[ BruteBank :: Support ]
Get unstuck.
Stay protected.
Setup instructions, configuration notes, and answers for keeping your WordPress site connected to BruteBank.
documentation online
01 connect your site
02 install the plugin
03 block the threat
// start here
Create your connection
Your public key identifies the site. Your secret key keeps the connection private.
Open Servers
Log in to your account and select “Servers” from the navigation menu.
Add a site
Enter a name for the WordPress site being protected, then select Add New Server.
Save both keys
Store the generated public and secret keys safely. The secret key will not be shown again.
// install + configure
Put BruteBank to work
Install in WordPress
- Sign in to your BruteBank account and download the WordPress plugin ZIP.
- In WP-Admin, go to Plugins → Add New Plugin, then select Upload Plugin.
- Choose the downloaded ZIP file, select Install Now, and wait for installation to finish.
- Select Activate Plugin.
Connect your keys
- Open the BruteBank item in the WordPress admin menu.
- Paste your Public Key and Secret Key into the plugin fields.
- Select Save/Update. Your site is now reporting attacks.
// faq
Frequently asked questions
How much does BruteBank cost?+
Plans start at $32.95 per month for one site. Larger monthly plans cover up to 20 sites. See the pricing options on the WordPress plugin page.
How does the trial work?+
New accounts include a 7-day free trial. Subscribe securely through Stripe from your billing page to continue BruteBank service after the trial.
Can BruteBank detect attacks that rotate IP addresses?+
Yes. Username burst protection combines reported attempts from multiple IPs targeting the same username and service on one site within 5 minutes. When the combined count reaches your Auto Block threshold, participating IPs are added to your block list. Enable it by choosing an Auto Block threshold in your account Profile; setting Auto Block to None disables this detection. It blocks IPs, not usernames, so the targeted username is not locked. Connected WordPress plugins pick up the shared block list during their next five-minute sync.
How do I disable the WordPress username endpoint?+
Install BruteBank plugin v2.7 or later. In WP-Admin → BruteBank → Protection, enable Disable username endpoint and select Save/Update with valid server keys. It is off by default and works independently of login monitoring. When enabled, it removes /wp/v2/users and /wp/v2/users/(?P<id>[\d]+) from the WordPress REST API. Uncheck the setting and save to restore the routes.
Will disabling the username endpoint affect integrations?+
It can. The user-list and individual-user routes are removed for authenticated requests too, so integrations that use them may stop working. The /wp/v2/users/me route is unchanged. Test your integrations before enabling the setting. It only removes these two REST routes; usernames may still be visible elsewhere on your site.
How do I set a Content Security Policy?+
Install the updated BruteBank plugin v2.8 package. In WP-Admin → BruteBank → Security headers, enter a CSP header value such as default-src 'self', check Enable Content Security Policy, and save with valid server keys. It is off by default and applies to WordPress frontend responses, not admin or login pages. That example blocks inline scripts/styles and third-party resources, which can break themes, forms, CAPTCHA, and checkout. Test and tailor the policy on staging first. Purge page/CDN caches after changes and rerun your scan. Existing server or CDN policies may also apply.
How do I add referrer, framing, and HSTS headers?+
Use the updated v2.8 plugin package. In WP-Admin → BruteBank → Security headers, enable Referrer-Policy (suggested strict-origin-when-cross-origin) and, where appropriate, X-Frame-Options: SAMEORIGIN or DENY. Alternatively add frame-ancestors 'self' or 'none' to your CSP, keeping framing policies consistent. HSTS is off by default: verify reliable HTTPS and a valid certificate, open settings over HTTPS, and confirm before enabling. Start max-age at 300 seconds and increase gradually after testing. HSTS is sent only on HTTPS, never includes subdomains or preload, and persists in browsers even after disabling it. The plugin leaves existing PHP headers in place; configure server/CDN headers and caches separately. Reinstall the updated package to receive these additions; the version number is unchanged.
Which WordPress forms work with invisible CAPTCHA?+
The BruteBank plugin supports WPForms, Contact Form 7, Elementor Pro Forms, and Gravity Forms. Elementor integration requires Elementor Pro. Visitors do not have to solve a puzzle.
Can I review form submissions blocked by CAPTCHA?+
Yes. The plugin keeps a local audit of supported form submissions, including CAPTCHA results, submitted fields, IP addresses, and copied attachments. Search and filter the audit, set a retention period, and review possible false positives in the BruteBank settings page.
Can I block an IP from the form audit?+
Yes. Use Block IP on an audit entry to send the block to BruteBank and enforce it immediately on that WordPress site. Other connected plugin sites pick up the shared block during their next five-minute sync.
Do I need the iOS app to protect my WordPress site?+
No. The WordPress plugin connects directly to your BruteBank account. The iOS app is optional for alerts and managing blocks.
Where do I download the WordPress plugin?+
Sign in to your BruteBank account and use the WordPress plugin download in the account sidebar. Then upload the ZIP from WP-Admin → Plugins → Add New Plugin.
I lost my secret key. How do I replace it?+
Open the server details page in your BruteBank account and reset the secret key. The old key is invalidated; update the new key in your WordPress plugin settings.
Can I invite other users?+
Yes. You can invite an unlimited number of users to your team.
Where can I contact support?+
Contact our support team through the Contact Us page.