

You choose a product when you add your website. Bot and Spam Protection and Bot Management start once you set up a payment method on Stripe's page. The WordPress Plugin starts straight away: set up a payment method before its first 5,000 requests are used, or checking pauses until you do. On those two, billing starts once your website has used its first 10,000 or 50,000 requests. Once for each website address. Your card details never reach us. Each website has its own billing period, from the day its billing started.

On the Billing tab, Change lets you move a website to its other product or stop it; a WordPress website moves between the WordPress Plugin and Bot Management for WordPress. Moving up starts straight away. Moving down happens when the billing period ends, or today if you choose: then the new price is charged today, your billing period starts again from today, and the rest of the old period is not refunded. Stopping happens when the billing period ends: you keep what you have paid for until then, and any extra requests not yet billed go on one last bill. A move waiting for the end of the period can be kept with the Keep button, or made today with Move now instead. You can change product once each billing period. Change on the Payment method row opens Stripe's page for your card, invoices and receipts; before a card is saved it says Set up payment method.

To remove a website, open Connect your site and Remove this website at the bottom. On Bot Management, change your www record back first, or your website stops opening.

This website uses Rabbitproof (rabbitproof.com.au) to protect it from bots and spam. When you visit, Rabbitproof checks your browser and device and the internet address you connect from, to tell people and bots apart. It sets a cookie so you are not checked again on every page. This information is used only to protect this website and other websites that use Rabbitproof, and is kept for a short time. Rabbitproof's privacy policy: rabbitproof.com.au/privacy.

What it does

When a website is added and proved, the scanner reads its pages once, then again every week. It looks for the forms on the website, its numbered lists (page 2, 3 and on) and, on WordPress, the addresses payment services send to. It keeps those addresses and nothing else from the pages.

How it behaves

• It says who it is: RabbitproofScanner/1.0 (+https://rabbitproof.com.au/help#scanner).
• It follows robots.txt.
• It reads at most 200 pages, one at a time, with a pause between.
• It never sends a form, signs in or adds anything to a cart.

Stop it

If it's your website, remove the website from your Rabbitproof dashboard. If it isn't, and you'd like it to stop, add User-agent: RabbitproofScanner and Disallow: / to your robots.txt.

The DNS record is not found

Wait up to an hour and press Check again. Make sure the name is _rabbitproof and that your provider did not add your domain twice (some add it for you).

The Rabbitproof code is not found

Make sure it is in your website's header, so it is on your home page. Wait a minute after saving, then press Check again on Connect your site. Where the code goes

A customer says their form "could not be sent"

That is the message a blocked visitor sees. Unblock them from the Requests tab.

A payment did not come through

The payment service's notice may have been blocked. Let it through on the Allow list (Bot Management), or write to us.

Still stuck?

Sign in and open Support in your dashboard. No account yet? Contact us.